Brenneck Pay - Security Questionnaire
Documentfinal Brenneck Pay: documents · security_questionnaire · final · 2025-11-05
Final security questionnaire dated 5 Nov 2025 from Anya Petrova for Brenneck Pay, a BaFin-supervised payment institution, on the Growth tier with EU data. It states positions and leaves connectors, users and credit terms to the contract.
What it says
What this says
Current to 11 Oct 26Final security questionnaire dated 5 Nov 2025 from Anya Petrova for Brenneck Pay, a BaFin-supervised payment institution, on the Growth tier with EU data. It states positions and leaves connectors, users and credit terms to the contract.
What it is: BB-Demo's answers to Brenneck Pay's security questions, version one, marked "Final". It is a position statement, not an order form.
Commits: Data stays in the EU region of Brenneck Pay's own Snowflake account. The nightly refresh completes "by 07:00 customer local time on business days", and on Growth service credits cover availability only.
Unusual: Single sign-on and SCIM are Enterprise only, so they are not in Growth. Sandbox, Premium support and dedicated residency are add-ons.
Not settled: Section F leaves the connector list, user allowance and exact service credit terms to the executed documents. The questionnaire says the MSA and data processing terms govern if they differ.
As found in this document
Current to 9 Oct 26- Data locationIn the EU region of Brenneck Pay's Snowflake account, in line with the requirement to keep the data in an EU region.In the EU region of Brenneck Pay's Snowflake account, in line with the requirement to keep the data in an EU region. · Source: object_read:doc_078_001
- Nightly refreshThe nightly refresh completes by 07:00 customer local time on business days.The nightly refresh completes by 07:00 customer local time on business days. · Source: object_read:doc_078_001
- Service credits on Growthon Growth, service credits cover availability onlyon Growth, service credits cover availability only · Source: object_read:doc_078_001
- Connector deliveryConnectors promised there carry a commitment to be live within an agreed number of days.Connectors promised there carry a commitment to be live within an agreed number of days. · Source: object_read:doc_078_001
The document
Body
Brenneck Pay - Security Questionnaire
Status: Final Prepared by: Anya Petrova, Solutions Engineer, BB-Demo Date: 5 Nov 2025 Prepared for: Brenneck Pay, Frankfurt Tier under review: Growth
Purpose and scope
This document records BB-Demo's answers to the security questions raised by Brenneck Pay. Brenneck Pay is a payment institution supervised by BaFin, and its merchant account managers and merchant risk team intend to work from one view of each merchant on the Growth tier, with the data kept in an EU region.
The answers describe the company brain as it would be delivered to Brenneck Pay on the Growth tier. Where an answer depends on a setting in Brenneck Pay's own environment, the answer says so rather than promising a control that BB-Demo does not operate.
How to read the answers
- Answered means BB-Demo can state the position from how the product is built and delivered.
- Customer-controlled means the control sits in Brenneck Pay's own Snowflake account and is set by Brenneck Pay.
- Contractual means the position is fixed in the order form, the MSA or the data processing terms, which take precedence over this document.
Read the whole document (6,198 characters)
A. Architecture and data location
| Ref | Question | Answer | Basis |
|---|---|---|---|
| A-one | Where does the platform run? | BB-Demo runs inside the customer's own Snowflake account. The brain is built and operated there, not in a BB-Demo-hosted copy of the customer's data. | Answered |
| A-two | Where is the data stored? | In the EU region of Brenneck Pay's Snowflake account, in line with the requirement to keep the data in an EU region. | Answered, confirmed in the order form |
| A-three | Is customer data copied to BB-Demo systems for its own use? | No. The data stays in the customer's account. BB-Demo does not take a separate copy for its own purposes. | Answered |
| A-four | Is dedicated data residency needed? | The EU region requirement is handled as part of the Growth engagement. A dedicated residency add-on exists and can be discussed if Brenneck Pay's compliance team wants it written in as a separate line. | Contractual |
B. Access control
| Ref | Question | Answer | Basis |
|---|---|---|---|
| B-one | How are users authenticated? | Users sign in through the product's standard authentication. Single sign-on and SCIM provisioning are part of the Enterprise tier and are not included in Growth. | Answered |
| B-two | Who can see which data? | Access to the brain follows the permissions configured for each connected source and for each team. Brenneck Pay chooses which teams and sources are connected. | Customer-controlled |
| B-three | Can merchant risk data be separated from account management data? | Yes. Sources can be scoped by team, so risk material can be limited to the people who should see it. Brenneck Pay's own policy decides the split. | Customer-controlled |
| B-four | Do BB-Demo staff have standing access to customer data? | Access by BB-Demo staff is limited to what is needed to deliver and support the service inside the customer's account, and is granted by the customer. | Answered |
C. Connected systems
| Ref | Question | Answer | Basis |
|---|---|---|---|
| C-one | Which systems will be connected? | The connector list is agreed in the order form. Connectors promised there carry a commitment to be live within an agreed number of days. | Contractual |
| C-two | Can a connector be removed? | Yes. Brenneck Pay can disconnect a source at any time, and indexed content from that source stops being refreshed. | Customer-controlled |
| C-three | Is a connector limit enforced? | The Growth tier carries a hard connector limit. Additional connectors are available as an add-on. | Contractual |
D. Availability, freshness and support
| Ref | Question | Answer | Basis |
|---|---|---|---|
| D-one | What availability is committed? | The standard Growth availability service level applies, with service credits for availability breaches as set out in the order form. | Contractual |
| D-two | How fresh is the data? | The nightly refresh completes by 07:00 customer local time on business days. Availability and freshness are separate measures; on Growth, service credits cover availability only. | Contractual |
| D-three | How quickly is a priority incident answered? | The Growth first-response service level for priority one incidents applies. Premium support with a named engineer is an optional add-on. | Contractual |
| D-four | Is there a test environment? | A Sandbox is available as an add-on. It is not part of the base Growth tier. | Contractual |
E. Regulatory position
| Ref | Question | Answer | Basis |
|---|---|---|---|
| E-one | Does BB-Demo understand Brenneck Pay's supervised status? | Yes. We have taken into account that Brenneck Pay is supervised by BaFin and that its security and outsourcing reviews will apply to this engagement. | Answered |
| E-two | Will BB-Demo support Brenneck Pay's own review? | Yes. Further evidence requests from Brenneck Pay's compliance and risk teams will be answered through Anya Petrova, with the account owner Matteo Ricci and the customer success manager Elena Novak kept informed. | Answered |
| E-three | Where is the processing relationship set out? | In the MSA and the data processing terms that accompany the order form. Those documents govern if they differ from this questionnaire. | Contractual |
F. Items left to the contract
The following are deliberately not stated here and will be fixed in the executed documents:
- the final connector list and the live-within commitments;
- the user allowance for the Growth tier and any additional users;
- the exact service credit terms;
- any dedicated residency, Premium support or Sandbox add-ons Brenneck Pay chooses.
G. Contacts
| Role | Name |
|---|---|
| Solutions Engineer, BB-Demo | Anya Petrova |
| Account owner, BB-Demo | Matteo Ricci |
| Customer success manager, BB-Demo | Elena Novak |
Sign-off
This questionnaire is final at version one and reflects BB-Demo's position on 5 Nov 2025. Any later change to the Growth offering or to Brenneck Pay's requirements will be issued as a new version.
Unusual terms
Current to 9 Oct 26- EU region data requirement
- BaFin-supervised customer
- SSO and SCIM not in Growth