Ballyvourney Software - Security Questionnaire
Documentfinal Ballyvourney Software · security questionnaire · final · 2 Jun 2026
Completed security questionnaire for a Growth tier deployment, dated 2 Jun 2026. It states AES-256 at rest, TLS 1.2 minimum in transit, a one hour recovery time objective and ISO 27001 certification. It is not a contract.
What it says
What this says
As at Fri 9 Oct 2026Completed security questionnaire for a Growth tier deployment, dated 2 Jun 2026. It states AES-256 at rest, TLS 1.2 minimum in transit, a one hour recovery time objective and ISO 27001 certification. It is not a contract.
What it is: a BG-Demo answer sheet of eight controls, completed by Theo Gallagher's solutions engineering side on 2 Jun 2026, filed in the customer's Security folder. Stored status is final.
Commits: it states "Recovery time objective is one hour for complete restore" and that customers are notified of incidents "within 24 hours". Audit logs are "retained for 90 days minimum".
Unusual: nothing departs from standard terms, but the answers read as security statements, not contract clauses, so their binding force depends on how the order form incorporates them.
Not settled: the document does not name a customer signatory, a price, a renewal date or a service level for availability or support response. It does not say whether it is attached to an executed order form.
As found in this document
As at Fri 9 Oct 2026- Data at restCustomer data is encrypted at rest using AES-256.Source: the AI read of this record
- Data in transitTLS 1.2 minimum for all data in motion.Source: the AI read of this record
- Audit log retentionLogs are retained for 90 days minimumSource: the AI read of this record
- Incident escalationSecurity incidents are classified and escalated within one business hour.Source: the AI read of this record
- Incident notificationCustomers are notified of any incident affecting their data within 24 hours.Source: the AI read of this record
- Recovery time objectiveRecovery time objective is one hour for complete restore.Source: the AI read of this record
- Backup testingBackup procedures are tested quarterly.Source: the AI read of this record
Body
Ballyvourney Software - Security Questionnaire
Summary
This questionnaire records BG-Demo's security and data protection controls applicable to Growth tier deployment.
| # | Control | Question | Answer |
|---|---|---|---|
| 1 | Data Protection | How is data protected at rest? | Customer data is encrypted at rest using AES-256. Data is isolated per customer within your Snowflake account under your ownership. Role-based access control enforces separation. |
| 2 | Data Encryption | What encryption standard is used for data in transit? | TLS 1.2 minimum for all data in motion. API integrations use certificate-pinned HTTPS. |
| 3 | Access Control | How is access to customer data restricted? | Role-based access control at the Snowflake database level. Users authenticate through your identity provider. Administrative access requires multi-factor authentication. |
| 4 | Audit Trail | Do you maintain logs of data access and user actions? | Snowflake maintains audit logs of all queries, logins and administrative actions. Logs are retained for 90 days minimum and available to you for export and review. |
| 5 | Incident Response | What is your incident response process? | Security inci |
Read the whole document (2,064 characters)
dents are classified and escalated within one business hour. Customers are notified of any incident affecting their data within 24 hours. We provide a full incident report after investigation. | | 6 | Business Continuity | What is your recovery time commitment? | Recovery time objective is one hour for complete restore. Backups are maintained in geographically separate locations. Backup procedures are tested quarterly. | | 7 | Vendor Risk | How do you assess vendor security? | We conduct annual security assessments of material third parties. Assessments are documented and retained. | | 8 | Compliance | What compliance standards do you maintain? | ISO 27001 certified. Compliant with GDPR and UK GDPR. We support customers in regulated industries. |
This questionnaire was completed on 2 June 2026. For further information, contact your solutions engineer.