Rookhaven Asset Management - Security Questionnaire
Documentfinal Rookhaven Asset Management: documents · security_questionnaire · final · 2026-08-01
Final security questionnaire from Theo Gallagher for Rookhaven's Enterprise evaluation, dated 1 Aug 2026. It is not a contract: it states no availability figure, P1 response time or price, and leaves three answers to confirm.
What it says
What this says
Current to 11 Oct 26Final security questionnaire from Theo Gallagher for Rookhaven's Enterprise evaluation, dated 1 Aug 2026. It is not a contract: it states no availability figure, P1 response time or price, and leaves three answers to confirm.
What it is: a pre-sale security questionnaire for the Enterprise tier, prepared by Theo Gallagher with Tom Ashdown named as account owner. It says "This questionnaire reflects what we can state today. It is not a contract."
Commits: nothing binding. It points to the order form for the availability figure and first-response time, and restates that nightly refresh is complete by 07:00 customer local time on business days.
Unusual: no non-standard terms. SSO, SCIM, residency, Premium support and Sandbox are marked as options, in place only if contracted.
Not settled: access for BB-Demo staff, certification evidence and the exit plan are all marked To confirm. The region choice is open with Tom, and no contracted terms appear.
As found in this document
Current to 9 Oct 26- Nightly refreshNightly refresh is complete by 07:00 customer local time on business days.Nightly refresh is complete by 07:00 customer local time on business days. · Source: object_read:doc_040_001
- Service credits (Enterprise)For Enterprise, service credits apply to availability and to data freshness.For Enterprise, service credits apply to availability and to data freshness. · Source: object_read:doc_040_001
- Availability and P1 responseThe exact figure is set out in the order form.The exact figure is set out in the order form. · Source: object_read:doc_040_001
The document
Body
Rookhaven Asset Management - Security Questionnaire
Prepared for: Rookhaven Asset Management Prepared by: Theo Gallagher, Solutions Engineer, BB-Demo Account owner: Tom Ashdown Date: 1 Aug 2026 Tier under evaluation: Enterprise Status: Final
Purpose and scope
Rookhaven Asset Management is evaluating the Enterprise tier so that client service and distribution can share one view of each client. This document answers the security questions raised during the evaluation. Where a control is not described below, we have said so rather than imply it exists. Where evidence is available, it is listed in the right-hand column and can be supplied on request.
How to read the answers
- In place means the control exists and we can evidence it.
- Option means it is available under the Enterprise tier or as an add-on, and is only in place if contracted.
- To confirm means the answer depends on the platform team or on your own configuration, and we will provide a dated commitment.
A. Architecture and data location
Read the whole document (4,841 characters)
| Ref | Question | Answer | Status | Evidence |
|---|---|---|---|---|
| ARCH-a | Where does the data live? | BB-Demo is built and run inside the customer's own Snowflake account. Rookhaven data stays in your account and under your own Snowflake controls. | In place | Architecture overview |
| ARCH-b | Is customer data mixed with other customers' data? | No. Because the brain runs inside your Snowflake account, it is not co-mingled with another customer's data. | In place | Architecture overview |
| ARCH-c | Can data be held in a specific region? | Dedicated EU or US data residency is an add-on. For a London firm we would agree the region as part of scoping. | Option | Order form line, if contracted |
| ARCH-d | Which source systems connect? | Only the systems you choose to connect, for example Salesforce, HubSpot, Zendesk, Xero, Gong, Microsoft 365, Google Workspace, Dropbox, SharePoint or Slack. | In place | Connector list agreed at scoping |
B. Access and identity
| Ref | Question | Answer | Status | Evidence |
|---|---|---|---|---|
| ACC-a | Is single sign-on supported? | SSO is included in the Enterprise tier. | Option | Tier description |
| ACC-b | Is automated user provisioning supported? | SCIM is included in the Enterprise tier. | Option | Tier description |
| ACC-c | Who at BB-Demo can reach customer data? | To confirm. We will name the roles and the approval route in writing, and will not answer on behalf of the platform team until they have reviewed it. | To confirm | Written access statement |
C. Service levels and resilience
| Ref | Question | Answer | Status | Evidence |
|---|---|---|---|---|
| SLA-a | What availability is committed? | Enterprise carries the highest availability commitment in our service levels. The exact figure is set out in the order form. | In place | Order form |
| SLA-b | How quickly are priority incidents answered? | Enterprise has the fastest first-response commitment of the three tiers. Premium support, with a named engineer, is an add-on. | Option | Order form |
| SLA-c | Is data freshness covered? | Nightly refresh is complete by 07:00 customer local time on business days. For Enterprise, service credits apply to availability and to data freshness. | In place | Order form |
| SLA-d | Is there a test environment? | A Sandbox is available from the second version of the Enterprise tier as an add-on. | Option | Order form line, if contracted |
D. Assurance and governance
| Ref | Question | Answer | Status | Evidence |
|---|---|---|---|---|
| GOV-a | Is security review support provided? | Yes. Enterprise implementation includes security review support, and an executive sponsor is assigned. | In place | Implementation scope |
| GOV-b | Can you provide independent certification or test reports? | To confirm. We will list what exists and its date, and will not describe anything we cannot evidence. | To confirm | Evidence pack, to follow |
| GOV-c | What is the exit plan? | To confirm. Because the data sits in your Snowflake account, it remains with you; we will set out the removal of connectors and access as a written exit plan. | To confirm | Exit plan, to follow |
Open items and owners
| Item | Owner | Next step |
|---|---|---|
| Access statement for BB-Demo staff | Theo Gallagher, with the platform team | Written answer to Rookhaven |
| Certification and test evidence pack | Theo Gallagher | Share list with dates |
| Exit plan | Theo Gallagher | Share written plan |
| Region choice and any residency add-on | Tom Ashdown | Agree at scoping |
Notes
This questionnaire reflects what we can state today. It is not a contract. Contracted terms, including service levels and any add-ons, are set only by an executed order form under the MSA.
Thanks, Theo