Carnmoor Fleet Leasing - Security Questionnaire
Documentfinal Carnmoor Fleet Leasing · security_questionnaire · final · 2025-09-12
BB-Demo's final answers to Carnmoor's security questions while it evaluates Growth, dated 12 Sep 2025. P1 first response is within one business hour; nightly refresh by 07:00. It states no price and is not a contract.
What it says
What this says
Current to 13 Oct 26BB-Demo's final answers to Carnmoor's security questions while it evaluates Growth, dated 12 Sep 2025. P1 first response is within one business hour; nightly refresh by 07:00. It states no price and is not a contract.
What it is: a pre-sale security and data-handling questionnaire prepared by Anya Petrova for Carnmoor Fleet Leasing. It is marked Final, version one, and describes the Growth tier "as it would be offered".
Commits: it states a P1 first response "within one business hour" and a nightly refresh complete "by 07:00 customer local time on business days". Service credits for Growth "apply to availability only".
Unusual: nothing off standard terms. It flags that SSO and SCIM are Enterprise only, and that regional data residency and Premium support are add-ons.
Not settled: it states no price, discount or availability percentage. It says "Nothing here replaces an executed order form", so contracted terms are not fixed here, and it does not show whether Carnmoor went ahead.
As found in this document
Current to 9 Oct 26- P1 first response (Growth)within one business hour on the Growth tierwithin one business hour on the Growth tier · Source: object_read:doc_151_001
- Nightly refreshcompletes by 07:00 customer local time on business dayscompletes by 07:00 customer local time on business days · Source: object_read:doc_151_001
- Service credits (Growth)apply to availability onlySource: object_read:doc_151_001
The document
Body
Carnmoor Fleet Leasing - Security Questionnaire
Status: Final Version: one Date: 12 Sep 2025 Prepared by: Anya Petrova, Solutions Engineer, BB-Demo Prepared for: Carnmoor Fleet Leasing, Milton Keynes Account owner: Sophie Ling Customer success manager: Amara Obi Tier under evaluation: Growth
Purpose and scope
This questionnaire records BB-Demo's answers to the security and data-handling questions raised by Carnmoor Fleet Leasing while it evaluates the Growth tier of the company brain. The intended use is a single view for corporate account managers, the driver service desk and remarketing, bringing each client's fleet, queries and invoices together.
Answers describe the Growth tier as it would be offered to Carnmoor. Where a capability belongs to a different tier or is an optional add-on, the answer says so plainly. Nothing here replaces an executed order form, which would decide the contracted terms.
Architecture and data location
Read the whole document (6,009 characters)
| Question | Answer |
|---|---|
| Where does the company brain run? | Inside the customer's own Snowflake account. BB-Demo does not copy Carnmoor data into a separate BB-Demo data store for the purpose of running the brain. |
| Who owns the data? | Carnmoor owns all source data and everything derived from it inside its Snowflake account. |
| Can data residency be fixed to a region? | The brain sits wherever the customer's Snowflake account sits. Dedicated EU or US data residency is available as an add-on where the customer needs it set out contractually. |
| Is customer data used to train models for other customers? | No. Each brain is built and run within the customer's own account and is not pooled with other customers' data. |
Source systems and connectors
| Question | Answer |
|---|---|
| Which systems can be connected? | Salesforce, HubSpot, Zendesk, Xero, Gong, Microsoft 365, Google Workspace, Dropbox, SharePoint, Slack and Snowflake. |
| How are connectors authorised? | Each connector is authorised by a named administrator at the customer, using the permissions that source system offers. Access can be withdrawn by the customer at any time by revoking that authorisation in the source system. |
| Can we limit what a connector reads? | Yes. The scope of each connector is agreed at implementation and can be narrowed by the customer. Anything outside the agreed scope is not indexed. |
| What happens when a connector is removed? | It stops loading. The customer decides whether previously indexed material is retained or removed from its Snowflake account. |
Access control and identity
| Question | Answer |
|---|---|
| How do users sign in on the Growth tier? | Through the standard sign-in provided with the product. Single sign-on and automated user provisioning (SSO and SCIM) are part of the Enterprise tier and are not included in Growth. |
| Can access be restricted by team? | Yes. Pages, chat and search respect the access that has been configured for each team, so the driver service desk need not see what remarketing sees unless Carnmoor chooses that. |
| Who administers the brain? | Carnmoor nominates its own administrators. We recommend more than one, so that a departure does not leave the brain without an administrator. |
| Does BB-Demo staff access customer data? | Only as needed to deliver implementation and support, and only under the access the customer grants inside its Snowflake account. The customer can revoke that access. |
Availability and support
| Question | Answer |
|---|---|
| What availability applies? | The Growth service level for availability. Service credits for Growth apply to availability only. |
| How quickly are priority incidents answered? | First response to a P1 incident is within one business hour on the Growth tier. |
| When is data refreshed? | The nightly refresh completes by 07:00 customer local time on business days, which applies to every tier. |
| Is a named support engineer included? | No. Premium support, with a named engineer, is an add-on. |
| Is a test environment available? | The Sandbox is an add-on, and is included with Enterprise from the second price book release. It is not part of Growth by default. |
Security review and assurance
| Question | Answer |
|---|---|
| Is security review support included? | Security review support is included in the Enterprise implementation. For Growth, Carnmoor's questions are answered through this document, and Anya Petrova can follow up on anything further. |
| Can Carnmoor see the contract position before signing? | Yes. Terms would be set out in an order form under the MSA, and the executed order form would be the reference for price and service levels. |
| Will BB-Demo complete our own supplier forms? | Where a form is sent, BB-Demo will answer it from the same facts as this document and say clearly where a capability is not part of the tier. |
Incident and change communication
| Question | Answer |
|---|---|
| How is Carnmoor told about incidents? | Through the support channel agreed at onboarding, with updates until the incident is resolved and an incident report afterwards for significant events. |
| How are product changes announced? | Release notes are shared with customers, and changes that affect connectors or access are flagged to administrators in advance. |
Open items and limits of this document
- Single sign-on and automated provisioning are not in Growth. If Carnmoor needs them, the Enterprise tier is the route, and the account owner can set out what changes.
- Data residency in a specific region is an add-on and would need to be written into any order form.
- This questionnaire states no contracted figures. Pricing and any discount would appear only in a proposal and an order form.
Contacts
| Role | Name |
|---|---|
| Solutions Engineer, BB-Demo | Anya Petrova |
| Account owner, BB-Demo | Sophie Ling |
| Customer success manager, BB-Demo | Amara Obi |
This version is final as of 12 Sep 2025.