Merriott Lyle Distribution - Security Questionnaire
Documentfinal Merriott Lyle Distribution · security_questionnaire · final · 2024-12-26
BB-Demo's completed security review answers for a prospect evaluating Enterprise, dated 26 Dec 2024. It quotes a P1 first response of thirty minutes and nightly refresh by 07:00. It is not a contract and states no price.
What it says
What this says
Current to 13 Oct 26BB-Demo's completed security review answers for a prospect evaluating Enterprise, dated 26 Dec 2024. It quotes a P1 first response of thirty minutes and nightly refresh by 07:00. It is not a contract and states no price.
What it is: a final, version one questionnaire prepared by Hannah Lowe for Merriott Lyle Distribution, which is evaluating the Enterprise tier. It says the platform runs "Inside the customer's own Snowflake account".
Commits: it restates standard Enterprise terms: SSO and SCIM included, P1 first response within thirty minutes, and service credits for both availability and data freshness. Refresh is "Nightly, completed by 07:00 customer local time on business days".
Not settled: availability is only "as written in the executed order form", with no percentage. Connector delivery days are left to the order form. Five topics, including encryption and penetration testing evidence, are held for written confirmation from the information security lead.
Status: it says it is "not a contract" and the customer is a prospect with no contracted annual recurring revenue at that date.
As found in this document
Current to 9 Oct 26- P1 first response (Enterprise)First response within thirty minutes on the Enterprise tier.First response within thirty minutes on the Enterprise tier. · Source: object_read:doc_076_001
- Data refreshNightly, completed by 07:00 customer local time on business days. This applies to every tier.Nightly, completed by 07:00 customer local time on business days. This applies to every tier. · Source: object_read:doc_076_001
- Service credits (Enterprise)On Enterprise, service credits apply to both availability and data freshness.On Enterprise, service credits apply to both availability and data freshness. · Source: object_read:doc_076_001
- AvailabilityThe Enterprise availability commitment, as written in the executed order form.The Enterprise availability commitment, as written in the executed order form. · Source: object_read:doc_076_001
- Connector deliveryConnectors named in the order form carry a commitment to be live within an agreed number of days.Connectors named in the order form carry a commitment to be live within an agreed number of days. · Source: object_read:doc_076_001
The document
Body
Merriott Lyle Distribution - Security Questionnaire
Status: Final, version one Date completed: 26 Dec 2024 Prepared by: Hannah Lowe, Solutions Engineer, BB-Demo Customer: Merriott Lyle Distribution, Birmingham Tier under review: Enterprise Commercial owner: Lewis Kerr, BB-Demo Customer success manager: Daniel Okafor, BB-Demo
Purpose and scope
This questionnaire records BB-Demo's answers to the security review for Merriott Lyle Distribution, a wholesale distributor of builders' and plumbing and heating supplies. The company is evaluating the Enterprise tier so that its branch, key-account and credit-control teams can see each trade account's orders, disputes, calls and invoices together.
The answers describe the company brain as BB-Demo delivers it. To be precise, where a control depends on the customer's own Snowflake account or on the signed order form, the answer says so rather than claiming it for BB-Demo alone. Where a question needs a written confirmation from our information security lead, the answer says that too.
Section A: Architecture and data location
Read the whole document (5,587 characters)
| Question | Response |
|---|---|
| Where does the platform run? | Inside the customer's own Snowflake account. BB-Demo does not copy the customer's data into a separate BB-Demo-hosted store. |
| Who owns the data? | The customer. The brain is a queryable layer over the customer's systems, built and run in the customer's environment. |
| Which source systems can be connected? | Systems such as Salesforce, HubSpot, Zendesk, Xero, Gong, Microsoft 365, Google Workspace, Dropbox, SharePoint and Slack, subject to the connector allowance in the order form. |
| Can data residency be fixed to a region? | Yes, through the dedicated EU or US data residency add-on. Merriott Lyle Distribution is UK based and has not asked for a change in region. |
| How often is the data refreshed? | Nightly, completed by 07:00 customer local time on business days. This applies to every tier. |
Section B: Access control and identity
| Question | Response |
|---|---|
| Is single sign-on supported? | Yes. SSO and SCIM are included in the Enterprise tier. |
| Can user provisioning be automated? | Yes, through SCIM, so that joiners, movers and leavers in the customer's identity provider are reflected in the brain. |
| Does BB-Demo staff access customer data? | Access is limited to what is needed to implement and support the service, and takes place inside the customer's Snowflake account under the customer's own access rules. The short answer is yes where support requires it; the longer answer is that the customer controls the grant. |
| Are users limited by role? | Access follows the roles the customer defines in its own environment. Admin rights should be held by more than one named person, which we recommend as good practice. |
Section C: Availability and support
| Question | Response |
|---|---|
| What availability is committed? | The Enterprise availability commitment, as written in the executed order form. |
| What is the response to a priority one incident? | First response within thirty minutes on the Enterprise tier. |
| Is there a service credit? | On Enterprise, service credits apply to both availability and data freshness. Availability is not the same as freshness, and both are covered at this tier. |
| Is premium support available? | Yes, as an Enterprise feature from the second version of the offering: a named engineer between 07:00 and 20:00 UK time. |
| Is a test environment available? | Yes, the Sandbox, as an Enterprise feature from the second version of the offering. |
Section D: Implementation and change
| Question | Response |
|---|---|
| How is the implementation delivered? | As a one-off, fixed-fee implementation for Enterprise, including security review support, of the kind this questionnaire forms part of. |
| How are connectors commissioned? | Connectors named in the order form carry a commitment to be live within an agreed number of days. The exact figure is set in the order form and not in this document. |
| Is training available? | Yes, including an on-site training day as an add-on. |
Section E: Items for written confirmation
The following topics were raised during the review. BB-Demo does not give an answer here that it has not checked, so each is held for written confirmation from our information security lead, and Hannah Lowe will put the answers in writing.
- Encryption configuration details specific to the customer's Snowflake account.
- Logging and audit retention settings for the customer's environment.
- Sub-processor and hosting arrangements to be listed in the data processing agreement.
- Business continuity and recovery arrangements, to be described against the order form commitments.
- Penetration testing and independent assurance evidence, to be shared under confidentiality.
Section F: Limits of this document
- This questionnaire is not a contract. The executed order form and master agreement decide contracted terms, including any service levels that differ from the standard Enterprise position.
- The customer is currently a prospect, so no contracted annual recurring revenue exists at this date.
- Allowances for users and connectors follow the Enterprise tier as set out in the order form.
Sign-off
| Role | Name | Date |
|---|---|---|
| Completed by, Solutions Engineer, BB-Demo | Hannah Lowe | 26 Dec 2024 |
| Account owner, BB-Demo | Lewis Kerr | 26 Dec 2024 |
| Customer success manager, BB-Demo | Daniel Okafor | 26 Dec 2024 |
Thanks, Hannah