Kesselfeld Software - Security Questionnaire
Documentfinal Kesselfeld Software: documents · security_questionnaire · final · 2025-11-06
Completed security questionnaire dated 6 Nov 2025, answered by Hannah Lowe for Kesselfeld Software on the Growth tier. It states EU data hosting, AES-256 and TLS 1.3 encryption, and no SSO on Growth. It is not a contract and states no price or service levels.
What it says
What this says
Current to 11 Oct 26Completed security questionnaire dated 6 Nov 2025, answered by Hannah Lowe for Kesselfeld Software on the Growth tier. It states EU data hosting, AES-256 and TLS 1.3 encryption, and no SSO on Growth. It is not a contract and states no price or service levels.
What it is: a ten-question security questionnaire completed by Hannah Lowe, Solutions Engineer, BB-Demo, for a Growth tier customer. It ends by asking the customer to "confirm acceptance of these security controls or request any modifications."
Commits: it describes controls rather than contract terms. Data is "hosted in EU region, encrypted at rest and in transit", with AES-256 at rest and TLS 1.3 in transit.
Unusual: Growth gets "password and two-factor authentication", while SAML 2.0 is Enterprise only. Third-party audit results are shared with Enterprise customers under NDA, so this customer would not receive them by default.
Not settled: the document does not show whether the customer accepted the controls. Wording such as "up to a year", "about a month" and "a few weeks" is vague, and no price, service level or renewal date is stated. Dedicated EU residency is an add-on in the price book, and the document does not say whether it is contracted.
As found in this document
Current to 9 Oct 26- Data residencyData hosted in EU region, encrypted at rest and in transitData hosted in EU region, encrypted at rest and in transit · Source: object_read:doc_099_001
- EncryptionAES-256 for data at rest, TLS 1.3 for data in transitAES-256 for data at rest, TLS 1.3 for data in transit · Source: object_read:doc_099_001
- Audit log retentionYes, audit logs retained for up to a year; longer retention available on requestYes, audit logs retained for up to a year; longer retention available on request · Source: object_read:doc_099_001
- BackupsDaily snapshots with automated restore testing; retention about a monthDaily snapshots with automated restore testing; retention about a month · Source: object_read:doc_099_001
- Vulnerability patchingpatching within a few weeks for critical issuespatching within a few weeks for critical issues · Source: object_read:doc_099_001
The document
Body
Kesselfeld Software - Security Questionnaire
Date: 6 November 2025 Completed by: Hannah Lowe, Solutions Engineer, BB-Demo Customer tier: Growth
Information Security Controls
| # | Question | Answer |
|---|---|---|
| 1 | What is the data residency requirement for Kesselfeld Software? | Data hosted in EU region, encrypted at rest and in transit |
| 2 | Does the Company Brain support SSO/SAML for user authentication? | SAML 2.0 supported on Enterprise tier; Growth tier uses password and two-factor authentication |
| 3 | Are audit logs retained for compliance purposes? | Yes, audit logs retained for up to a year; longer retention available on request |
| 4 | How are backups performed and tested? | Daily snapshots with automated restore testing; retention about a month |
| 5 | What encryption standards are used? | AES-256 for data at rest, TLS 1.3 for data in transit |
| 6 | Is there a data classification policy? | Data classified by sensitivity; access controls and retention policies enforced by role |
| 7 | Are there network penetration tests or security assessments? | Annual third-party security audit; results shared with Enterprise customers under NDA |
| 8 |
Read the whole document (1,981 characters)
| What is the process for vulnerability management? | Regular vulnerability scans; patching within a few weeks for critical issues | | 9 | How is access to customer data restricted? | Role-based access control; admins can restrict user access by connector and record type | | 10 | Is there a Data Processing Agreement (DPA) in place? | Yes, DPA provided as part of the standard MSA; supplementary DPA available for GDPR compliance |
Tier-Specific Features
Growth tier includes:
- Password and two-factor authentication
- Role-based access control
- Audit logging with long-term retention
- Encrypted data at rest and in transit
- Daily backups
- Standard support
Next Steps
Please confirm acceptance of these security controls or request any modifications.
Unusual terms
Current to 9 Oct 26- No SSO or SAML on Growth tier
- Audit results shared with Enterprise only, under NDA
- Vague retention and patching periods