Vellacott Payments - Security Questionnaire
Documentfinal Vellacott Payments: documents · security_questionnaire · final · 2025-04-01
Final version one, dated 1 Apr 2025, answering Vellacott Payments' security review questions ahead of an Enterprise subscription. It states no figures: availability and P1 response are given only as the Enterprise level, and no price appears.
What it says
What this says
Current to 11 Oct 26Final version one, dated 1 Apr 2025, answering Vellacott Payments' security review questions ahead of an Enterprise subscription. It states no figures: availability and P1 response are given only as the Enterprise level, and no price appears.
What it is: a security questionnaire prepared by Anya Petrova, Solutions Engineer, answering the review questions of an FCA-authorised e-money and payments firm. It describes how the brain runs inside the customer's own Snowflake account.
Commits: it says "The nightly refresh completes by 07:00 customer local time on business days, and Enterprise is credited for freshness as well as availability." SSO and SCIM and an executive sponsor are part of Enterprise.
Unusual: nothing off the standard Enterprise terms. Sandbox and Premium support are described as "subject to the order form".
Not settled: it gives no availability percentage, no P1 response time and no price. Three open points remain for the review call: source systems in scope, regional data residency, and whether Premium support and the Sandbox are wanted. Contracted terms sit in the executed order form, not here.
As found in this document
Current to 9 Oct 26- Nightly refreshThe nightly refresh completes by 07:00 customer local time on business daysThe nightly refresh completes by 07:00 customer local time on business days · Source: object_read:doc_084_001
- Service creditsEnterprise is credited for freshness as well as availabilityEnterprise is credited for freshness as well as availability · Source: object_read:doc_084_001
- AvailabilityThe Enterprise availability service level applies, the highest of the three tiers.The Enterprise availability service level applies, the highest of the three tiers. · Source: object_read:doc_084_001
- P1 first responseThe Enterprise priority one first response time applies, the fastest of the three tiers.The Enterprise priority one first response time applies, the fastest of the three tiers. · Source: object_read:doc_084_001
The document
Body
Vellacott Payments - Security Questionnaire
Status: Final, version one Date: 1 April 2025 Prepared by: Anya Petrova, Solutions Engineer, BB-Demo Commercial contact: Sophie Ling, BB-Demo Customer success contact: Daniel Okafor, BB-Demo Tier under review: Enterprise
This questionnaire answers the security review questions raised by Vellacott Payments, an FCA-authorised e-money and payments firm, ahead of an Enterprise subscription. It describes how the company brain is built and run. Where an answer depends on the contract, that is stated.
Architecture and data location
Read the whole document (3,731 characters)
| Question | Answer |
|---|---|
| Where does the brain run? | Inside Vellacott's own Snowflake account. BB-Demo builds and operates it there. |
| Is customer data copied to a BB-Demo environment? | No. Data stays in the customer's Snowflake account. |
| Which source systems can be connected? | Typical sources include Salesforce, HubSpot, Zendesk, Xero, Gong, Microsoft 365, Google Workspace, Dropbox, SharePoint and Slack. The connectors in scope are agreed in the order form. |
| Can data residency be fixed to a region? | Dedicated EU or US data residency is available as an add-on. As a UK customer, Vellacott's data stays wherever its own Snowflake account is hosted. |
Access control
| Question | Answer |
|---|---|
| Is single sign-on supported? | Yes. SSO and SCIM provisioning are part of the Enterprise tier. |
| How are leavers handled? | With SCIM, removal in the identity provider removes access to the brain. |
| Who controls which users have access? | Vellacott's administrators. BB-Demo staff work within the access the customer grants. |
| Is there an executive sponsor? | Yes, the Enterprise tier includes an executive sponsor on the BB-Demo side. |
Service levels and resilience
| Question | Answer |
|---|---|
| What availability is committed? | The Enterprise availability service level applies, the highest of the three tiers. |
| What is the incident response commitment? | The Enterprise priority one first response time applies, the fastest of the three tiers. |
| Is data freshness covered? | Yes. The nightly refresh completes by 07:00 customer local time on business days, and Enterprise is credited for freshness as well as availability. |
| Is there a non-production environment? | A Sandbox is available on Enterprise from the second version of the price book, subject to the order form. |
Support
| Question | Answer |
|---|---|
| Is named-engineer support available? | Premium support, with a named engineer, is an Enterprise option, subject to the order form. |
| How are security questions handled during implementation? | Enterprise implementation includes security review support from BB-Demo. |
Data protection and governance
| Question | Answer |
|---|---|
| Who is the data controller? | Vellacott Payments. BB-Demo processes data on its instructions. |
| Is there a data processing agreement? | Yes. A DPA is put in place alongside the MSA and order form. |
| Is customer data used to train models for other customers? | No. The brain is built and run within the customer's own account, and its data is not pooled with other customers. |
| How are changes to terms handled? | Through the executed order form, which decides contracted terms and service levels. |
Open points for the review call
- Vellacott to confirm which source systems are in scope for the first phase
- Vellacott to confirm whether regional data residency is needed beyond its existing Snowflake account
- Vellacott to confirm whether Premium support and the Sandbox are wanted
Sign-off
Prepared and approved for issue by Anya Petrova, Solutions Engineer, BB-Demo, on 1 April 2025.