Penmaen Software - Security Questionnaire
Documentfinal Penmaen Software · security questionnaire · final · 27 May 2024
Final security questionnaire dated 27 May 2024, prepared by Hannah Lowe ahead of a Growth subscription. It quotes 99.5% availability and a P1 first response of one business hour. No price is recorded; penetration test, sub-processor and certification items are open.
What it says
What this says
As at Fri 9 Oct 2026Final security questionnaire dated 27 May 2024, prepared by Hannah Lowe ahead of a Growth subscription. It quotes 99.5% availability and a P1 first response of one business hour. No price is recorded; penetration test, sub-processor and certification items are open.
What it is: BG-Demo's written answers to Penmaen Software's IT and security questions, covering architecture, access control and service levels for the Growth tier only. It is not a contract.
Commits: "The Growth service level of 99.5% availability", a P1 first response of "one business hour", and a nightly refresh "by 07:00 customer local time on business days". Credits apply to availability only.
Unusual: nothing off the standard Growth terms. The answers state data residency is an add-on and SSO and SCIM are Enterprise features.
Not settled: the penetration test report is "Not covered here. Hannah to confirm with Ewan before anything is stated." The sub-processor list and certification evidence are to follow in writing. Any answer depending on an order form is subject to that order form, and no contract value is recorded.
As found in this document
As at Fri 9 Oct 2026- Availability99.5% availabilitySource: the AI read of this record
- P1 first responseone business hourSource: the AI read of this record
- Nightly refreshcompletes by 07:00 customer local time on business daysSource: the AI read of this record
- Service creditsOn Growth, credits apply to availability only. Data freshness is not credited on this tier.Source: the AI read of this record
Body
Penmaen Software - Security Questionnaire
Status: Final Version: one Prepared by: Hannah Lowe, Solutions Engineer, BG-Demo Date: 27 May 2024 Tier under discussion: Growth
Purpose
This questionnaire records the answers BG-Demo gave to Penmaen Software's IT and security questions ahead of a Growth subscription. Penmaen is a Cardiff vendor of booking and membership software for gyms and leisure centres. Its customer success team wants to read tickets, renewals and usage per leisure operator through B-Glass.
To be precise, every answer below describes how BG-Demo works today. Where a control depends on the customer's own Snowflake account, the answer says so. I'll put anything further in writing on request.
Section A: Architecture and data location
Read the whole document (3,192 characters)
| Ref | Question | Answer |
|---|---|---|
| A1 | Where does the brain run? | Inside Penmaen's own Snowflake account. BG-Demo does not copy customer data into a separate BG-Demo data store. |
| A2 | Who controls the data? | Penmaen. The data stays in its Snowflake account and under its access policies. |
| A3 | Which systems would be connected? | Source systems such as the CRM, the helpdesk and the accounting system, chosen by Penmaen and limited to the Growth connector allowance. |
| A4 | Is data residency configurable? | Dedicated EU or US residency is an add-on. It is not part of the Growth tier as quoted. |
Section B: Access control
| Ref | Question | Answer |
|---|---|---|
| B1 | How do users sign in? | Through the sign-in methods available on the Growth tier. SSO and SCIM are Enterprise features and are not included in Growth. |
| B2 | Can access be limited by role? | Yes. Access to the brain follows the roles and grants Penmaen sets up in its Snowflake account. |
| B3 | Who at BG-Demo can reach customer data? | Only staff working on the implementation or on a support request, and only to the extent the customer's Snowflake permissions allow. |
Section C: Availability and support
| Ref | Question | Answer |
|---|---|---|
| C1 | What availability is committed? | The Growth service level of 99.5% availability. |
| C2 | How quickly are priority incidents answered? | The Growth first-response time for a P1 issue is one business hour. |
| C3 | When is data refreshed? | The nightly refresh completes by 07:00 customer local time on business days. |
| C4 | Are service credits offered? | On Growth, credits apply to availability only. Data freshness is not credited on this tier. |
Section D: Items not covered in this response
| Ref | Question | Status |
|---|---|---|
| D1 | Penetration test report | Not covered here. Hannah to confirm with Ewan before anything is stated. |
| D2 | Sub-processor list | Not covered here. Will be provided separately in writing. |
| D3 | Certification evidence | Not covered here. Will be provided separately in writing. |
Notes
- This questionnaire reflects the Growth tier only. Enterprise security review support is not part of this scope.
- Any answer that depends on a signed order form is subject to the terms of that order form.
- No contract value is recorded against this questionnaire at this stage.
Thanks, Hannah