Carnwath Haulage - Security Questionnaire
Documentfinal Carnwath Haulage: documents · security_questionnaire · final · 2023-11-04
Security questionnaire completed for Carnwath Haulage's Growth onboarding, attested by BB-Demo CTO Tobias Renwick on 4 Nov 2023. Data stays in the customer's own Snowflake account; Growth P1 first response is within one business hour.
What it says
What this says
Current to 12 Oct 26Security questionnaire completed for Carnwath Haulage's Growth onboarding, attested by BB-Demo CTO Tobias Renwick on 4 Nov 2023. Data stays in the customer's own Snowflake account; Growth P1 first response is within one business hour.
What it is: a BB-Demo answer sheet to the customer's security questions, filed under Customers/Carnwath Haulage/Security. It is attested by Tobias Renwick, Chief Technology Officer and Co-founder, as accurate as of 4 Nov 2023.
Commits: data stays "in the customer's own Snowflake account", TLS 1.2 or higher in transit, and for Growth "the first response to critical incidents is within one business hour". Backups are the customer's responsibility.
Unusual: nothing off the standard Growth terms. It is a statement of posture, not a contract, and carries no price, term or renewal date.
Not settled: the document is dated 4 Nov 2023 and is not shown to have been refreshed since. It names no customer signatory and does not show whether the customer accepted it.
As found in this document
Current to 9 Oct 26- Date signed4 Nov 2023Source: object_read:doc_120_001
- Data locationCustomer data remains in the customer's own Snowflake account, which the customer controls.Customer data remains in the customer's own Snowflake account, which the customer controls. · Source: object_read:doc_120_001
- Encryption in transitTLS 1.2 or higherSource: object_read:doc_120_001
- Growth tier P1 first responsewithin one business hourSource: object_read:doc_120_001
- Backupsthe customer's responsibility within their Snowflake accountthe customer's responsibility within their Snowflake account · Source: object_read:doc_120_001
The document
Body
Carnwath Haulage - Security Questionnaire
Introduction
This security questionnaire is completed as part of the onboarding process for BB-Demo's Growth subscription tier. It sets out how BB-Demo handles data security and compliance in accordance with industry standards.
Questions and Answers
| Question | Answer |
|---|---|
| Where is customer data stored? | Customer data remains in the customer's own Snowflake account, which the customer controls. BB-Demo runs as a deployed layer within that account and does not store copies of customer data. |
| What encryption is used in transit? | All communication between systems is encrypted in transit using TLS 1.2 or higher. |
| What encryption is used at rest? | Data at rest is encrypted using the customer's Snowflake account encryption settings. BB-Demo does not apply additional encryption. |
| How is access controlled to the platform? | Access is controlled through user login with credentials managed by the customer. The Growth tier uses standard user management. For account administration, role-based access controls limit who can manage connectors, team settings and billing. |
| How are credentials and API keys managed? | All |
Read the whole document (3,255 characters)
credentials and API keys for connectors are stored securely within the customer's Snowflake account and encrypted at rest. BB-Demo engineers do not have access to these credentials except where explicitly granted by the customer for troubleshooting purposes. | | How is incident response handled? | BB-Demo maintains an incident response process. Security incidents are logged, investigated and reported to the customer in accordance with the service level agreement. For Growth tier, the first response to critical incidents is within one business hour. | | Is there a change management process? | Yes. Changes to the platform are tested and rolled out in a controlled manner. Maintenance windows are scheduled where possible. | | Are backups taken? | Backups of data are the customer's responsibility within their Snowflake account. BB-Demo does not manage backups on behalf of the customer. | | How is the platform audited? | BB-Demo undergoes regular security reviews. The platform architecture has been reviewed for security. For Enterprise tier customers, additional security review is part of onboarding; Growth tier customers have access to summary documentation. | | What is the data retention policy? | Data is retained for as long as the subscription is active. On termination, the customer can export their data from their Snowflake account. BB-Demo does not retain copies of customer data after offboarding. | | Is there a responsible disclosure process? | Security vulnerabilities should be reported to the security team. BB-Demo will investigate and patch vulnerabilities according to their severity. | | Who can I contact with security questions? | Your account point of contact is your technical sponsor at BB-Demo. Security questions can be escalated via them. |
Attestation
I confirm that the information provided in this questionnaire is accurate as of 4 Nov 2023 and reflects the current security posture of BB-Demo's platform.
For and on behalf of BB-Demo:
Tobias Renwick Chief Technology Officer and Co-founder 4 Nov 2023