Thorverton Creamery - Security Questionnaire
Documentfinal Thorverton Creamery · security_questionnaire · final · 2026-09-11
Completed security questionnaire for Thorverton Creamery, dated 11 Sep 2026 and marked Final, answered by Theo Gallagher. It states TLS in transit, AES-256 at rest, a recovery point objective under one hour and that SOC 2 Type II is still being worked towards.
What it says
What this says
Current to 14 Oct 26Completed security questionnaire for Thorverton Creamery, dated 11 Sep 2026 and marked Final, answered by Theo Gallagher. It states TLS in transit, AES-256 at rest, a recovery point objective under one hour and that SOC 2 Type II is still being worked towards.
What it is: A vendor security questionnaire answered by BB-Demo for the customer, covering encryption, access, residency, backups, incident response, audit and third parties. It is a set of statements, not a signed contract.
Commits: Incident notice "within one business day of discovery", "Recovery time objective is under four hours for full restoration" and audit logs "retained for twelve months". It also states quarterly backup restoration tests.
Unusual: "We are working towards SOC 2 Type II certification." Evidence is offered on request only, which a regulated or cautious buyer may press on.
Not settled: It does not say which tier Thorverton Creamery holds, nor whether EU residency has been bought. It names Growth and Enterprise authentication routes without saying which applies.
As found in this document
Current to 9 Oct 26- Security incident notificationwithin one business day of discoverywithin one business day of discovery · Source: object_read:doc_183_001
- Recovery point objectiveunder one hourSource: object_read:doc_183_001
- Recovery time objectiveunder four hours for full restorationunder four hours for full restoration · Source: object_read:doc_183_001
- Backup restoration testsquarterlySource: object_read:doc_183_001
- Audit log retentiontwelve monthsSource: object_read:doc_183_001
- Admin action auditmonthlySource: object_read:doc_183_001
The document
Body
Thorverton Creamery - Security Questionnaire
Completed: 11 Sep 2026
Status: Final
Data Security and Encryption
| Question | Answer |
|---|---|
| How is customer data encrypted in transit? | All data in transit is encrypted using industry-standard TLS. |
| How is data encrypted at rest? | Customer data at rest in Snowflake is encrypted using AES-256. |
| What encryption key management is in place? | Encryption keys are managed by Snowflake's key management service. We do not hold customer encryption keys. |
Access Controls
| Question | Answer |
|---|---|
| How is user access controlled and authenticated? | User authentication is via your identity provider on Enterprise tier, or email verification on Growth. Role-based access control is enforced within the platform. |
| How are admin privileges managed? | Admin privileges are restricted to named individuals. We audit all admin actions monthly. |
| How is access revoked when a user leaves? | Access is revoked immediately upon user deprovisioning in your tenant. No manual step is required. |
Data Residency and Sovereignty
Read the whole document (3,373 characters)
| Question | Answer |
|---|---|
| Where is customer data stored? | By default, customer data is stored in the UK region on Snowflake. EU data residency is available as an add-on. |
| Can data be moved between regions? | Yes, data residency can be changed during the contract term. Migration is handled at renewal or upon request. |
Backups and Disaster Recovery
| Question | Answer |
|---|---|
| How frequently is data backed up? | Data is backed up continuously by Snowflake. |
| What is your recovery point objective? | Recovery point objective is under one hour. |
| What is your recovery time objective? | Recovery time objective is under four hours for full restoration. |
| Are backups tested regularly? | Yes, we conduct backup restoration tests quarterly. |
Incident Response
| Question | Answer |
|---|---|
| Is there a documented incident response plan? | Yes, we have a formal incident response plan with clear escalation paths and defined roles. |
| How are security incidents reported to customers? | We notify customers of any security incident affecting their data within one business day of discovery. |
Audit and Compliance
| Question | Answer |
|---|---|
| Are you SOC 2 Type II certified? | We are working towards SOC 2 Type II certification. Current controls are documented and evidence is available upon request. |
| Can you provide audit logs? | Yes, customer-facing audit logs are available for all user actions, system changes and data access. |
| How long are logs retained? | Audit logs are retained for twelve months. |
| Do you support external audit? | Yes, we support third-party security audits with prior written notice. |
Vendor and Third-Party Risk
| Question | Answer |
|---|---|
| What third parties have access to customer data? | Snowflake (infrastructure provider only) and your identity provider (for authentication). No other parties have access to customer data. |
| How do you manage third-party risk? | All third parties are required to complete our vendor security questionnaire. Snowflake's security is independently certified. |
Completed by Theo Gallagher, Solutions Engineer, BB-Demo
Thanks, Theo
Unusual terms
Current to 9 Oct 26- SOC 2 Type II not yet certified
- Third-party audit only with prior written notice