Cawthorne Learning - Security Questionnaire
Documentfinal Cawthorne Learning · security_questionnaire · final · 2026-08-26
Security answers prepared by Hannah Lowe on 26 Aug 2026 for Cawthorne Learning's Growth evaluation. Commits to first P1 response within one business hour and a 07:00 nightly refresh. Availability is as stated in the order form; no price is given.
What it says
What this says
Current to 13 Oct 26Security answers prepared by Hannah Lowe on 26 Aug 2026 for Cawthorne Learning's Growth evaluation. Commits to first P1 response within one business hour and a 07:00 nightly refresh. Availability is as stated in the order form; no price is given.
What it is: a final set of security answers written by Hannah Lowe for Cawthorne Learning while it evaluates the Growth tier. It is a pre-contract information document, not an order form.
Commits: "First response within one business hour on the Growth tier." The nightly refresh completes by 07:00 customer local time on business days, on every tier.
Unusual: nothing off the standard terms. It states plainly that Growth credits cover availability only and that SSO and SCIM sit in Enterprise.
Not settled: certifications, staff vetting and sub-processors are all marked as not answered. The availability figure is deferred to the order form, and no price or dates for a contract appear.
As found in this document
Current to 9 Oct 26- AvailabilityThe Growth availability service level, as stated in the order form.The Growth availability service level, as stated in the order form. · Source: object_read:doc_165_001
- P1 first responseFirst response within one business hour on the Growth tier.First response within one business hour on the Growth tier. · Source: object_read:doc_165_001
- Nightly refreshThe nightly refresh completes by 07:00 customer local time on business days, on every tier.The nightly refresh completes by 07:00 customer local time on business days, on every tier. · Source: object_read:doc_165_001
- Service creditsOn Growth, service credits apply to availability only. Data freshness is credited on Enterprise, not on Growth.On Growth, service credits apply to availability only. Data freshness is credited on Enterprise, not on Growth. · Source: object_read:doc_165_001
The document
Body
Cawthorne Learning - Security Questionnaire
Status: Final Prepared by: Hannah Lowe, Solutions Engineer, BB-Demo Date: 26 Aug 2026 Account owner: Harvey Doyle Tier under evaluation: Growth
Purpose
This document answers the security questions raised by Cawthorne Learning while it evaluates the Growth tier, so that customer success can see each provider's tickets, usage and renewals together. Answers are limited to what BB-Demo can state accurately today. Where an answer needs confirmation from a colleague who owns security, it is marked as open and will be put in writing separately.
Hosting and data location
Read the whole document (3,229 characters)
| Question | Answer |
|---|---|
| Where does the brain run? | To be precise, BB-Demo builds and runs the brain inside the customer's own Snowflake account. Cawthorne Learning's data is not copied into a separate BB-Demo data store. |
| Who controls the underlying data platform? | The customer, through its own Snowflake account and the controls it already applies there. |
| Can data be kept in a specific region? | Dedicated EU or US data residency is available as an add-on. The standard arrangement follows the region of the customer's Snowflake account. |
Connected systems
| Question | Answer |
|---|---|
| Which systems does the brain read from? | Only the systems the customer chooses to connect, for example the CRM, the helpdesk, Microsoft 365 or Google Workspace. Each connector is agreed in the order form. |
| Does the brain write back to source systems? | The short answer is no for the Growth scope described in the proposal. The longer answer is that any change to that would be agreed in writing first. |
Access and identity
| Question | Answer |
|---|---|
| How do users sign in? | Access follows the customer's own arrangements. Single sign-on and SCIM provisioning are part of the Enterprise tier and are not included in Growth. |
| Is there an administrator role? | Yes. The customer nominates its administrators, and we recommend at least two so that a departure does not leave the brain without an owner. |
Availability and support
| Question | Answer |
|---|---|
| What availability is committed? | The Growth availability service level, as stated in the order form. |
| What response is committed for a priority one issue? | First response within one business hour on the Growth tier. |
| When is data refreshed? | The nightly refresh completes by 07:00 customer local time on business days, on every tier. |
| What service credits apply? | On Growth, service credits apply to availability only. Data freshness is credited on Enterprise, not on Growth. |
Open items
| Topic | Position |
|---|---|
| Independent certifications and test reports | Not answered here. I will confirm the current position with a colleague who owns security and put it in writing. |
| Staff vetting and internal access controls | Not answered here. Same route: confirmed in writing before any reliance is placed on it. |
| Sub-processors and incident notification | Not answered here. To be covered in the data processing agreement if Cawthorne Learning proceeds. |
Sign-off
Thanks, Hannah
Hannah Lowe, Solutions Engineer, BB-Demo. Finalised 26 Aug 2026.