Marlstone Legal - Security Questionnaire
Documentfinal Marlstone Legal · security questionnaire · final · 28 Jan 2025
A completed ten-question security questionnaire for Marlstone Legal, stored as final and dated 28 Jan 2025. It states that data stays in the customer's Snowflake account, with 24-hour breach notification and deletion of BG-Demo systems within 30 days of termination.
What it says
What this says
As at Fri 9 Oct 2026A completed ten-question security questionnaire for Marlstone Legal, stored as final and dated 28 Jan 2025. It states that data stays in the customer's Snowflake account, with 24-hour breach notification and deletion of BG-Demo systems within 30 days of termination.
What it is: a question-and-answer sheet filed under Customers/Marlstone Legal/Security, marked "Final", created and modified on 2025-01-28. Hannah Lowe, Solutions Engineer, is the resolved author on the BG-Demo side.
Commits: incident handling is a "Documented process with 24-hour notification to customers of confirmed breaches". At contract end, data is "Retained in customer's Snowflake account; BG-Demo systems deleted within 30 days of termination."
Unusual: nothing departs from the standard terms. Access control stays with the customer, with SSO and role-based controls enabled by BG-Demo.
Not settled: the sheet names no signatory, customer contact or tier. It states no price, availability figure, response time or renewal date, and it is not an order form, so it sets no contracted service levels.
As found in this document
As at Fri 9 Oct 2026- Security incident notification24-hour notification to customers of confirmed breachesSource: the AI read of this record
- Data at end of contractRetained in customer's Snowflake account; BG-Demo systems deleted within 30 days of terminationSource: the AI read of this record
- Encryption in transitTLS 1.2 and above for all connections to the brain and SnowflakeSource: the AI read of this record
- Disaster recovery testingYes, with quarterly testingSource: the AI read of this record
Body
Marlstone Legal - Security Questionnaire
Status: Final
| Question | Answer |
|---|---|
| What is the legal basis for processing personal data? | Contract, legitimate interest, and consent where required. |
| Do you use multi-factor authentication for user accounts? | Yes, via Microsoft 365 identity. |
| What is your data backup and recovery procedure? | Data held in customer's own Snowflake account; we provide technical support for backup configuration. |
| Is there a business continuity or disaster recovery plan in place? | Yes, with quarterly testing. Snowflake provides availability within service levels. |
| What is the encryption standard for data in transit? | TLS 1.2 and above for all connections to the brain and Snowflake. |
| How do you handle security incidents? | Documented process with 24-hour notification to customers of confirmed breaches. |
| Are staff trained in data security and privacy? | Annual training required; compliance tracked via Microsoft 365. |
| Who is responsible for access control? | Customer retains all access control; we enable SSO and role-based controls. |
| How is the audit trail maintained? | Snowflake audit logs retained by customer; quer |
Read the whole document (1,387 characters)
y history available in the brain. | | What happens to data at the end of the contract? | Retained in customer's Snowflake account; BG-Demo systems deleted within 30 days of termination. |