Brenneck Pay - Security Questionnaire v1
Documentdraft Brenneck Pay · security questionnaire · draft · 30 Jun 2026
Draft security questionnaire from Theo Gallagher for Sabine Kranz, extending the DORA questionnaire with EU data residency for merchant-risk data. Several answers are open. It states no availability, P1 response time or price commitment.
What it says
What this says
As at Fri 9 Oct 2026Draft security questionnaire from Theo Gallagher for Sabine Kranz, extending the DORA questionnaire with EU data residency for merchant-risk data. Several answers are open. It states no availability, P1 response time or price commitment.
What it is: a draft dated 30 Jun 2026, written by Theo Gallagher for Sabine Kranz. It says "Not final" and "Until then this document should not be treated as final."
Commits: little. The only firm statements are that users are administered within the Growth allowance of 40 licensed users, and that single sign-on and SCIM are Enterprise features outside this subscription.
Unusual: the document says it states a subscription figure of £50k and a term end of 2 Feb 2027, but it is not a contract and the figure is not confirmed here as ARR.
Not settled: whether data leaves the EU region (RES-B), the chat and search processing path, log retention, the exit test, subcontractors and audit rights. Incident notification is deferred to the executed order form and MSA. The text does not show whether version two has been issued.
As found in this document
As at Fri 9 Oct 2026- Date end2 Feb 2027Source: the AI read of this record
- Licensed usersGrowth allowance of 40 licensed usersSource: the AI read of this record
- Data regionThe order for this account is for the data to be kept in an EU region.Source: the AI read of this record
- Incident notificationThe commitment is whatever the executed order form and MSA state.Source: the AI read of this record
The document
Body
Brenneck Pay - Security Questionnaire v1
Status: Draft. Not final. Answers marked "open" are waiting on evidence or on confirmation from the platform team.
| Customer | Brenneck Pay, Frankfurt |
| Respondent | Theo Gallagher, Solutions Engineer, BG-Demo |
| Requested by | Sabine Kranz, Information Security Officer, Brenneck Pay |
| Draft date | 30 Jun 2026 |
| Subscription | Growth, annual recurring revenue £50k, 40 licensed users |
| Customer since | 3 Feb 2026 |
| Current term ends | 2 Feb 2027 |
Purpose and scope
This questionnaire extends the DORA ICT third-party questionnaire already completed for Brenneck Pay with a section on data residency for the merchant-risk data. It covers B-Glass that BG-Demo runs for Brenneck Pay, so that merchant account managers and merchant risk work from one view of each merchant.
Each answer states what BG-Demo can evidence today and what is still open. Where an answer depends on the platform team, it is marked as such and not treated as confirmed.
How to read the status column
Read the whole document (6,054 characters)
- Evidenced: a document or log extract can be supplied with this questionnaire.
- Partly evidenced: the control exists, but the evidence supplied is incomplete.
- Open: no evidence yet. Not to be read as compliant.
Section A: Data residency for merchant-risk data
| Ref | Question | BG-Demo answer | Status | Owner |
|---|---|---|---|---|
| RES-A | Where exactly is the data processed? | The brain is built and run inside Brenneck Pay's own Snowflake account. Storage and processing therefore sit in the region of that account. The order for this account is for the data to be kept in an EU region. We will supply the account region as a dated extract. | Partly evidenced | Theo Gallagher |
| RES-B | Does any merchant-risk data leave the EU region, including for support or monitoring? | Not confirmed. We can describe the support access model, but the statement that no data is copied outside the region needs sign-off from the platform team. We will not give a verbal assurance. | Open | Theo Gallagher, with the platform team |
| RES-C | Which connected systems feed the merchant-risk view, and where do they sit? | Connectors are configured by Brenneck Pay's administrators. We will list each connected source with its hosting location as the customer reports it. BG-Demo does not control the hosting of those sources. | Partly evidenced | Theo Gallagher |
| RES-D | Are model prompts and answers processed in the same region as the data? | Open. The processing path for chat and search needs to be documented by the platform team before we answer. | Open | Platform team |
| RES-E | Can the region be changed later without a rebuild? | Open. We will give a written answer, not a commitment on the call. | Open | Theo Gallagher |
Section B: Access and logging
| Ref | Question | BG-Demo answer | Status | Owner |
|---|---|---|---|---|
| ACC-A | Who at BG-Demo can access the Brenneck Pay environment? | Access is limited to named staff with a support or delivery reason. We will provide the access list by role and the approval route. | Partly evidenced | Theo Gallagher |
| ACC-B | Are access logs available to Brenneck Pay? | The brain runs inside the customer's Snowflake account, so account-level access history is already in the customer's control. We can evidence that for the account, and we will show the BG-Demo side separately. | Partly evidenced | Theo Gallagher |
| ACC-C | How long are logs retained? | Open. The retention period is to be stated in words and confirmed with the platform team. | Open | Platform team |
| ACC-D | How is user access managed for the licensed users? | Users are administered by Brenneck Pay within the Growth allowance of 40 licensed users. Single sign-on and SCIM belong to the Enterprise tier and are not part of this subscription. | Evidenced | Theo Gallagher |
Section C: DORA ICT third-party requirements
| Ref | Question | BG-Demo answer | Status | Owner |
|---|---|---|---|---|
| DOR-A | Is the service described in the register of information fields Brenneck Pay needs? | We will return the service description, the subcontracting position and the contract dates in the format Brenneck Pay uses. | Open | Theo Gallagher |
| DOR-B | What is the incident notification commitment? | The commitment is whatever the executed order form and MSA state. We will quote it from the signed documents. We will not paraphrase it from memory. | Partly evidenced | Theo Gallagher |
| DOR-C | Is there a tested exit plan? | We have an exit approach, and because the data stays in Brenneck Pay's Snowflake account, the customer keeps its data on exit. A dated exit test has not yet been run for this customer, so this is open. | Open | Theo Gallagher |
| DOR-D | Are subcontractors involved in delivering the service? | Open. A named list is to be supplied with the control reference for each. | Open | Theo Gallagher |
| DOR-E | Can BaFin and Brenneck Pay audit the service? | Audit and access rights are a contract matter. We will point to the clause in the executed documents once confirmed. | Open | Theo Gallagher |
Open findings and owners
- Region statement for support and monitoring access (RES-B): Theo Gallagher, with the platform team.
- Processing path for chat and search (RES-D): platform team.
- Log retention period (ACC-C): platform team.
- Exit test (DOR-C): Theo Gallagher.
- Subcontractor list (DOR-D): Theo Gallagher.
Evidence to be attached
- Dated extract showing the region of the Snowflake account.
- Access list by role for BG-Demo staff.
- Extract of account access history for the environment.
- Relevant clauses from the executed order form and MSA.
Next steps
- Theo Gallagher sends this draft to Sabine Kranz for comment on the question wording.
- Open items are closed with evidence, and each closed item is dated.
- A version two is issued once the platform team has confirmed the residency answers in writing. Until then this document should not be treated as final.
Unusual terms
As at Fri 9 Oct 2026- Open answers not to be read as compliant
- EU data region stated in the order