Pellegrin Hart Benefits - Security Questionnaire
Documentfinal Pellegrin Hart Benefits · security questionnaire · final · 15 Mar 2026
Final security questionnaire response prepared by Theo Gallagher, completed 15 Mar 2026, for a Growth tier prospect. It describes how the product is built and operated. No contract exists and it states no price, availability percentage or response time.
What it says
What this says
As at Fri 9 Oct 2026Final security questionnaire response prepared by Theo Gallagher, completed 15 Mar 2026, for a Growth tier prospect. It describes how the product is built and operated. No contract exists and it states no price, availability percentage or response time.
What it is: a prospect-facing answer sheet covering architecture, access control, availability, incidents and exit. It says "Pellegrin Hart Benefits is a prospect, so no contract is in place yet and no live data has been connected."
Commits: nothing binding. Service levels are referred to the schedule without figures, and exit terms are only promised: "exit terms will be written into the order form before signature."
Unusual: nothing off standard terms. It confirms Growth has no SSO or SCIM and that Premium support "is an add-on and is not part of Growth."
Not settled: penetration testing, certification and audit reports are not described, and answers held by the platform team "will be confirmed by that team before it is relied on in a contract." Residency, connector numbers and exit terms await an order form.
As found in this document
As at Fri 9 Oct 2026- Service creditsThe Growth service level applies, with service credits for availability only. Data freshness is not credited on Growth.Source: the AI read of this record
- Nightly refreshThe nightly refresh completes before the start of the customer's business day on working days, on every tier.Source: the AI read of this record
- Exit termsexit terms will be written into the order form before signature.Source: the AI read of this record
Body
Pellegrin Hart Benefits - Security Questionnaire
Prepared by Theo Gallagher, Solutions Engineer, BG-Demo
Status: Final. Completed 15 Mar 2026.
Scope of this response
This questionnaire answers Pellegrin Hart Benefits' security questions for the Growth tier of the BG-Demo B-Glass. Pellegrin Hart Benefits is a prospect, so no contract is in place yet and no live data has been connected. The answers describe how the product is built and operated. Where a control is held by the BG-Demo platform team rather than by the solutions team, the answer says so and evidence is available on request. Where we cannot evidence a control, we say that plainly.
Architecture and data location
Read the whole document (4,256 characters)
| Question | Answer | Evidence |
|---|---|---|
| Where is customer data stored and processed? | The brain is built and run inside the customer's own Snowflake account. BG-Demo does not hold a separate copy of the customer's business data outside that account. | Architecture overview, available on request |
| Is a dedicated regional data residency available? | Dedicated EU or US data residency is an add-on. For Pellegrin Hart Benefits the data sits in the customer's own Snowflake account and region. | Order form, once one exists |
| Which systems does the brain read from? | Only the sources the customer chooses to connect, such as the CRM, the helpdesk, the call recorder and the mailbox. The Growth tier includes a limited number of connectors. | Connector list agreed during onboarding |
Access control
| Question | Answer | Evidence |
|---|---|---|
| How do users sign in? | Growth does not include single sign-on or SCIM. Those are Enterprise features. Access on Growth is managed by the customer's administrators. | Tier description |
| Can access be limited by team? | Yes, administrators control who sees which areas. We can evidence that during the demo on the prospect's own data. | Demonstration |
| Who at BG-Demo can reach customer data? | Access is limited to staff working on the implementation and support of that customer. The access list is held by the platform team. | Access list, on request via the platform team |
Availability and resilience
| Question | Answer | Evidence |
|---|---|---|
| What availability is committed? | The Growth service level applies, with service credits for availability only. Data freshness is not credited on Growth. | Service level schedule |
| What is the first response time for an urgent issue? | The Growth first-response commitment for the highest priority applies. | Service level schedule |
| When is data refreshed? | The nightly refresh completes before the start of the customer's business day on working days, on every tier. | Service level schedule |
Incident handling and support
| Question | Answer | Evidence |
|---|---|---|
| How are incidents reported to customers? | Customers are told through the support channel agreed at onboarding. A written incident report follows a significant event. | Incident report template |
| Is a named engineer available? | Premium support, with a named engineer, is an add-on and is not part of Growth. | Add-on description |
Exit and portability
| Question | Answer | Evidence |
|---|---|---|
| What happens to the data if the customer leaves? | Because the brain lives in the customer's own Snowflake account, the customer keeps the data and the structures built there. Here is the dated commitment: exit terms will be written into the order form before signature. | Order form, once one exists |
Open points and limits of this response
- This is a response for a prospect, not a statement of controls tested against a live deployment.
- Penetration testing, certification and audit reports are not described here, because no such evidence is attached to this record. If Pellegrin Hart Benefits needs them, please ask and we will confirm what can be provided.
- Any answer marked as held by the platform team will be confirmed by that team before it is relied on in a contract.
Next steps
- Pellegrin Hart Benefits reviews these answers and lists any follow-up questions.
- BG-Demo returns written answers with evidence attached.
- The demo on the prospect's own data shows access control in practice.
Thanks, Theo