Penwortham Mutual - Security Questionnaire
Documentfinal Penwortham Mutual: documents · security_questionnaire · final · 2026-03-22
Completed security questionnaire for Penwortham Mutual, dated 22 Mar 2026, prepared by the BB-Demo Solutions Team. It quotes Enterprise availability of 99.9% uptime, a 30-minute P1 response and a 07:00 UK time nightly refresh. It states no price.
What it says
What this says
Current to 11 Oct 26Completed security questionnaire for Penwortham Mutual, dated 22 Mar 2026, prepared by the BB-Demo Solutions Team. It quotes Enterprise availability of 99.9% uptime, a 30-minute P1 response and a 07:00 UK time nightly refresh. It states no price.
What it is: a customer-facing questionnaire answering data protection, access control, incident response, availability and assurance questions. Stored status is final, but it is a set of answers, not a signed contract.
Commits: "Enterprise: 99.9% uptime, measured monthly, with service credits for breaches" and "30-minute P1 response time". Incidents are reported "within 24 hours", with a full report "within 5 business days".
Unusual: the document says ISO 27001 certification is "planned for late 2026", so it is not yet held. EU data residency is an add-on.
Not settled: it does not show which tier Penwortham Mutual buys, any price, or any order form. Answers are written for the Enterprise tier, and an executed order form would decide the contracted terms.
As found in this document
Current to 9 Oct 26- Availability (Enterprise)99.9% uptime, measured monthly, with service credits for breaches99.9% uptime, measured monthly, with service credits for breaches · Source: object_read:doc_097_001
- P1 response time (Enterprise)30-minute P1 response timeSource: object_read:doc_097_001
- Nightly data refreshcomplete by 07:00 UK time on business days, every tiercomplete by 07:00 UK time on business days, every tier · Source: object_read:doc_097_001
- Incident reportingreported to the customer within 24 hours; full incident report within 5 business daysreported to the customer within 24 hours; full incident report within 5 business days · Source: object_read:doc_097_001
- Recovery time objective4 hoursSource: object_read:doc_097_001
- Backup retention after deletionup to 30 daysSource: object_read:doc_097_001
- Audit log retentionminimum 12 monthsSource: object_read:doc_097_001
The document
Body
Penwortham Mutual - Security Questionnaire
Date completed: 22 Mar 2026
Data Protection and Privacy
| Question | Answer |
|---|---|
| How is customer data protected in transit and at rest? | All data in transit uses TLS encryption. Data at rest is encrypted at the Snowflake account level. Customer data remains in the customer's own Snowflake account under their access controls. |
| What is the data retention and deletion policy? | Customer retains full control and ownership of their data. Data deletion is available on demand. Backups are retained for up to 30 days after deletion. |
| Do you have a Data Processing Agreement for GDPR compliance? | Yes. DPA available covering UK GDPR and other applicable regulations. Data processing is customer-controlled. |
| Is EU data residency available? | Yes. EU data can be hosted in an EEA Snowflake account. This is available as an add-on. |
Access Control and Authentication
Read the whole document (2,903 characters)
| Question | Answer |
|---|---|
| What authentication and SSO options are provided? | SAML 2.0 SSO included in Enterprise tier. Multi-factor authentication available and recommended for administrators. |
| How are user access levels managed? | Role-based access control: admins, analysts, and viewers. SCIM provisioning available in Enterprise for automated user and group management. |
| What password policy is enforced? | 12-character minimum, complexity requirements, 90-day expiry (configurable). Admin accounts require strong authentication. |
Monitoring, Logging and Incident Response
| Question | Answer |
|---|---|
| What audit logging is available? | All user actions, data access, and configuration changes are logged with timestamps and user attribution. Logs available for minimum 12 months. |
| What is your incident response process? | Incidents affecting confidentiality, integrity or availability are reported to the customer within 24 hours. Full incident report within 5 business days. |
| What support is available in case of issues? | Enterprise tier includes 30-minute P1 response time, dedicated support contact, and ongoing success partnership. |
Availability and Service Levels
| Question | Answer |
|---|---|
| What availability SLA applies? | Enterprise: 99.9% uptime, measured monthly, with service credits for breaches. |
| What is the data refresh commitment? | Nightly data refresh complete by 07:00 UK time on business days, every tier. |
| Is there a backup and recovery plan? | Yes. Nightly backups to separate Snowflake account in same region. Recovery time objective 4 hours. Tested quarterly. |
External Assurance
| Question | Answer |
|---|---|
| Do you hold security certifications? | SOC 2 Type II audit completed annually. ISO 27001 certification planned for late 2026. |
Prepared by: BB-Demo Solutions Team
Date: 22 Mar 2026
Unusual terms
Current to 9 Oct 26- ISO 27001 certification only planned for late 2026
- EU data residency available as an add-on