Pemaquid Analytics - Security Questionnaire
Documentfinal Pemaquid Analytics: documents · security_questionnaire · final · 2026-01-22
Completed by Hannah Lowe on 22 Jan 2026 for Pemaquid Analytics, Boston, discussing the Growth tier. It is not a contract and states no price, availability figure or P1 response time. Several answers are deferred to the order form or to written follow-up.
What it says
What this says
Current to 11 Oct 26Completed by Hannah Lowe on 22 Jan 2026 for Pemaquid Analytics, Boston, discussing the Growth tier. It is not a contract and states no price, availability figure or P1 response time. Several answers are deferred to the order form or to written follow-up.
What it is: a security questionnaire marked Final, completed by Hannah Lowe, Solutions Engineer, BB-Demo. It answers a prospect's questions on architecture, access, data handling, service levels and incidents for the Growth tier.
Commits: the nightly refresh "completes by 07:00 customer local time on business days, on every tier". Incidents affecting the deployment would be reported to the security contact promptly.
Unusual: nothing off standard terms. It says SSO and SCIM are Enterprise only, and that Growth credits cover availability only.
Not settled: certifications, a penetration test report, the deletion process and exit steps are all deferred to written confirmation or the order form. It gives no availability figure, P1 response time or price, and the evidence does not show that an order form followed.
As found in this document
Current to 9 Oct 26- Nightly refreshcompletes by 07:00 customer local time on business days, on every tiercompletes by 07:00 customer local time on business days, on every tier · Source: object_read:doc_087_001
- Growth service creditsGrowth credits cover availability only, as a share of one month's feeGrowth credits cover availability only, as a share of one month's fee · Source: object_read:doc_087_001
- Security incident reportingreported to your security contact promptly, and not held backreported to your security contact promptly, and not held back · Source: object_read:doc_087_001
The document
Body
Pemaquid Analytics - Security Questionnaire
Status: Final Completed by: Hannah Lowe, Solutions Engineer, BB-Demo Date: 22 Jan 2026 Prospect: Pemaquid Analytics, Boston Tier discussed: Growth
This questionnaire covers the company brain as it would be deployed for Pemaquid Analytics. To be precise, where an answer depends on the signed order form, or on a document BB-Demo will supply separately, the answer says so rather than assuming it.
Section A: Architecture and data location
| Question | Answer |
|---|---|
| Where does the brain run? | Inside the customer's own Snowflake account. BB-Demo does not move your data into a separate BB-Demo data store. |
| Which systems does it read from? | Only the sources you choose to connect, for example your CRM, helpdesk, call recorder, email or accounting system. Each connector is agreed in the order form. |
| Can data be held in a specific region? | Dedicated EU or US data residency is available as an add-on. Without it, the region is the one your Snowflake account already uses. |
| Is customer data used to train models for other customers? | No. The brain works over your own data in your own account. |
Read the whole document (3,943 characters)
Section B: Access control
| Question | Answer |
|---|---|
| How do users sign in? | The Growth tier uses standard sign-in for named users. SSO and SCIM are part of the Enterprise tier and are not included in Growth. |
| Who at BB-Demo can see customer data? | Access is limited to staff working on your deployment, and only as far as your Snowflake roles allow. I will put the exact arrangement in writing during the security review. |
| Can access be limited by team? | Yes, through the roles and permissions in your Snowflake account and the page-level settings in the brain. |
Section C: Data handling
| Question | Answer |
|---|---|
| How fresh is the data? | The nightly refresh completes by 07:00 customer local time on business days, on every tier. |
| What happens to data if the contract ends? | Because the brain lives in your Snowflake account, you keep control of the data. The exit steps will be written into the order form. |
| Can individual records be deleted on request? | Records are deleted at source in your own systems and the brain follows at the next refresh. I will confirm in writing how this works for each connector you choose. |
Section D: Service levels and support
| Question | Answer |
|---|---|
| What availability is offered? | The Growth service level in the order form. An executed order form can change service levels. |
| What is credited if service falls short? | Growth credits cover availability only, as a share of one month's fee. Data freshness is credited on Enterprise only. |
| What support is included? | Standard support with the Growth first response time for the highest priority issues. Premium support is an Enterprise feature. |
Section E: Incidents and assurance
| Question | Answer |
|---|---|
| Will we be told about a security incident? | Yes. Any incident affecting your deployment would be reported to your security contact promptly, and not held back. |
| Which certifications does BB-Demo hold? | This questionnaire does not state any. I would rather confirm the current position with our security lead and send it to you in writing than overstate a control here. |
| Is a penetration test report available? | Not enclosed. I will check what can be shared and confirm in writing. |
| Is there a full security review for Growth? | The full security review process is part of Enterprise. For Growth, this questionnaire and a follow-up call with me are the route. |
Follow-up actions
- Hannah Lowe to send written confirmation on certifications, penetration testing and the deletion process.
- Pemaquid Analytics to confirm which sources it would connect first.
- Pemaquid Analytics to say whether SSO is a requirement, as that would point to Enterprise.
Thanks, Hannah