Corstorphine Building Society - Security Questionnaire v1
Documentdraft Corstorphine Building Society · security_questionnaire · draft · 2026-06-09
Draft first-pass supplier security questionnaire for the society's Enterprise tier evaluation, prepared by Hannah Lowe on 9 Jun 2026. The society is a prospect with no contract. It states no availability percentage and no price; many answers are still evidence to follow.
What it says
What this says
Current to 13 Oct 26Draft first-pass supplier security questionnaire for the society's Enterprise tier evaluation, prepared by Hannah Lowe on 9 Jun 2026. The society is a prospect with no contract. It states no availability percentage and no price; many answers are still evidence to follow.
What it is: a draft supplier security questionnaire from Hannah Lowe (BB-Demo) to Euan Rattray, Head of Information Security. It scopes an Enterprise tier evaluation for one view of each mortgage broker firm.
Commits: it restates standard terms only. "A nightly refresh completes by 07:00 customer local time on business days, on every tier." The Enterprise priority incident first response is "thirty minutes".
Unusual: no availability percentage and no price are stated. The text says an executed order form can change the service terms.
Not settled: the data-flow diagram, standing access, audit logging, exit wording, model training, incident history, assurance and sub-processor lists are all open points. Residency, Sandbox and Premium support are add-ons or version two features, to be confirmed in an order form.
As found in this document
Current to 9 Oct 26- Nightly refreshA nightly refresh completes by 07:00 customer local time on business days, on every tier.A nightly refresh completes by 07:00 customer local time on business days, on every tier. · Source: object_read:doc_080_005
- Priority incident first response (Enterprise)thirty minutesSource: object_read:doc_080_005
- Service credits (Enterprise)service credits for both availability and data freshnessservice credits for both availability and data freshness · Source: object_read:doc_080_005
The document
Body
Corstorphine Building Society - Security Questionnaire v1
Status: Draft
| Prepared for | Euan Rattray, Head of Information Security, Corstorphine Building Society |
| Prepared by | Hannah Lowe, Solutions Engineer, BB-Demo |
| Commercial owner | Tom Ashdown, BB-Demo |
| Date | Tuesday 9 June 2026 |
| Scope | Enterprise tier evaluation: one view of each mortgage broker firm for intermediary distribution and member services |
| Policy basis | The society's supplier outsourcing and operational-resilience policy |
How to read this draft
This is a first pass at the supplier security questionnaire. Each answer is marked either Answered or Evidence to follow. Where a control is described, I have said what it is and what it is not. Where I cannot yet put a document behind a statement, I have said so rather than give assurance. Euan, please mark any answer you consider unevidenced and I will treat it as an open finding.
The society is a prospect. There is no contract in place, no data has been connected and no BB-Demo service is running for the society today. Everything below describes how the service would be delivered if the evaluation proceeds.
Read the whole document (7,381 characters)
Section A: Service and architecture
| Ref | Question | BB-Demo response | Status |
|---|---|---|---|
| A-one | What is the service and where does it run? | The company brain is a single AI-queryable layer over the customer's systems. It is built and run inside the customer's own Snowflake account, not in a BB-Demo-hosted environment. | Answered |
| A-two | Which of our systems would be connected? | To be agreed in the design phase. The Enterprise tier includes the Enterprise connector allowance. For this evaluation the focus is the CRM and the systems that hold broker firm and member service records. The society decides which sources are connected. | Answered |
| A-three | Does data leave the society's Snowflake account? | The short answer is that the brain's stored data stays in the society's account. The longer answer is that I will put a data-flow diagram in writing, showing each connector, each processing step and each point where a query is answered, so you can test that statement rather than take it from me. | Evidence to follow |
| A-four | Is data residency configurable? | Dedicated EU or US data residency is available as an add-on. The society is a UK organisation and I expect UK residency to be the requirement. I will confirm how that is expressed in the order form. | Answered |
| A-five | Is there a non-production environment for testing? | A Sandbox is available on the Enterprise tier from version two of the offering. It would let your team test connectors and access settings without touching production. | Answered |
Section B: Access control
| Ref | Question | BB-Demo response | Status |
|---|---|---|---|
| B-one | Who has standing access to our data? | Access follows the society's own Snowflake roles and grants. Whether any BB-Demo staff hold standing access is a design decision I want to settle with you directly, and my proposal is none by default, with time-limited access granted by the society when support requires it. I will confirm this in writing. | Evidence to follow |
| B-two | How do our users authenticate? | The Enterprise tier includes SSO and SCIM, so sign-in and joiner, mover and leaver changes can be driven from the society's identity provider. | Answered |
| B-three | Can we restrict what each user can ask about? | Answers are limited by what the user's role can see in the connected sources. I will document how permissions are inherited from each connector, and where they are not, so that the limits are clear. | Evidence to follow |
| B-four | How are administrator actions recorded? | I do not want to describe an audit log feature from memory. I will check the exact scope of administrator and query logging and return with a precise answer and sample output. | Evidence to follow |
Section C: Data handling
| Ref | Question | BB-Demo response | Status |
|---|---|---|---|
| C-one | What categories of data would be processed? | Customer records, calls, emails, tickets and finance data from the sources the society chooses to connect. Member personal data would be in scope if member services systems are connected, so a data processing agreement would be required before any connection. | Answered |
| C-two | How often is data refreshed? | A nightly refresh completes by 07:00 customer local time on business days, on every tier. | Answered |
| C-three | What happens to data if we leave? | Because the brain sits in the society's own Snowflake account, the society retains the data itself. I will set out in the contract what BB-Demo removes and what it confirms in writing on exit. | Evidence to follow |
| C-four | Is our data used to train models for other customers? | I will not answer this from a summary. I will provide a written statement and the supporting contractual wording. | Evidence to follow |
Section D: Resilience and incident management
| Ref | Question | BB-Demo response | Status |
|---|---|---|---|
| D-one | What availability is committed? | The Enterprise tier carries the highest availability service level BB-Demo offers, with service credits for both availability and data freshness. An executed order form can change these terms. | Answered |
| D-two | What is the response to a priority incident? | The Enterprise first response for a priority incident is thirty minutes. Premium support, with a named engineer during extended UK hours, is available as an add-on. | Answered |
| D-three | What is the incident history? | I do not have a documented incident history in a form I am willing to send you yet. I will provide it as a dated list with cause and remediation, and say plainly if it is short. | Evidence to follow |
| D-four | How does BB-Demo support the society's operational-resilience obligations? | Exit, continuity and testing arrangements would need to be written against the society's policy. I would rather work through the policy clauses with you than claim alignment in general terms. | Evidence to follow |
Section E: Assurance and governance
| Ref | Question | BB-Demo response | Status |
|---|---|---|---|
| E-one | What independent assurance can you provide? | I will list what BB-Demo holds and what it does not. A reference to another organisation's certificate is not a control, and I will not offer one as if it were. | Evidence to follow |
| E-two | Who is the executive sponsor? | The Enterprise tier includes an executive sponsor. The named individual will be confirmed with the order form. | Answered |
| E-three | How are sub-processors managed? | I will provide the list of sub-processors, what each does and how the society would be notified of changes. | Evidence to follow |
Open points for the next version
- Data-flow diagram showing every connector and processing step (A-three).
- Written position on standing access and time-limited support access (B-one).
- Scope and sample of administrator and query logging (B-four).
- Exit and data removal wording (C-three).
- Written statement on model training (C-four).
- Dated incident history (D-three).
- Assurance and sub-processor lists (E-one, E-three).
I'll put each of these in writing and issue the next version once the evidence is attached.
Thanks, Hannah
Unusual terms
Current to 9 Oct 26- No availability percentage stated
- Terms changeable by executed order form
- Data processing agreement required before any connection