Kaltenbrunn Medizintechnik - Security Questionnaire
Documentfinal Kaltenbrunn Medizintechnik · security_questionnaire · final · 2026-01-23
Final version one security questionnaire prepared by Hannah Lowe on 23 Jan 2026 for an Enterprise engagement. The brain runs in the customer's own Snowflake account, EU region. It states no figures; service levels defer to the executed order form.
What it says
What this says
Current to 13 Oct 26Final version one security questionnaire prepared by Hannah Lowe on 23 Jan 2026 for an Enterprise engagement. The brain runs in the customer's own Snowflake account, EU region. It states no figures; service levels defer to the executed order form.
What it is: a questionnaire answering the customer's security questions ahead of an Enterprise engagement, prepared by Hannah Lowe. Answers cover architecture, access control, security review support and service levels.
Commits: it says "Inside the customer's own Snowflake account" and that SSO and SCIM are part of Enterprise. It also says Hannah leads security review support and answers follow-ups in writing.
Unusual: it states no availability percentage, response time or price. Service levels point to "the executed order form", and stale-data credits are stated for Enterprise only.
Not settled: section 6 lists three items needing written confirmation: the architecture diagram, the inherited controls list and the incident notification process. The questionnaire is not a contract and does not show whether the order form was signed.
As found in this document
Current to 9 Oct 26- Data locationIn the EU region of the customer's Snowflake accountIn the EU region of the customer's Snowflake account · Source: object_read:doc_161_001
- AvailabilityThe Enterprise availability level, as written in the executed order form.The Enterprise availability level, as written in the executed order form. · Source: object_read:doc_161_001
- P1 first responseThe Enterprise first-response commitment, which is the fastest of the three tiers.The Enterprise first-response commitment, which is the fastest of the three tiers. · Source: object_read:doc_161_001
- Nightly refreshThe nightly refresh is complete before the start of the customer's business day, on business days.The nightly refresh is complete before the start of the customer's business day, on business days. · Source: object_read:doc_161_001
- Service creditsOn Enterprise, credits apply to both availability and data freshness.On Enterprise, credits apply to both availability and data freshness. · Source: object_read:doc_161_001
- Follow-up questionsAny follow-up question is answered in writing and added to this record as a new version.Any follow-up question is answered in writing and added to this record as a new version. · Source: object_read:doc_161_001
The document
Body
Kaltenbrunn Medizintechnik - Security Questionnaire
Status: Final, version one Prepared by: Hannah Lowe, Solutions Engineer, BB-Demo Date: 23 Jan 2026 Account owner: Matteo Ricci Customer success manager: Elena Novak Tier under discussion: Enterprise
1. Purpose and scope
This document answers the security questions raised by Kaltenbrunn Medizintechnik in Hamburg ahead of an Enterprise engagement. It covers how the company brain is built and run for the customer, where the data sits and how access is managed. Where a control belongs to the customer's own Snowflake account rather than to BB-Demo, the answer says so. Anything that needs a written commitment is marked as such, so nothing here is stronger than the evidence behind it.
2. Architecture and data location
Read the whole document (3,935 characters)
| Ref | Question | Answer |
|---|---|---|
| A1 | Where does the brain run? | Inside the customer's own Snowflake account. BB-Demo does not move the customer's data into a separate BB-Demo environment. |
| A2 | Where is the data held? | In the EU region of the customer's Snowflake account, in line with the data residency requirement for this engagement. |
| A3 | Which systems are connected? | Only the sources the customer chooses, for example the CRM, the helpdesk, Microsoft 365 or the accounting system. Each connector is agreed in the order form. |
| A4 | Does BB-Demo hold a copy of customer data outside the customer's account? | No separate copy is held by design. Hannah will confirm this in writing against the final architecture diagram before signature. |
3. Access control
| Ref | Question | Answer |
|---|---|---|
| B1 | Is single sign-on supported? | Yes. SSO and SCIM provisioning are part of the Enterprise tier. |
| B2 | How are leavers handled? | Through SCIM, so that removing a person in the customer's identity system removes their access to the brain. |
| B3 | Can access be limited by team? | Yes. The brain respects the permissions configured in the customer's Snowflake account. The exact role design is agreed during implementation. |
| B4 | Who at BB-Demo can reach the customer's environment? | Only named BB-Demo staff working on the engagement, and only through access the customer grants and can revoke. |
4. Security review support
| Ref | Question | Answer |
|---|---|---|
| C1 | Is security review support included? | Yes. Enterprise implementation includes support for the customer's security review, led by Hannah Lowe. |
| C2 | Can the customer's IT team speak to an engineer directly? | Yes. Hannah is the contact for technical and architecture questions. |
| C3 | Will further questions be answered in writing? | Yes. Any follow-up question is answered in writing and added to this record as a new version. |
5. Service levels and support
| Ref | Question | Answer |
|---|---|---|
| D1 | What availability applies? | The Enterprise availability level, as written in the executed order form. |
| D2 | What is the response commitment for a priority one incident? | The Enterprise first-response commitment, which is the fastest of the three tiers. The executed order form is the final word. |
| D3 | When is data refreshed? | The nightly refresh is complete before the start of the customer's business day, on business days. |
| D4 | Are service credits available for stale data? | Yes. On Enterprise, credits apply to both availability and data freshness. |
6. Items to confirm in writing
These points are answered in principle above but need a written confirmation from BB-Demo before the customer relies on them.
- The final architecture diagram showing the EU region and the connectors chosen.
- The detailed list of controls inherited from the customer's Snowflake account.
- The incident notification process, agreed with the customer's security team.
7. Sign-off
Completed by Hannah Lowe, Solutions Engineer, BB-Demo, on 23 Jan 2026.
Thanks, Hannah
Unusual terms
Current to 9 Oct 26- Service levels deferred to the executed order form
- Three items need written confirmation before reliance