Carrowkeel Software - Security Questionnaire
Documentfinal Carrowkeel Software: documents · security_questionnaire · final · 2025-06-16
Final security questionnaire completed by Hannah Lowe on 16 Jun 2025 for Carrowkeel Software while it considered the Growth tier. It is not a contract: availability, P1 response and price are left to the order form.
What it says
What this says
Current to 11 Oct 26Final security questionnaire completed by Hannah Lowe on 16 Jun 2025 for Carrowkeel Software while it considered the Growth tier. It is not a contract: availability, P1 response and price are left to the order form.
What it is: BB-Demo's written answers to Carrowkeel's security and data-handling questions, completed by Hannah Lowe, Solutions Engineer. It describes how the brain is built and run, not what is contracted.
Commits: the only fixed figure is the nightly refresh, "completes by 07:00 customer local time on business days, on every tier". Data stays in Carrowkeel's own Snowflake account and is not pooled with other customers.
Unusual: nothing off the standard terms. It notes that for Growth, "credits relate to availability only" and that SSO and SCIM are Enterprise features.
Not settled: availability %, P1 response time and price are not stated. Data residency is an add-on that "would need to be written into the order form", and the executed order form takes precedence.
As found in this document
Current to 9 Oct 26- Nightly refreshThe nightly refresh completes by 07:00 customer local time on business days, on every tier.The nightly refresh completes by 07:00 customer local time on business days, on every tier. · Source: object_read:doc_085_001
- Service credits (Growth)For Growth, credits relate to availability only. They do not cover data freshness.For Growth, credits relate to availability only. They do not cover data freshness. · Source: object_read:doc_085_001
- AvailabilityThe standard Growth service level applies, and the figure would be stated in the order form.The standard Growth service level applies, and the figure would be stated in the order form. · Source: object_read:doc_085_001
- P1 first responseGrowth carries its own P1 first-response commitment, set out in the order form.Growth carries its own P1 first-response commitment, set out in the order form. · Source: object_read:doc_085_001
The document
Body
Carrowkeel Software - Security Questionnaire
Status: Final Completed by: Hannah Lowe, Solutions Engineer, BB-Demo Date: Monday 16 June 2025 Organisation: Carrowkeel Software, Dublin Tier under discussion: Growth
Purpose
This questionnaire records BB-Demo's answers to the security and data-handling questions raised by Carrowkeel Software while it considers the Growth tier. The intended use is for customer success to read support tickets, renewals and product usage per agency group. To be precise, the answers below describe how the company brain is built and run. Anything that depends on a signed order form is marked as such, and I'll put any further detail in writing on request.
Architecture and data location
Read the whole document (3,497 characters)
| Question | Answer |
|---|---|
| Where does the company brain run? | Inside Carrowkeel Software's own Snowflake account. BB-Demo does not copy your data into a separate BB-Demo environment. |
| Who controls the data? | Carrowkeel Software. The data stays in your Snowflake account and under your account controls. |
| Which systems would be connected? | Only the sources you choose, for example your helpdesk, CRM and product usage data. The Growth tier covers several teams and a defined number of connectors. |
| Can data be held in a specific region? | Dedicated EU or US data residency is available as an add-on. It is not part of the standard Growth tier and would need to be written into the order form. |
Access control
| Question | Answer |
|---|---|
| How do users sign in? | Through the access arrangements agreed during implementation. SSO and SCIM are Enterprise features and are not included in Growth. |
| Can access be limited by team? | Yes. The short answer is yes for who can use the brain; the longer answer is that what each person can see is governed by the permissions in your Snowflake account and the connected sources. |
| Who at BB-Demo can reach the environment? | Only the engineers working on your implementation and support, and only as needed for that work. |
Availability and support
| Question | Answer |
|---|---|
| What availability is committed? | The standard Growth service level applies, and the figure would be stated in the order form. |
| How quickly are urgent issues answered? | Growth carries its own P1 first-response commitment, set out in the order form. |
| Is the data refreshed daily? | Yes. The nightly refresh completes by 07:00 customer local time on business days, on every tier. |
| Are service credits offered? | For Growth, credits relate to availability only. They do not cover data freshness. |
Data handling
| Question | Answer |
|---|---|
| Is customer data used to train models for other customers? | No. The brain is built and run inside your own account, and your data is not pooled with that of other customers. |
| What happens at the end of the contract? | Because the brain runs in your Snowflake account, the data remains yours. BB-Demo's components are removed as agreed with your team. |
| Are sub-processors involved? | Snowflake hosts the environment as your own provider. Any other sub-processor would be listed in the data processing terms before signature. |
Open items
- Contract-specific commitments (service levels, any add-ons) will be fixed by the executed order form, which takes precedence over this questionnaire.
- Further technical questions from Carrowkeel Software's IT team are welcome, and I'll answer them in writing.
Thanks, Hannah