Hartside Student Living - Security Questionnaire
Documentfinal Hartside Student Living · security_questionnaire · final · 2026-01-03
Security questionnaire completed by Hannah Lowe on 3 Jan 2026 for the proposed Growth subscription. States the P1 first response is one business hour and the nightly refresh is complete by 07:00. Certifications, penetration testing and incident notification are still to follow in writing.
What it says
What this says
Current to 13 Oct 26Security questionnaire completed by Hannah Lowe on 3 Jan 2026 for the proposed Growth subscription. States the P1 first response is one business hour and the nightly refresh is complete by 07:00. Certifications, penetration testing and incident notification are still to follow in writing.
What it is: a pre-sale security questionnaire, version one, filed as final, answering questions for the proposed Growth subscription. It is a set of answers, not a contract.
Commits: "The Growth first response for a P1 is one business hour." Also "The nightly refresh is complete by 07:00 customer local time on business days." Credits for Growth "cover availability only".
Unusual: nothing departs from the standard Growth terms. The document notes that "An executed order form can change any of these terms."
Not settled: certifications, penetration testing and incident notification are "answered separately in writing". The document gives no availability percentage or price, and does not show whether Hartside replied on single sign-on or data residency.
As found in this document
Current to 9 Oct 26- P1 first response (Growth)one business hourSource: object_read:doc_158_001
- Nightly refreshcomplete by 07:00 customer local time on business dayscomplete by 07:00 customer local time on business days · Source: object_read:doc_158_001
- Service credits (Growth)availability onlySource: object_read:doc_158_001
The document
Body
Hartside Student Living - Security Questionnaire
Completed by Hannah Lowe, Solutions Engineer, BB-Demo Date: 3 Jan 2026 Status: Final, version one Tier discussed: Growth BB-Demo account owner: Lewis Kerr Customer Success Manager: Hollie Grieve
This questionnaire covers the proposed Growth subscription for Hartside Student Living. Where the honest answer depends on the contract, the answer says so. Where a question needs a written statement from our security lead, I have said that rather than guess.
1. Architecture and data location
Read the whole document (3,679 characters)
| # | Question | Answer |
|---|---|---|
| 1.1 | Where does the service run? | BB-Demo is built and run inside the customer's own Snowflake account. The brain is not a separate hosted copy of your data held by us. |
| 1.2 | Does customer data leave the customer's environment? | To be precise, the data sits in your Snowflake account. Source systems you choose to connect, such as your CRM, helpdesk or accounting system, are read into it. |
| 1.3 | Can data be held in a specific region? | Dedicated EU or US data residency is available as an add-on. It is not part of the base Growth subscription. |
| 1.4 | Which systems can be connected? | Growth includes a defined number of connectors. Named systems we support include Salesforce, HubSpot, Zendesk, Xero, Gong, Microsoft 365, Google Workspace, Dropbox, SharePoint, Slack and Snowflake. |
2. Access and identity
| # | Question | Answer |
|---|---|---|
| 2.1 | Is single sign-on supported? | Single sign-on and SCIM provisioning are part of the Enterprise tier, not Growth. If they are a requirement for Hartside, the Enterprise tier is the route. |
| 2.2 | Who controls who can see what? | Access sits within your Snowflake account, so your own administrators remain in control of the environment. |
| 2.3 | Is there a named support engineer? | Premium support with a named engineer is an add-on. Growth uses the standard support arrangement. |
3. Service levels and reliability
| # | Question | Answer |
|---|---|---|
| 3.1 | What availability is committed? | The standard Growth service level applies. Service credits for Growth cover availability only. |
| 3.2 | How quickly do you respond to a priority incident? | The Growth first response for a P1 is one business hour. |
| 3.3 | How fresh is the data? | The nightly refresh is complete by 07:00 customer local time on business days. Freshness is not credited under the Growth service level. |
| 3.4 | Can service terms be changed? | An executed order form can change any of these terms. |
4. Policies, certifications and testing
| # | Question | Answer |
|---|---|---|
| 4.1 | Which independent certifications do you hold? | This is answered separately in writing, after checking with our security lead, so that nothing is overstated. |
| 4.2 | Do you carry out penetration testing and share summaries? | Answered separately in writing, after checking. |
| 4.3 | What is your incident notification process? | Answered separately in writing, after checking, and aligned to the contract. |
| 4.4 | Is there a sandbox for testing changes? | A Sandbox is part of Enterprise from the second version of the offering. It is not included in Growth. |
5. Open items for Hartside
- Confirm whether single sign-on is a firm requirement, as this would move the proposal from Growth to Enterprise.
- Confirm whether data residency in a specific region is needed.
- Tell us which of section 4 you want answered in writing first.
The short answer is that the architecture keeps your data in your own Snowflake account. The longer answer is in the written statements above, which I'll put in writing.
Thanks, Hannah