Pelton Grange Care - Security Questionnaire
Documentfinal Pelton Grange Care · security_questionnaire · final · 2025-06-19
Completed security questionnaire for Pelton Grange Care at Growth tier, answered by Anya Petrova on 19 Jun 2025. It states a 4 business hour incident notice and a recovery time objective under 1 hour. It states no availability %, P1 response time or price.
What it says
What this says
Current to 13 Oct 26Completed security questionnaire for Pelton Grange Care at Growth tier, answered by Anya Petrova on 19 Jun 2025. It states a 4 business hour incident notice and a recovery time objective under 1 hour. It states no availability %, P1 response time or price.
What it is: BB-Demo's answers to a customer security questionnaire, completed by Anya Petrova, Solutions Engineer, on 19 Jun 2025 for the Growth tier. It covers information security, data protection, operational security and audit.
Commits: "Customers are notified within 4 business hours of discovery of a security incident affecting their data." Critical security patches go out "within 48 hours", and the recovery time objective is "under 1 hour".
Unusual: the SOC 2 answer says BB-Demo "complies with SOC 2 principles", with audit reports under NDA. The certifications listed belong to Snowflake, not BB-Demo.
Not settled: it is a statement of practice, not an order form. It sets no availability %, P1 response time, service credit or price, and it was not re-dated after 19 Jun 2025.
As found in this document
Current to 9 Oct 26- Security incident notificationCustomers are notified within 4 business hours of discovery of a security incident affecting their dataCustomers are notified within 4 business hours of discovery of a security incident affecting their data · Source: object_read:doc_172_001
- Critical security patchescritical security patches within 48 hourscritical security patches within 48 hours · Source: object_read:doc_172_001
- Recovery time objectiveunder 1 hourSource: object_read:doc_172_001
- Encryption in transitTLS 1.2 or higherSource: object_read:doc_172_001
- Encryption at restAES-256Source: object_read:doc_172_001
- Activity log retentionLogs are retained for 12 months and available for auditLogs are retained for 12 months and available for audit · Source: object_read:doc_172_001
- Data on terminationdeleted or returned at the customer's request within 30 daysdeleted or returned at the customer's request within 30 days · Source: object_read:doc_172_001
- Audit notice30 days' notice and a signed NDASource: object_read:doc_172_001
The document
Body
Pelton Grange Care, Security Questionnaire
Completed by: Anya Petrova, Solutions Engineer, BB-Demo
Date: 19 June 2025
Tier: Growth
Information Security
| Question | BB-Demo Response |
|---|---|
| What is your SOC 2 certification status? | BB-Demo complies with SOC 2 principles for security, availability, and data confidentiality. Detailed audit reports are available under NDA upon request. |
| Do you encrypt data at rest? | Yes. All data stored in Snowflake is encrypted with AES-256. Encryption keys are managed by Snowflake's Key Management Service. |
| Do you encrypt data in transit? | Yes. All data transmission between customer systems and BB-Demo infrastructure uses TLS 1.2 or higher. |
| What is your incident response process? | We maintain a documented incident response plan covering detection, containment, eradication, and recovery. Customers are notified within 4 business hours of discovery of a security incident affecting their data. |
| How do you handle access control? | Role-based access control (RBAC) is enforced. User accounts are provisioned only with the minimum permissions required for their role. Multi-factor authent |
Read the whole document (4,251 characters)
ication is available for administrators. | | Do you conduct penetration testing? | Yes. BB-Demo commissions annual third-party penetration testing and remediates identified risks before release to production. |
Data Protection and Privacy
| Question | BB-Demo Response |
|---|---|
| Are you GDPR compliant? | Yes. BB-Demo acts as a data processor and has executed Data Processing Agreements (DPAs) with all customers. We comply with GDPR Articles 28–32 and maintain standard contractual clauses for international transfers. |
| Where is customer data stored? | Customer data is stored in Snowflake within the UK region by default. EU and US data residency options are available as an add-on. |
| What is your data retention policy? | Customer data is retained for the duration of the contract. Upon contract termination, data is deleted or returned at the customer's request within 30 days. |
| How do you handle data subject requests? | We respond to customer requests for data subject access, erasure, and portability within the timescales specified in the DPA. The customer is responsible for the end-user communication. |
Operational Security
| Question | BB-Demo Response |
|---|---|
| How do you manage software vulnerabilities? | All BB-Demo personnel receive security training. Dependency scanning is automated in our CI/CD pipeline. Production patches are deployed on a risk-assessed basis; critical security patches within 48 hours. |
| Do you log user activity? | Yes. All user actions (queries, exports, user management) are logged with timestamp, user ID, and action type. Logs are retained for 12 months and available for audit. |
| What is your disaster recovery plan? | Snowflake provides automatic backup and geo-redundant replication. In the event of a data centre failure, customer data remains available with no manual intervention required. Recovery time objective is under 1 hour. |
| How do you manage vendor access? | BB-Demo staff access customer data only for support and incident investigation, with full logging and customer notification. Sub-processor changes are communicated in advance with opt-out rights. |
Compliance and Audit
| Question | BB-Demo Response |
|---|---|
| Are you happy to undertake a security audit? | Yes. Customers may conduct security assessments, including third-party assessments. We ask for 30 days' notice and a signed NDA. Enterprise customers receive a tailored security assessment as part of onboarding. |
| Do you hold any compliance certifications? | BB-Demo's Snowflake environment is hosted by Snowflake, which holds SOC 2 Type II, ISO 27001, and FedRAMP (Moderate) certifications. |
Next Steps
Please confirm receipt of this questionnaire. If any answers require clarification or if you would like to discuss BB-Demo's security posture in greater detail, please contact your Solutions Engineer.
This questionnaire reflects BB-Demo's security practices as of 19 June 2025.
Unusual terms
Current to 9 Oct 26- Incident notice within 4 business hours
- Critical patches within 48 hours
- SOC 2 principles claimed, reports under NDA