Pentreath Cold Chain - Security Questionnaire
Documentfinal Pentreath Cold Chain: documents · security_questionnaire · final · 2023-09-17
Final version 1 security questionnaire dated 17 Sep 2023, prepared by Tobias Renwick for Pentreath Cold Chain's Growth tier evaluation. It describes the standard offering and states no availability figure, P1 response time or price.
What it says
What this says
Current to 11 Oct 26Final version 1 security questionnaire dated 17 Sep 2023, prepared by Tobias Renwick for Pentreath Cold Chain's Growth tier evaluation. It describes the standard offering and states no availability figure, P1 response time or price.
What it is: a BB-Demo answer sheet for a prospect's security review, covering data location, connectors, access control and availability. It is not a contract.
Commits: nightly refresh "complete by 07:00 customer local time on business days, on every tier". It also states "Any contractual change would be made in an executed order form."
Unusual: nothing off the standard terms. It says SSO and SCIM are not in Growth, and "only Enterprise is credited for freshness".
Not settled: the availability percentage, user and connector numbers and P1 response time are described only as "standard Growth" and are not stated. No price, term or signature appears, and it does not show whether Pentreath Cold Chain signed.
As found in this document
Current to 9 Oct 26- Nightly refreshcomplete by 07:00 customer local time on business days, on every tiercomplete by 07:00 customer local time on business days, on every tier · Source: object_read:doc_081_001
- Availability service creditsService credits for availability apply on Growth.Service credits for availability apply on Growth. · Source: object_read:doc_081_001
- P1 first responseThe standard Growth first-response commitment, measured in business hours.The standard Growth first-response commitment, measured in business hours. · Source: object_read:doc_081_001
- Contractual changeAny contractual change would be made in an executed order form.Any contractual change would be made in an executed order form. · Source: object_read:doc_081_001
The document
Body
Pentreath Cold Chain - Security Questionnaire
Status: Final, version 1 Date: 17 Sep 2023 Prepared by: Tobias Renwick, Chief Technology Officer and Co-founder, BB-Demo Prepared for: Pentreath Cold Chain, Bristol (Growth tier evaluation)
Purpose
This questionnaire sets out how BB-Demo's company brain handles data, access and availability for the Growth tier. To be precise, the answers below describe the standard Growth offering. Anything that would change under a signed order form is stated as such.
1. Architecture and data location
Read the whole document (3,596 characters)
| Ref | Question | Answer |
|---|---|---|
| 1.1 | Where does the data live? | Inside Pentreath Cold Chain's own Snowflake account. BB-Demo runs the brain within that account, so the data does not move to a BB-Demo-owned store. |
| 1.2 | Who controls the data? | Pentreath Cold Chain. Your own Snowflake controls, roles and retention settings continue to apply. |
| 1.3 | Can data be hosted in a specific region? | Dedicated EU or US data residency is available as an add-on. It is not part of the standard Growth tier. |
| 1.4 | Does BB-Demo use customer data for anything other than serving the customer? | No. The brain exists to answer questions for the customer's own teams. |
2. Connected systems
| Ref | Question | Answer |
|---|---|---|
| 2.1 | Which sources can be connected? | Typical sources are a CRM, a helpdesk, call recordings, email, finance and product usage. Named systems we support include Salesforce, HubSpot, Zendesk, Xero, Gong, Microsoft 365, Google Workspace, Dropbox, SharePoint and Slack. |
| 2.2 | Is there a limit on connectors? | Yes. The Growth tier carries a hard connector limit. Additional connectors can be bought as an add-on. |
| 2.3 | How do you refresh the data? | A nightly refresh, complete by 07:00 customer local time on business days, on every tier. |
3. Access control
| Ref | Question | Answer |
|---|---|---|
| 3.1 | Is single sign-on supported? | SSO and SCIM are part of the Enterprise tier. They are not included in Growth. If your security team requires them, the honest answer is that Enterprise is the right tier. |
| 3.2 | Is there a user limit? | The Growth tier has a stated user allowance. Additional users can be added in blocks as an add-on. |
| 3.3 | Who at BB-Demo can see customer data? | Access follows the customer's Snowflake role setup. We will agree the named roles with your administrators during implementation. |
4. Availability and support
| Ref | Question | Answer |
|---|---|---|
| 4.1 | What availability is committed? | The standard Growth service level. Service credits for availability apply on Growth. |
| 4.2 | Are credits given for stale data? | Not on Growth. Availability and freshness are different measures, and only Enterprise is credited for freshness. |
| 4.3 | What is the response time for a priority one issue? | The standard Growth first-response commitment, measured in business hours. |
| 4.4 | Is named-engineer support available? | Premium support is an add-on with a named engineer and extended UK hours. |
5. Items outside this document
| Ref | Question | Answer |
|---|---|---|
| 5.1 | Roadmap commitments | BB-Demo does not give roadmap dates in writing. Any contractual change would be made in an executed order form. |
| 5.2 | Further detail on controls | We are happy to take your security team through the design in a call, and to answer follow-up questions in writing afterwards. |
Sign-off
These answers are final for this version. Please send any follow-up questions to Tobias Renwick.
Best, Tobias