Quarrington Care Network - Security Questionnaire
Documentfinal Quarrington Care Network · security questionnaire · final · 11 Feb 2026
Final security and privacy answers from BG-Demo to prospect Quarrington Care Network, dated 11 Feb 2026, for a Growth subscription under a business associate agreement. It is not a contract and states no price, availability percentage or P1 time.
What it says
What this says
As at Fri 9 Oct 2026Final security and privacy answers from BG-Demo to prospect Quarrington Care Network, dated 11 Feb 2026, for a Growth subscription under a business associate agreement. It is not a contract and states no price, availability percentage or P1 time.
What it is: a security questionnaire prepared by Hannah Lowe for a HIPAA-regulated prospect. It states "there is no contracted annual recurring revenue for this account, because Quarrington is still a prospect."
Commits: the document says "The business associate agreement is signed before any connector is switched on." It also says BG-Demo staff see data only "through access that Quarrington grants inside its own account."
Unusual: it makes no HIPAA certification claim. Single sign-on, Premium support, the Sandbox and data residency are named as not included in Growth.
Not settled: the region requirement is left to be confirmed in the order form. Availability and P1 response are referred to the standard Growth service levels, with no figures given. The evidence does not show whether an order form was signed.
As found in this document
As at Fri 9 Oct 2026- Business associate agreementThe business associate agreement is signed before any connector is switched on.Source: the AI read of this record
- Service credits on GrowthOn Growth, credits apply for availability only, not for data freshness.Source: the AI read of this record
- Nightly refreshThe nightly refresh completes by early morning customer local time on business days, on every tier.Source: the AI read of this record
- Security incident notificationBG-Demo will notify the customer contact named in the order form, and the business associate agreement sets the notification obligations.Source: the AI read of this record
The document
Body
Quarrington Care Network - Security Questionnaire
Status: Final Prepared by: Hannah Lowe, Solutions Engineer, BG-Demo Date: 11 Feb 2026 Customer: Quarrington Care Network, Chicago Account owner: Jordan Pike Customer success manager: Hollie Grieve Tier in scope: Growth
Purpose and scope
This document answers the security and privacy questions raised by Quarrington Care Network ahead of its Growth subscription. Quarrington is a home-health and hospice operator across Illinois, Indiana and Wisconsin and is subject to HIPAA. The subscription is to be held under a business associate agreement, so the referral-relations and patient-services teams can see each referring hospital's calls, tickets and contracts together.
To be precise about scope: the answers below describe B-Glass as BG-Demo delivers it on the Growth tier. Where a control belongs to a different tier or to a paid add-on, the answer says so rather than implying it is included.
At the date of this document there is no contracted annual recurring revenue for this account, because Quarrington is still a prospect.
Architecture and data location
Read the whole document (5,811 characters)
| Question | Answer |
|---|---|
| Where does the customer's data live? | B-Glass is built and run inside the customer's own Snowflake account. Source data is not copied into a BG-Demo-owned data store. |
| Who controls the Snowflake account? | Quarrington. Access to the account, its roles and its network settings remain with Quarrington's own administrators. |
| Can data be held in a specific region? | Dedicated EU or US data residency is available as an add-on. Quarrington operates in the US, and its region requirement should be confirmed in the order form. |
| How does data reach the brain? | Through connectors to the systems Quarrington chooses, for example Salesforce, Zendesk, Gong, Microsoft 365 or SharePoint. The Growth connector allowance applies, and a connector promised in an order form carries a live-within-days commitment. |
| Is there a separate test environment? | The Sandbox is an add-on and is not part of the Growth tier. It can be added if Quarrington wants one. |
Access control
| Question | Answer |
|---|---|
| How do users sign in? | Growth uses standard account sign-in. Single sign-on and SCIM provisioning are Enterprise features and are not included in Growth. |
| Can access be limited by team? | Yes, in the sense that the brain reads through the customer's Snowflake roles. What a person sees depends on how Quarrington's administrators configure those roles. |
| Who at BG-Demo can see customer data? | Only staff working on the implementation or on a support request, and only through access that Quarrington grants inside its own account. Quarrington can revoke that access at any time. |
| Is there a named support engineer? | Not on Growth. Premium support, with a named engineer, is an add-on. |
Healthcare data and HIPAA
| Question | Answer |
|---|---|
| Will BG-Demo sign a business associate agreement? | Yes. The Growth subscription is being bought on the basis of a business associate agreement, and that agreement sits alongside the order form under the master agreement. |
| Does the brain need patient-identifiable records? | The use case described is referral relations and patient services: calls, tickets and contracts per referring hospital. The connectors in scope should be agreed so that only the sources needed for that use case are connected. |
| Can sources be excluded? | Yes. Quarrington chooses which systems and which parts of them are connected, and a connector can be removed by the customer's administrators. |
| Does BG-Demo make a HIPAA compliance claim for its software? | No. HIPAA obligations are met through the business associate agreement, the architecture above and Quarrington's own configuration. This document makes no certification claim. |
Availability and support
| Question | Answer |
|---|---|
| What availability applies? | The Growth tier availability commitment in the standard service levels. An executed order form can change it. |
| How quickly is a priority issue answered? | The Growth first-response commitment for a P1 issue, measured in business hours. |
| How fresh is the data? | The nightly refresh completes by early morning customer local time on business days, on every tier. |
| What are the service credits? | On Growth, credits apply for availability only, not for data freshness. Credits for freshness belong to Enterprise. |
Change, incident and exit
| Question | Answer |
|---|---|
| How is Quarrington told about a security incident? | BG-Demo will notify the customer contact named in the order form, and the business associate agreement sets the notification obligations. |
| What happens at the end of the term? | Because the brain lives in Quarrington's own Snowflake account, the data stays with Quarrington. Connector access granted to BG-Demo is withdrawn. |
| Is there a review cycle? | Growth includes quarterly business reviews led by the customer success manager, and those are a natural place to revisit these answers. |
Points confirmed in writing
I'll put the following in writing, as they are the points a security team usually wants fixed before signature:
- Single sign-on is not part of Growth. If Quarrington's IT team requires it, the Enterprise tier is the route.
- Data residency is an add-on and must appear in the order form if it is required.
- Premium support and the Sandbox are add-ons, not Growth inclusions.
- The business associate agreement is signed before any connector is switched on.
Sign-off
| Role | Name |
|---|---|
| Prepared by | Hannah Lowe, Solutions Engineer, BG-Demo |
| Commercial owner | Jordan Pike |
| Customer success | Hollie Grieve |
| Date | 11 Feb 2026 |
Unusual terms
As at Fri 9 Oct 2026- Business associate agreement before connectors
- No HIPAA certification claim
- SSO and SCIM not in Growth