Calderbrook Housing Group - Security Questionnaire
Documentfinal Calderbrook Housing Group · security_questionnaire · final · 2024-07-14
Final security questionnaire completed by Hannah Lowe on 14 Jul 2024 for Calderbrook Housing Group's Growth tier. It is an answer document, not a contract: no price is stated and the order form governs. Nightly refresh is by 07:00 and no certification is claimed.
What it says
What this says
Current to 13 Oct 26Final security questionnaire completed by Hannah Lowe on 14 Jul 2024 for Calderbrook Housing Group's Growth tier. It is an answer document, not a contract: no price is stated and the order form governs. Nightly refresh is by 07:00 and no certification is claimed.
What it is: a written answer set to the security questions from Calderbrook's business-intelligence and IT teams, issued by Hannah Lowe on 14 Jul 2024. It says the brain is "built and run inside the customer's own Snowflake account".
Commits: the nightly refresh "completes by 07:00 customer local time on business days, on every tier". It also says the order form "governs over this questionnaire" for any change to connectors, exclusions or residency.
Unusual: nothing off standard terms. It states plainly that SSO and SCIM are not in Growth and that service credits on Growth "cover availability only", so freshness failures are not credited.
Not settled: the availability percentage and the P1 first-response time are left to the order form. Penetration-test evidence and sub-processors are deferred to written evidence, and no certification is claimed.
As found in this document
Current to 9 Oct 26- Nightly refreshcompletes by 07:00 customer local time on business days, on every tiercompletes by 07:00 customer local time on business days, on every tier · Source: object_read:doc_007_001
- Freshness service creditsNot on Growth. Service credits on Growth cover availability only.Not on Growth. Service credits on Growth cover availability only. · Source: object_read:doc_007_001
- Availabilitythe standard Growth availability commitment, set out in the order formthe standard Growth availability commitment, set out in the order form · Source: object_read:doc_007_001
- P1 first responsethe Growth first-response commitment for the highest priority tickets, as stated in the order formthe Growth first-response commitment for the highest priority tickets, as stated in the order form · Source: object_read:doc_007_001
The document
Body
Calderbrook Housing Group - Security Questionnaire
Status: Final Completed by: Hannah Lowe, Solutions Engineer, BB-Demo Date: 14 Jul 2024 Prepared for: Calderbrook Housing Group, Leeds Offering in scope: BB-Demo company brain, Growth tier BB-Demo account owner: Tom Ashdown BB-Demo customer success manager: Daniel Okafor
1. Purpose and how to read this document
This questionnaire sets out BB-Demo's written answers to the security questions raised by Calderbrook Housing Group's business-intelligence team and its IT colleagues. The scope is the Growth tier of the company brain, which would join tenant calls, repairs tickets, complaints and rent arrears data into one picture for the board.
To be precise, each answer describes how the service is built and operated. Where a control depends on the customer's own Snowflake account or on the signed order form, the answer says so. Where a feature belongs to a different tier, the answer says that too, rather than implying it is included.
2. Architecture and data location
Read the whole document (5,709 characters)
| # | Question | Answer |
|---|---|---|
| 2.1 | Where does the data live? | The brain is built and run inside the customer's own Snowflake account. Customer data is not copied into a BB-Demo-owned data store as part of the standard service. |
| 2.2 | Who controls the storage? | Calderbrook Housing Group, as owner of the Snowflake account. BB-Demo works within the permissions the customer grants. |
| 2.3 | Is data residency configurable? | Dedicated EU or US data residency is an add-on and is not part of the Growth tier. It is not requested in this questionnaire. |
| 2.4 | Which source systems connect to the brain? | Only the systems the customer chooses to connect, such as the CRM, the helpdesk, the call recorder, email and the accounting system. Each connector is agreed in the order form. |
| 2.5 | Can connectors be removed? | Yes. A connector can be disabled by the customer at any time, and the data it loaded stays under the customer's control in their account. |
3. Access control and identity
| # | Question | Answer |
|---|---|---|
| 3.1 | How are BB-Demo staff given access? | Access is granted by the customer within their Snowflake account, to named BB-Demo people, for implementation and support. The customer can review and revoke it. |
| 3.2 | Is single sign-on available? | SSO and SCIM are Enterprise tier features. They are not included in Growth. The short answer is no for this tier; the longer answer is that an upgrade would add them. |
| 3.3 | Is access role-based? | Yes. Users see what their role permits, and the customer's administrators manage roles. |
| 3.4 | How many administrators should the customer hold? | We recommend at least two, so that the loss of one person does not leave the brain without an owner. |
4. Data handling and privacy
| # | Question | Answer |
|---|---|---|
| 4.1 | What kinds of personal data may be processed? | Tenant-related records such as call content, repairs tickets, complaints and arrears information may contain personal data. The customer decides which sources to connect and which fields to include. |
| 4.2 | Who is the controller? | The customer is the controller. BB-Demo acts as processor under the data processing terms that sit alongside the MSA. |
| 4.3 | Can data be excluded? | Yes. Sources, folders, queues and fields can be excluded at connector design stage, and I will put the agreed exclusions in writing. |
| 4.4 | What happens to data at the end of the contract? | Because the brain runs in the customer's Snowflake account, the customer keeps the data. BB-Demo's access is removed and the connectors are switched off. |
5. Availability, freshness and support
| # | Question | Answer |
|---|---|---|
| 5.1 | What availability is committed? | The Growth tier carries the standard Growth availability commitment, set out in the order form. |
| 5.2 | How fresh is the data? | The nightly refresh completes by 07:00 customer local time on business days, on every tier. |
| 5.3 | Are freshness failures credited? | Not on Growth. Service credits on Growth cover availability only. Availability and freshness are different things: a brain can be available while answering on stale data. Freshness credits are an Enterprise feature. |
| 5.4 | What is the response to a serious incident? | Growth carries the Growth first-response commitment for the highest priority tickets, as stated in the order form. |
| 5.5 | Is Premium support included? | No. Premium support and the Sandbox are add-ons or Enterprise features. |
6. Assurance and certification
| # | Question | Answer |
|---|---|---|
| 6.1 | Does BB-Demo claim a specific certification in this response? | No certification is claimed in this document. Any evidence the customer relies on should be requested and supplied in writing as part of the contract documents. |
| 6.2 | Is penetration-test evidence available? | I will not answer that from memory. It will be confirmed in writing before signature. |
| 6.3 | Are sub-processors used? | Any sub-processors are listed in the data processing terms. The customer's own Snowflake account remains the place the data sits. |
7. Open points and next steps
- Items 6.2 and 6.3 are answered by reference to written evidence, which Hannah Lowe will supply on request.
- Any change to the connectors, exclusions or residency would be recorded in the order form, which governs over this questionnaire.
- Questions on commercial terms should go to Tom Ashdown. Questions on adoption after go-live go to Daniel Okafor.
8. Sign-off
Prepared and issued by Hannah Lowe, Solutions Engineer, BB-Demo, on 14 Jul 2024.
Thanks, Hannah