Saltdean Hart Insurance Brokers - Security Questionnaire
Documentfinal Saltdean Hart Insurance Brokers: documents · security_questionnaire · final · 2024-10-01
Hannah Lowe's response of 1 Oct 2024 to a security questionnaire for Saltdean Hart Insurance Brokers, covering the Growth tier. It states the brain runs in the customer's Snowflake account and that the nightly refresh completes by 07:00. Four points remain to be confirmed in writing.
What it says
What this says
Current to 11 Oct 26Hannah Lowe's response of 1 Oct 2024 to a security questionnaire for Saltdean Hart Insurance Brokers, covering the Growth tier. It states the brain runs in the customer's Snowflake account and that the nightly refresh completes by 07:00. Four points remain to be confirmed in writing.
What it is: a final-status security questionnaire response prepared by Hannah Lowe, Solutions Engineer, for a prospect evaluating Growth. It is a pre-sale answer document, not a contract or order form.
Commits: it states "The nightly refresh completes by 07:00 customer local time on business days." Connectors named in an order form carry a commitment to be live within an agreed number of days, but the document gives no number.
Unusual: SSO and SCIM are "part of the Enterprise tier and are not included in Growth". Freshness credits are "Enterprise only". Premium support and Sandbox are add-ons.
Not settled: certifications, data retention and deletion, incident notification and staff vetting are all to be confirmed in writing. It gives no availability percentage, no P1 response time and no price. The evidence does not show whether the written follow-ups were sent.
As found in this document
Current to 9 Oct 26- Nightly refreshThe nightly refresh completes by 07:00 customer local time on business days.The nightly refresh completes by 07:00 customer local time on business days. · Source: object_read:doc_089_001
- Connector deliveryConnectors named in an order form carry a commitment to be live within an agreed number of days.Connectors named in an order form carry a commitment to be live within an agreed number of days. · Source: object_read:doc_089_001
- Availability creditsservice credits for availability breaches as set out in the order formservice credits for availability breaches as set out in the order form · Source: object_read:doc_089_001
- Freshness creditsNot on Growth. Service credits for data freshness apply to Enterprise only.Not on Growth. Service credits for data freshness apply to Enterprise only. · Source: object_read:doc_089_001
The document
Body
Saltdean Hart Insurance Brokers - Security Questionnaire
Response prepared by Hannah Lowe, Solutions Engineer, BB-Demo, on 1 October 2024. This response covers the Growth tier being evaluated by Saltdean Hart Insurance Brokers. Status: final.
Where the short answer is not the whole story, the longer answer is given. Where I could not confirm a point as written here, I say so and will put it in writing separately.
1. Architecture and data location
| Question | Response |
|---|---|
| Where does the company brain run? | Inside your own Snowflake account. BB-Demo builds and runs the brain there, so the data stays within an environment you already control. |
| Does BB-Demo hold a separate copy of our data? | The short answer is no: the brain is built in your Snowflake account. The longer answer is that I will put the exact data flows in writing, with a diagram, if you would like them for your records. |
| Can data be held in a specific region? | Dedicated EU or US data residency is available as an add-on. Your Snowflake account location governs where the data sits in the first instance. |
2. Connected systems
Read the whole document (3,632 characters)
| Question | Response |
|---|---|
| Which systems can the brain connect to? | Salesforce, HubSpot, Zendesk, Xero, Gong, Microsoft 365, Google Workspace, Dropbox, SharePoint, Slack and Snowflake. |
| Is there a limit on connectors? | Yes. The Growth tier carries a fixed connector limit and a user allowance. Exact numbers are set out in the order form. |
| Are connector promises binding? | Connectors named in an order form carry a commitment to be live within an agreed number of days. |
3. Access control
| Question | Response |
|---|---|
| Is single sign-on supported? | To be precise, SSO and SCIM are part of the Enterprise tier and are not included in Growth. If they are a requirement for Saltdean Hart, we should discuss the Enterprise tier. |
| Who can administer the brain? | Administrators are named by the customer. I recommend at least two, so that one departure does not leave the brain without an admin. |
4. Availability and refresh
| Question | Response |
|---|---|
| What availability is committed? | The standard Growth service level for availability, with service credits for availability breaches as set out in the order form. |
| How fresh is the data? | The nightly refresh completes by 07:00 customer local time on business days. |
| Are credits given for stale data? | Not on Growth. Service credits for data freshness apply to Enterprise only. Availability and freshness are separate measures. |
5. Support
| Question | Response |
|---|---|
| How are priority incidents handled? | Growth carries a defined first response for the most serious incidents, set out in the standard service levels. |
| Is a named engineer available? | Premium support, with a named engineer, is an add-on and is not part of the base Growth tier. |
| Is there a test environment? | A Sandbox is available as an add-on. |
6. Points to be confirmed in writing
I will not answer these from memory, because accuracy matters more than speed here. I will put each in writing after checking internally:
- Third-party certifications and audit reports.
- Data retention and deletion at the end of a contract.
- Incident notification commitments in the data processing terms.
- Staff vetting and internal access to customer environments.
7. Next steps
- Saltdean Hart to say whether SSO or SCIM is a requirement.
- Hannah Lowe to send the written responses to section 6.
- Priya Raman to follow up on commercial terms once the security position is agreed.
Thanks, Hannah
Unusual terms
Current to 9 Oct 26- SSO and SCIM excluded from Growth
- Freshness credits Enterprise only
- Four points deferred to written follow-up