Brimscombe Energy - Security Questionnaire
Documentfinal Brimscombe Energy · security questionnaire · final · 6 Oct 2024
Final security questionnaire prepared by Hannah Lowe on 6 Oct 2024 for Brimscombe Energy's Enterprise tier review. It sets no availability figure, P1 time or price, and defers those to the order form. Nightly refresh by 07:00 UK time is stated.
What it says
What this says
As at Fri 9 Oct 2026Final security questionnaire prepared by Hannah Lowe on 6 Oct 2024 for Brimscombe Energy's Enterprise tier review. It sets no availability figure, P1 time or price, and defers those to the order form. Nightly refresh by 07:00 UK time is stated.
What it is: BG-Demo's answers to a prospect's security review, covering hosting, access, data protection, service levels, incidents and assurance. It is marked Final and is not a contract.
Commits: the refresh is stated as "The nightly refresh completes by 07:00 UK time on business days." On Enterprise, a freshness breach is credited as well as an availability breach.
Unusual: certifications and penetration test summaries are not given. The sheet says they will be shared as documents, so the questionnaire does not show whether any exist.
Not settled: the availability figure, service credit and P1 response are left to the order form. Four open points remain, including the identity provider and the first connector wave. Residency add-on and Premium support are optional and not stated as bought.
As found in this document
As at Fri 9 Oct 2026- Nightly refreshThe nightly refresh completes by 07:00 UK time on business days.Source: the AI read of this record
- Freshness creditOn Enterprise, a breach of freshness is credited as well as a breach of availability.Source: the AI read of this record
- Availability and service creditThe figure and the service credit are set out in the order form.Source: the AI read of this record
The document
Body
Brimscombe Energy - Security Questionnaire
Status: Final Prepared by: Hannah Lowe, Solutions Engineer, BG-Demo Date: 6 Oct 2024 Prospect: Brimscombe Energy, Gloucester Tier under review: Enterprise Account owner: Tom Ashdown Customer success manager: Daniel Okafor
Purpose and scope
This questionnaire records BG-Demo's answers to the security review for Brimscombe Energy, a business gas and electricity supplier licensed by Ofgem. Brimscombe Energy is assessing the Enterprise tier so that its key-account, collections and complaints teams can see each business customer's sites, contracts, calls and bills together.
To be precise, the answers describe how B-Glass is built and run. Where a point is set by contract rather than by architecture, the answer says so and points to the order form or the MSA. Where a control depends on Brimscombe Energy's own Snowflake configuration, the answer says that too, rather than claiming it for BG-Demo.
Hosting and architecture
Read the whole document (6,798 characters)
| Topic | Question | BG-Demo answer |
|---|---|---|
| Where the brain runs | Where is the platform hosted and where does our data sit? | The brain is built and run inside the customer's own Snowflake account. Brimscombe Energy's data stays in its own Snowflake environment and is not copied into a BG-Demo-owned data store. |
| Data residency | Can data be held in a specific region? | Residency follows the region of the customer's Snowflake account. Dedicated EU or US residency is available as an add-on and would be written into the order form. |
| Source systems | Which systems does the brain read from? | Only the connectors Brimscombe Energy chooses to enable, for example the CRM, the helpdesk, the call recorder, mailboxes and the accounting system. Each connector is listed in the order form, and the Enterprise tier allows the full Enterprise connector allowance. |
| Separation | Is our data separated from other customers? | Yes. Because each brain lives in the customer's own Snowflake account, there is no shared data layer between customers. |
Access control and identity
| Topic | Question | BG-Demo answer |
|---|---|---|
| Single sign-on | Can staff sign in with our identity provider? | Yes. SSO and SCIM are part of the Enterprise tier, so sign-in and user lifecycle can follow Brimscombe Energy's own directory. |
| Joiners and leavers | How are leavers removed? | With SCIM enabled, removal in the directory removes access to the brain. Without it, an administrator removes the user by hand. We recommend SCIM for a business of this size. |
| Least privilege | Can access be limited by team? | Access to pages, chat and search follows the permissions set by Brimscombe Energy's administrators. Collections, complaints and key-account teams can be given different views. |
| BG-Demo staff access | Who at BG-Demo can see our data? | BG-Demo staff work inside the customer's Snowflake account only with the access the customer grants, and only for implementation and support. The customer controls and can withdraw that access. |
Data protection
| Topic | Question | BG-Demo answer |
|---|---|---|
| Personal data | Will the brain hold personal data? | Yes, in the sense that customer records, calls and emails will include names and contact details of business contacts. The processing terms are set out in the data processing agreement that sits under the MSA. |
| Encryption | Is data encrypted in transit and at rest? | The short answer is yes for the platform layer, because the brain relies on Snowflake's own encryption and on encrypted connections to each source system. The longer answer is that the exact configuration is Brimscombe Energy's Snowflake setup, and I'll put the detail in writing alongside the architecture diagram. |
| Retention and deletion | What happens to our data if we leave? | Data lives in the customer's account, so it stays under the customer's control. On exit, the brain's indexes and connectors are switched off and removed in line with the MSA. |
| Sensitive categories | Can some sources be excluded? | Yes. A connector or a folder within a source can be left out, and Brimscombe Energy decides this at design time with our solutions engineer. |
Availability and service levels
| Topic | Question | BG-Demo answer |
|---|---|---|
| Availability | What availability is committed? | The Enterprise availability level applies, which is the highest of the three tiers. The figure and the service credit are set out in the order form. |
| Support response | How quickly is a priority incident answered? | The Enterprise first-response level for a P1 applies. Premium support, with a named engineer during extended UK hours, is an optional add-on. |
| Data freshness | How current is the data? | The nightly refresh completes by 07:00 UK time on business days. On Enterprise, a breach of freshness is credited as well as a breach of availability. |
| Testing changes | Is there somewhere to test before going live? | A Sandbox is available on Enterprise from the second version of the tier, and Brimscombe Energy may find it useful for testing new connectors. |
Incident handling
| Topic | Question | BG-Demo answer |
|---|---|---|
| Incident process | How are incidents reported and managed? | Incidents are raised through the helpdesk and classified by priority. The customer's named contacts are told of any incident affecting their brain. |
| Breach notification | Will we be told of a data breach? | Yes. Notification duties and timings are set in the data processing agreement and will be repeated in the order form schedule if Brimscombe Energy asks. |
Assurance and evidence
| Topic | Question | BG-Demo answer |
|---|---|---|
| Independent certification | Do you hold independent security certifications? | I won't overstate this. Any certification or audit report will be supplied as a document for Brimscombe Energy's team to read, not summarised in this sheet. |
| Penetration testing | Is the platform independently tested? | The same applies: the summary of testing is shared as a document under confidentiality, not paraphrased here. |
| Security review support | Will you support our own review? | Yes. Security review support is included in the Enterprise implementation, and I will answer follow-up questions in writing. |
Open points and next steps
- Brimscombe Energy's IT team to confirm the identity provider so SSO and SCIM design can be planned.
- Brimscombe Energy to confirm which source systems are in scope for the first connector wave.
- BG-Demo to send the architecture diagram and the data processing agreement alongside this sheet.
- Tom Ashdown to coordinate the order form once the review is accepted; Daniel Okafor to join the onboarding planning.
Thanks, Hannah
Unusual terms
As at Fri 9 Oct 2026- Certifications deferred to separate documents
- Sandbox only from second version of tier