Ardcarne Life Assurance - Security Questionnaire
Documentfinal Ardcarne Life Assurance · security_questionnaire · final · 2026-02-27
A final security questionnaire completed by Theo Gallagher on 27 Feb 2026 for an Enterprise brain at Ardcarne Life Assurance. It states no figures for availability, P1 response or price, and leaves incident timings and platform controls as open points before signature.
What it says
What this says
Current to 13 Oct 26A final security questionnaire completed by Theo Gallagher on 27 Feb 2026 for an Enterprise brain at Ardcarne Life Assurance. It states no figures for availability, P1 response or price, and leaves incident timings and platform controls as open points before signature.
What it is: a BB-Demo answer sheet to Ardcarne's security and resilience questions, covering architecture, access, service levels and exit. Ardcarne is described as "an Irish life and pensions insurer supervised by the Central Bank of Ireland and subject to DORA".
Commits: little in numbers. Service levels are referred to as "the Enterprise availability level" and "the Enterprise first response commitment", with the figures left to the order form. Credits cover availability and data freshness.
Unusual: incident notification timings are "a dated commitment that we will put in writing before signature". Exit support "is not assumed to be included".
Not settled: the open points table needs owners before the contract is signed. It is not an order form, and connectors, the residency add-on, Sandbox and Premium support are only agreed once they appear there.
As found in this document
Current to 9 Oct 26- AvailabilityThe Enterprise availability level, which is the highest we offer, and higher than Starter and Growth.The Enterprise availability level, which is the highest we offer, and higher than Starter and Growth. · Source: object_read:doc_008_001
- Critical incident first responseThe Enterprise first response commitment, the fastest of the three tiers, measured in business time.The Enterprise first response commitment, the fastest of the three tiers, measured in business time. · Source: object_read:doc_008_001
- Data freshnessThe nightly refresh is complete by the start of the business day in the customer's local time on business days.The nightly refresh is complete by the start of the business day in the customer's local time on business days. · Source: object_read:doc_008_001
- Service creditsEnterprise service credits cover availability and data freshness. Starter and Growth credits cover availability only.Enterprise service credits cover availability and data freshness. Starter and Growth credits cover availability only. · Source: object_read:doc_008_001
- Incident notification timingsa dated commitment that we will put in writing before signaturea dated commitment that we will put in writing before signature · Source: object_read:doc_008_001
The document
Body
Ardcarne Life Assurance - Security Questionnaire
Status: Final Version: one Completed by: Theo Gallagher, Solutions Engineer, BB-Demo Completed on: 27 Feb 2026 Account owner: Matteo Ricci Customer success manager: Elena Novak Tier assessed: Enterprise
Purpose and scope
This questionnaire answers the security and operational resilience questions raised by Ardcarne Life Assurance, an Irish life and pensions insurer supervised by the Central Bank of Ireland and subject to DORA. It covers the company brain as it would be delivered under the Enterprise tier, built and run inside Ardcarne's own Snowflake account.
Answers follow the order of the questions. Each answer says what is in place, and the evidence column says what we can evidence and how. Where a control belongs to the platform team, or depends on a choice Ardcarne makes in its own Snowflake account, the answer says so rather than speaking for it.
How to read the answers
Read the whole document (6,427 characters)
- In place means the control exists today and we can evidence that.
- Customer-configured means the control sits in Ardcarne's Snowflake account or source systems and is set by Ardcarne's own administrators.
- Agreed in the order form means the commitment is written into the executed order form and not before.
A. Architecture and data location
| Ref | Question | Answer | Evidence |
|---|---|---|---|
| ARCH-A | Where is customer data stored and processed? | The brain is built and run inside the customer's own Snowflake account. BB-Demo does not hold a separate copy of the customer's data in a BB-Demo environment. | Architecture description supplied with this questionnaire. |
| ARCH-B | Can data residency be fixed to the EU? | Yes. Dedicated EU data residency is an available add-on, and the customer's Snowflake account location also determines where the data sits. | Add-on description; Ardcarne's own Snowflake account settings. |
| ARCH-C | Which source systems can be connected? | CRM, call recorder, email, helpdesk, finance and HR sources. Named systems include Salesforce, HubSpot, Zendesk, Xero, Gong, Google Workspace, Dropbox, SharePoint and Slack. Each connector is agreed in the order form. | Connector list in the order form, once agreed. |
| ARCH-D | Is there a non-production environment for testing changes? | The Sandbox is part of the Enterprise tier with Premium support. Use of it is agreed in the order form. | Order form line, once agreed. |
B. Access control
| Ref | Question | Answer | Evidence |
|---|---|---|---|
| ACC-A | Is single sign-on supported? | Yes. SSO is included in the Enterprise tier. | Tier description. |
| ACC-B | Is automated user provisioning supported? | Yes. SCIM is included in the Enterprise tier. | Tier description. |
| ACC-C | Who administers users and roles? | Ardcarne's administrators, using its own identity provider and Snowflake roles. BB-Demo staff access is limited to what delivery and support need. | Role model discussed in the security review; evidence pack on request. |
| ACC-D | Is access reviewed? | Customer-configured. We recommend a regular review by Ardcarne's administrators and we can walk them through the access list. | Walkthrough on request. |
C. Service levels and resilience
These answers matter most for DORA, and for the July outage that ran through the security review.
| Ref | Question | Answer | Evidence |
|---|---|---|---|
| RES-A | What availability is committed? | The Enterprise availability level, which is the highest we offer, and higher than Starter and Growth. | Service levels in the order form. |
| RES-B | How fast do you respond to a critical incident? | The Enterprise first response commitment, the fastest of the three tiers, measured in business time. | Service levels in the order form. |
| RES-C | How fresh is the data? | The nightly refresh is complete by the start of the business day in the customer's local time on business days. | Service levels in the order form. |
| RES-D | What happens if you miss these levels? | Enterprise service credits cover availability and data freshness. Starter and Growth credits cover availability only. Availability and freshness are separate measures: a brain can be available and still answering on stale data. | Service credit terms in the order form. |
| RES-E | Is there named support? | Premium support gives a named engineer within extended UK hours. It is an Enterprise option and is agreed in the order form. | Order form line, once agreed. |
D. Incident management and exit
| Ref | Question | Answer | Evidence |
|---|---|---|---|
| INC-A | How will Ardcarne be told about an incident? | Through the support channel agreed at onboarding, with a named contact on each side. The exact notification timings are a dated commitment that we will put in writing before signature, not a statement made here. | Written commitment before signature. |
| INC-B | Is there a post-incident report? | Yes. Reports set out timeline, impact, cause and actions. We can share the format ahead of time. | Sample report format on request. |
| EXIT-A | What is the exit plan? | Because the brain runs inside Ardcarne's own Snowflake account, the data remains in Ardcarne's control at exit. BB-Demo's retained access is removed on termination. | Exit steps to be confirmed in the contract. |
| EXIT-B | Is exit support available? | Handover support can be scoped with the account team. It is not assumed to be included. | Scope to be agreed with the account owner. |
E. Open points and owners
The questionnaire is final as a statement of what we can answer today. These points need a named owner before the contract is signed.
| Item | What is needed | Owner |
|---|---|---|
| Incident notification timings | A dated written commitment | Theo Gallagher |
| Platform-level controls in the evidence pack | Confirmation from the platform team, which we will ask Ewan for before anything is sent | Theo Gallagher |
| Connector list and residency add-on | Agreed lines in the order form | Matteo Ricci |
| Onboarding contacts and review cadence | Named people on both sides | Elena Novak |
F. Sign-off
| Role | Name | Title | Date |
|---|---|---|---|
| Completed by | Theo Gallagher | Solutions Engineer, BB-Demo | 27 Feb 2026 |
| Commercial owner | Matteo Ricci | Account owner, BB-Demo | 27 Feb 2026 |
| Customer success | Elena Novak | CSM, BB-Demo | 27 Feb 2026 |
Unusual terms
Current to 9 Oct 26- Incident notification timings promised in writing before signature
- Exit support not assumed to be included
- Sandbox and Premium support only if agreed in the order form