Wendover Kast Insurance Group - Security Questionnaire
Documentfinal Wendover Kast Insurance Group: documents · security_questionnaire · final · 2026-08-19
Final security questionnaire completed by Theo Gallagher on 19 Aug 2026 for the Enterprise evaluation. It states answers, not contract terms: the nightly refresh completes "by 07:00 customer local time on business days"; availability and P1 figures are left to the order form.
What it says
What this says
Current to 11 Oct 26Final security questionnaire completed by Theo Gallagher on 19 Aug 2026 for the Enterprise evaluation. It states answers, not contract terms: the nightly refresh completes "by 07:00 customer local time on business days"; availability and P1 figures are left to the order form.
What it is: BB-Demo's answers to security questions raised during the Enterprise evaluation, completed by Theo Gallagher on 19 Aug 2026. Account owner is named as Jordan Pike.
Commits: the brain runs in the customer's own Snowflake account, SSO and SCIM are included in Enterprise, and the nightly refresh completes by 07:00 customer local time on business days. Service credits cover availability and data freshness on Enterprise.
Unusual: nothing off standard terms. Dedicated US data residency is an add-on, named in the order form only if chosen.
Not settled: the availability level and the P1 first-response time are "written into the order form", so no figures appear here. Role design, exit steps, pen test reports and residency pricing are deferred to implementation, the proposal or request.
As found in this document
Current to 9 Oct 26- Nightly refreshThe nightly refresh completes by 07:00 customer local time on business days, on every tier.The nightly refresh completes by 07:00 customer local time on business days, on every tier. · Source: object_read:doc_091_001
- Service creditsService credits cover availability and data freshness on Enterprise.Service credits cover availability and data freshness on Enterprise. · Source: object_read:doc_091_001
- AvailabilityThe Enterprise availability level applies, as set out in the order form.The Enterprise availability level applies, as set out in the order form. · Source: object_read:doc_091_001
- P1 first responseThe exact figure is written into the order form.The exact figure is written into the order form. · Source: object_read:doc_091_001
The document
Body
Wendover Kast Insurance Group - Security Questionnaire
Status: Final Completed by: Theo Gallagher, Solutions Engineer, BB-Demo Date: 19 Aug 2026 Prospective tier: Enterprise Account owner: Jordan Pike
This document records BB-Demo's answers to the security questions raised during the Enterprise evaluation by Wendover Kast Insurance Group. Each answer states what is in place today. Where an answer depends on the customer's own environment, it says so. Where evidence is available, it is marked "we can evidence that" and will be supplied on request.
1. Hosting and data location
| Ref | Question | Answer |
|---|---|---|
| 1.1 | Where does customer data live? | The company brain is built and run inside the customer's own Snowflake account. BB-Demo does not move the customer's data into a separate BB-Demo store. We can evidence that with the deployment design. |
| 1.2 | Can data residency be fixed to a region? | Yes. Dedicated US data residency is an add-on. It would be named in the order form if chosen. |
| 1.3 | Who controls the underlying storage? | The customer, through its Snowflake account and its own administrators. |
2. Access control
Read the whole document (3,673 characters)
| Ref | Question | Answer |
|---|---|---|
| 2.1 | Is single sign-on supported? | Yes. SSO and SCIM are included in the Enterprise tier. |
| 2.2 | Is user provisioning automated? | Yes, through SCIM, so leavers can be removed from the identity provider and not by hand. |
| 2.3 | Can access be limited by team? | Access follows the customer's configuration of connectors and users. The exact role design is agreed during implementation, so we will not describe it as fixed here. |
3. Data protection and connectors
| Ref | Question | Answer |
|---|---|---|
| 3.1 | Which source systems are connected? | Only the systems the customer chooses to connect, such as the CRM, the helpdesk, email and the call recorder. Each connector is listed in the order form. |
| 3.2 | Is data refreshed regularly? | Yes. The nightly refresh completes by 07:00 customer local time on business days, on every tier. |
| 3.3 | Can changes be tested before go-live? | Yes. The Sandbox is available with the Enterprise tier. |
4. Availability and support
| Ref | Question | Answer |
|---|---|---|
| 4.1 | What availability is committed? | The Enterprise availability level applies, as set out in the order form. Service credits cover availability and data freshness on Enterprise. |
| 4.2 | How quickly are priority incidents answered? | Enterprise carries the shortest first-response time of the three tiers. The exact figure is written into the order form. |
| 4.3 | Is there named support? | Premium support, with a named engineer during extended UK hours, is available with the Enterprise tier. |
5. Exit
| Ref | Question | Answer |
|---|---|---|
| 5.1 | What happens to data at the end of the term? | Because the brain runs in the customer's Snowflake account, the customer keeps its data and the structures built there. Access for BB-Demo is withdrawn. We can evidence that with the exit plan. |
| 5.2 | Is there a documented exit plan? | Yes. The exit steps are agreed with the customer during implementation and recorded with the order form. |
6. Open points and owners
| Item | Owner | Note |
|---|---|---|
| Penetration test and audit reports | Theo Gallagher | Supplied on request under the customer's confidentiality terms. |
| Questions that depend on the platform team | Theo Gallagher | Confirmed with the platform team before any answer is added. |
| Commercial terms, including residency | Jordan Pike | Handled in the proposal, not in this questionnaire. |
Thanks, Theo