Delancey Haig - Security Questionnaire
Documentfinal Delancey Haig: documents · security_questionnaire · final · 2024-05-06
Final security questionnaire completed on 6 May 2024 by Hannah Lowe for Delancey Haig's Growth evaluation. P1 first response is within one business hour; availability is left to the order form. Not tied to an order form, no price recorded.
What it says
What this says
Current to 11 Oct 26Final security questionnaire completed on 6 May 2024 by Hannah Lowe for Delancey Haig's Growth evaluation. P1 first response is within one business hour; availability is left to the order form. Not tied to an order form, no price recorded.
What it is: BB-Demo's answers to security and data-handling questions during the Growth evaluation. It states "It has not yet been tied to an order form, and no contract value is recorded against it."
Commits: nightly refresh "complete by 07:00 customer local time on business days", and first response to a priority-one issue "within one business hour". Growth service credits "cover availability only".
Unusual: nothing off standard terms. It deliberately disclaims certification, SSO, SCIM, Sandbox, Premium support and residency beyond the order form.
Not settled: the availability percentage, connector list, user allowance and price. The text says the executed order form and MSA take precedence, so this is not a contract and reflects the position only as at 6 May 2024.
As found in this document
Current to 9 Oct 26- Nightly refreshcomplete by 07:00 customer local time on business dayscomplete by 07:00 customer local time on business days · Source: object_read:doc_077_001
- P1 first response (Growth)within one business hourSource: object_read:doc_077_001
- Service credits (Growth)cover availability onlySource: object_read:doc_077_001
The document
Body
Delancey Haig - Security Questionnaire
Status: Final Version: one Completed: Monday 6 May 2024 Prepared by: Hannah Lowe, Solutions Engineer, BB-Demo Prepared for: Delancey Haig, London Tier under discussion: Growth
Purpose and scope
Delancey Haig is a London recruitment group placing technology and finance professionals on contract and permanent terms. It is evaluating the Growth tier so that client-account directors can see each client's vacancies, placements, invoices and complaints together. This questionnaire records BB-Demo's answers to the security and data-handling questions raised during that evaluation.
Where an answer depends on a contract term, the executed order form and the MSA take precedence over this document. Where a control is not part of the Growth tier, the answer says so plainly rather than describing it as available.
How the product is deployed
Read the whole document (6,108 characters)
| Ref | Question | Response |
|---|---|---|
| A | Where does the product run? | The company brain is built and run inside the customer's own Snowflake account. BB-Demo does not move the customer's data into a separate BB-Demo-owned data store to serve queries. |
| B | Who owns the data held in the brain? | The customer. The brain is a layer over the customer's own systems, and the data stays in the customer's Snowflake account. |
| C | Which source systems can be connected? | Systems such as Salesforce, HubSpot, Zendesk, Xero, Gong, Microsoft 365, Google Workspace, Dropbox and SharePoint can be connected. The number of connectors is set by the Growth connector allowance, and the connectors promised are listed in the order form. |
| D | Can data be held in a specific region? | Dedicated EU or US data residency is an optional add-on. It is not included in Growth by default and would need to be named in the order form. |
| E | Is there a separate test environment? | The Sandbox is an add-on that sits with the Enterprise tier from the second price book. It is not part of Growth. |
Access control and identity
| Ref | Question | Response |
|---|---|---|
| F | Is single sign-on supported? | SSO and SCIM are Enterprise features. They are not included in Growth. To be precise, Growth users sign in with the access method agreed at implementation, and any move to SSO would be an upgrade conversation. |
| G | How are users limited? | Each tier has an included user number. Growth has its own allowance, and additional blocks of users can be added by order form. |
| H | Who administers the brain on the customer side? | Named administrators nominated by Delancey Haig. We recommend more than one, so that a single departure does not leave the brain without an administrator. |
| I | Can access be limited by team? | The brain is set up around the teams in scope. For Delancey Haig that is the client-account directors first. Any wider rollout would be agreed in writing before it is configured. |
Data protection
| Ref | Question | Response |
|---|---|---|
| J | How is data protected at rest and in transit? | Data sits in the customer's Snowflake account and is protected by the controls the customer has configured there. Connector traffic uses the connection methods supported by each source system. The short answer is that BB-Demo inherits the customer's Snowflake controls. The longer answer is that the exact configuration is confirmed in writing during implementation. |
| K | Does BB-Demo use customer data to train models for other customers? | No. Each brain is built and run for one customer inside that customer's own account. |
| L | What happens to data at the end of the contract? | Because the data lives in the customer's Snowflake account, the customer retains it. Removal of BB-Demo's connectors and access is arranged at termination and confirmed in writing. |
| M | Is personal data of candidates in scope? | It may be, depending on which source systems are connected. Delancey Haig should decide which sources and fields are included before connectors are switched on, and we will document that decision with the order form. |
Availability, freshness and support
| Ref | Question | Response |
|---|---|---|
| N | What availability is committed on Growth? | The Growth service level for availability applies, as set out in the order form. Service credits on Growth cover availability only. |
| O | How current is the data? | The nightly refresh is complete by 07:00 customer local time on business days. To be precise, freshness is a target for every tier, but only Enterprise carries service credits for it. |
| P | How quickly is a priority-one issue answered? | On Growth, first response to a priority-one issue is within one business hour. |
| Q | Is out-of-hours or named-engineer support included? | No. Premium support, with a named engineer, is an add-on and is not part of Growth. |
People and process
| Ref | Question | Response |
|---|---|---|
| R | Who is the security contact at BB-Demo? | Hannah Lowe, Solutions Engineer, runs security reviews and is the first point of contact for questions about this document. |
| S | Who at the customer is involved in implementation? | The people Delancey Haig nominates. Account ownership at BB-Demo sits with Priya Raman and adoption with Daniel Okafor. |
| T | Will further questions be answered? | Yes. Any question not answered here will be answered in writing before signature. If Hannah is not certain of an answer she will check internally first rather than guess. |
Points deliberately not claimed
To avoid overstating anything, this document does not claim:
- any certification or external audit report. If Delancey Haig needs one, we will provide the position in writing.
- SSO, SCIM, Sandbox or Premium support as part of Growth.
- any data residency commitment beyond what is named in an executed order form.
Sign-off
This questionnaire is final at version one and reflects BB-Demo's position on Monday 6 May 2024. It has not yet been tied to an order form, and no contract value is recorded against it.
Thanks, Hannah
Hannah Lowe Solutions Engineer, BB-Demo