Quillmark Health - Security Questionnaire
Documentfinal Quillmark Health · security_questionnaire · final · 2026-02-25
Final security questionnaire dated 25 Feb 2026, prepared by Hannah Lowe for Quillmark Health's Enterprise evaluation. It is not a contract and states no price, availability percentage or P1 response time; four follow-ups remain open.
What it says
What this says
Current to 13 Oct 26Final security questionnaire dated 25 Feb 2026, prepared by Hannah Lowe for Quillmark Health's Enterprise evaluation. It is not a contract and states no price, availability percentage or P1 response time; four follow-ups remain open.
What it is: BB-Demo's written answers to the security review for a HIPAA-regulated prospect evaluating Enterprise. It is marked final and says it "is not a contract and does not change any term of an order form".
Commits: Answers are product facts. SSO and SCIM are included in Enterprise, and US data residency is an add-on that follows the region of the customer's Snowflake account. Security review support is included in the Enterprise implementation.
Unusual: HIPAA business associate status is left as "a contractual matter". Premium support hours are UK-based, so US-hours coverage needs agreeing before signature.
Not settled: BB-Demo staff access, model use on customer data, business associate terms and US-hours support are all open follow-ups. No figures for availability, response times or price are stated, and the order form governs where terms differ.
As found in this document
The document
Body
Quillmark Health - Security Questionnaire
Status: Final Prepared by: Hannah Lowe, Solutions Engineer, BB-Demo Commercial owner: Jordan Pike Date: 25 Feb 2026 Tier evaluated: Enterprise Prospect: Quillmark Health, Boston, a revenue-cycle management services firm for hospital groups
Purpose and scope
This document records BB-Demo's written answers to the security review for Quillmark Health. Quillmark Health is evaluating the Enterprise tier so that client-services teams can see one view of each hospital client. Quillmark Health is subject to HIPAA, so the answers below are written with regulated health data in mind.
To be precise about how we have written it: where a control is part of the product as sold, we say so. Where an answer depends on contract terms, on the customer's own Snowflake configuration or on a point we need to confirm with our security lead, we say that instead of giving a firm commitment. We will put any follow-up in writing.
How to read the answers
Read the whole document (6,041 characters)
| Status | Meaning |
|---|---|
| Answered | Stated as a fact about the product or our delivery model |
| Depends on configuration | The control sits with the customer's own Snowflake account or identity provider |
| Contractual | To be set out in the order form or the agreement, not asserted here |
| Follow-up | We will confirm in writing after checking internally |
Architecture and data location
| Question | Answer | Status |
|---|---|---|
| Where does the company brain run? | Inside the customer's own Snowflake account. BB-Demo builds and operates it there rather than copying data into a separate BB-Demo data store. | Answered |
| Which source systems can be connected? | Systems such as Salesforce, HubSpot, Zendesk, Xero, Gong, Microsoft 365, Google Workspace, Dropbox, SharePoint and Slack, through connectors. The Enterprise tier carries the highest connector allowance. | Answered |
| Can data residency be fixed to the United States? | Dedicated US data residency is an available add-on. Because the brain runs in the customer's Snowflake account, the region follows the region of that account. | Answered |
| Is there a non-production environment? | A Sandbox is available on Enterprise as an add-on from the second price book version. | Answered |
Access control and identity
| Question | Answer | Status |
|---|---|---|
| Is single sign-on supported? | Yes. SSO and SCIM provisioning are included in the Enterprise tier. | Answered |
| How are users removed when they leave? | Through SCIM from the customer's identity provider, so that leavers are deprovisioned from the customer's directory. | Depends on configuration |
| Who at BB-Demo can reach customer data? | Access is limited to the people delivering and supporting the account. We will describe the access model in writing for Quillmark Health's review. | Follow-up |
| Is role-based access available inside the brain? | Access follows what the customer connects and permits in its own Snowflake account and identity provider. | Depends on configuration |
Handling of regulated data
| Question | Answer | Status |
|---|---|---|
| Can BB-Demo process data subject to HIPAA? | We understand Quillmark Health is subject to HIPAA. Whether and how BB-Demo would act as a business associate is a contractual matter and is not asserted in this questionnaire. | Contractual |
| Should protected health information be connected at all? | The short answer is that it is the customer's decision which sources and fields are connected. The longer answer is that we would agree the permitted sources and any exclusions during design, before any connector goes live. | Depends on configuration |
| Is customer data used to train models for other customers? | Each brain is built and run inside the customer's own account. We will confirm the exact wording on model use in writing so that it matches the agreement. | Follow-up |
Security review support
Security review support is included in the Enterprise implementation. In practice this means the following:
- A named solutions engineer answers the questionnaire and any follow-up questions.
- An architecture walk-through is available for Quillmark Health's IT and compliance teams.
- Written confirmation is given for any answer that was provided verbally.
Service levels relevant to the review
The Enterprise tier carries the higher availability commitment and the fastest first response for priority-one incidents among our tiers. Service credits on Enterprise cover both availability and data freshness. The nightly refresh is designed to complete before the start of the customer's business day on business days. An executed order form can change any of these terms, and the order form governs where it differs from this document.
Availability is not the same as freshness. A brain can be available while answering on stale data, which is why Enterprise is the only tier credited for freshness.
Support model
| Question | Answer | Status |
|---|---|---|
| Is a named support engineer available? | Premium support, with a named engineer during extended UK hours, is an Enterprise add-on from the second price book version. | Answered |
| Is US-hours coverage included? | Premium support hours are UK-based. Coverage for US working hours would need to be discussed and agreed before signature. | Follow-up |
Open points and follow-up
- Written description of BB-Demo staff access to customer environments, from Hannah Lowe.
- Written confirmation on model use and customer data, after review with our security lead.
- Position on business associate terms, to be raised by Jordan Pike as part of any commercial discussion.
- Confirmation of support coverage for US working hours.
Sign-off
This questionnaire is final as issued on 25 Feb 2026. It reflects the product and delivery model as described to Quillmark Health at that date. It is not a contract and does not change any term of an order form.
Thanks, Hannah
Hannah Lowe Solutions Engineer, BB-Demo
Unusual terms
Current to 9 Oct 26- HIPAA business associate position left to contract
- Premium support hours UK-based, US coverage to be agreed
- Model use wording to be confirmed in writing