Etowah Lane Equipment Rental - Security Questionnaire
Documentfinal Etowah Lane Equipment Rental · security_questionnaire · final · 2026-05-22
Final security questionnaire completed by Theo Gallagher on 22 May 2026 for the Enterprise evaluation. It states a 30 minute P1 first response and Enterprise credits for availability and freshness. It states no price and is not a contract.
What it says
What this says
Current to 13 Oct 26Final security questionnaire completed by Theo Gallagher on 22 May 2026 for the Enterprise evaluation. It states a 30 minute P1 first response and Enterprise credits for availability and freshness. It states no price and is not a contract.
What it is: a security review answer sheet, dated 22 May 2026, written by Theo Gallagher with Jordan Pike as commercial owner. It covers architecture, identity, availability and security review support for the Enterprise tier.
Commits: it states "first response to a P1 is thirty minutes" and that Enterprise carries "service credits for both availability and data freshness". The availability figure is left to the order form.
Unusual: Premium support is in UK hours, so US working hours are flagged as a gap. US data residency is an add-on, and the Sandbox is named only as a contract item.
Not settled: the document says "Nothing here replaces the order form". Four open points remain: Snowflake region, source systems in scope, support hours and identity provider. No price, term or signature from the customer appears.
As found in this document
Current to 9 Oct 26- P1 first response (Enterprise)first response to a P1 is thirty minutesfirst response to a P1 is thirty minutes · Source: object_read:doc_153_001
- Service credits (Enterprise)Enterprise carries service credits for both availability and data freshnessEnterprise carries service credits for both availability and data freshness · Source: object_read:doc_153_001
- Nightly refreshThe nightly refresh completes before the start of the customer's business day, local time, on business daysThe nightly refresh completes before the start of the customer's business day, local time, on business days · Source: object_read:doc_153_001
- AvailabilityThe Enterprise availability level applies; the precise figure would be restated in the order formThe Enterprise availability level applies; the precise figure would be restated in the order form · Source: object_read:doc_153_001
The document
Body
Etowah Lane Equipment Rental - Security Questionnaire
Status: Final, version one Completed by: Theo Gallagher, Solutions Engineer, BB-Demo Account owner: Jordan Pike, BB-Demo Date: 22 May 2026 Tier under evaluation: Enterprise
Purpose and scope
This questionnaire answers the security review questions raised by Etowah Lane Equipment Rental, Atlanta, as part of its evaluation of the BB-Demo company brain on the Enterprise tier. The intended use is a single view of each contractor account for branch, national-accounts and credit teams across the US South-East.
The answers below describe how BB-Demo is delivered and what we can evidence today. Where a control depends on a decision the customer makes in its own environment, the answer says so. Where something is not yet contracted, the answer says that too. Nothing here replaces the order form, which would decide contracted terms if the evaluation proceeds.
How to read the answers
Read the whole document (5,764 characters)
- Answered means BB-Demo can state the position and, where marked, evidence it.
- Customer-side means the control sits in the customer's own Snowflake account or identity systems.
- Contract means the position is set by the order form and would be confirmed there.
Architecture and data location
| Control reference | Question | Response | Status |
|---|---|---|---|
| ARCH-A | Where does the customer's data reside? | The company brain is built and run inside the customer's own Snowflake account. BB-Demo does not copy customer data into a separate BB-Demo data store as part of the standard design. | Answered |
| ARCH-B | Which source systems are connected? | Only the systems the customer chooses to connect, for example the CRM, the helpdesk, the call recorder, email and the accounting system. The Enterprise tier includes the higher connector allowance. The exact list would be agreed during implementation. | Answered |
| ARCH-C | Can data be held in a specific region? | Dedicated US data residency is available as an add-on. Because the brain runs in the customer's Snowflake account, the region is chosen by where that account is hosted. | Contract |
| ARCH-D | Is there a separate test environment? | The Sandbox is part of the Enterprise tier from the second price book version, and would be named in the order form. | Contract |
Access control and identity
| Control reference | Question | Response | Status |
|---|---|---|---|
| IAM-A | Is single sign-on supported? | Yes. SSO and SCIM provisioning are included in the Enterprise tier. | Answered |
| IAM-B | How are leavers removed? | With SCIM in place, deprovisioning follows the customer's identity provider. The joiner and leaver process itself is customer-side. | Customer-side |
| IAM-C | Who at BB-Demo can access the customer's environment? | Access for BB-Demo staff is limited to what implementation and support require. We can evidence the named roles once the customer's Snowflake account and the scope of work are agreed. We will not state a head count before then. | Answered |
| IAM-D | Can the customer restrict what the brain can see? | Yes. The customer decides which connectors are enabled and which data those connectors expose. Row-level and role-level restrictions inside Snowflake are the customer's to define. | Customer-side |
Availability, support and freshness
| Control reference | Question | Response | Status |
|---|---|---|---|
| SVC-A | What availability level applies? | The Enterprise availability level applies, which is the higher of our two availability levels. The precise figure would be restated in the order form. | Contract |
| SVC-B | What is the response time for a critical incident? | For Enterprise, first response to a P1 is thirty minutes. | Answered |
| SVC-C | Is there named support? | Premium support, with a named engineer and extended UK hours, is an add-on and from the second price book version is part of Enterprise. The hours are UK hours, so US working hours would need to be discussed. | Contract |
| SVC-D | How fresh is the data? | The nightly refresh completes before the start of the customer's business day, local time, on business days. Enterprise carries service credits for both availability and data freshness. | Answered |
Security review support
| Control reference | Question | Response | Status |
|---|---|---|---|
| REV-A | Is security review support included? | Yes. Enterprise implementation includes security review support, and the fixed implementation fee covers it. | Answered |
| REV-B | Can controls be evidenced? | We can evidence each control stated as Answered on request, with the control reference above. Items marked Contract or Customer-side are evidenced through the order form or the customer's own configuration. | Answered |
| REV-C | Is there an exit plan? | Because the data sits in the customer's own Snowflake account, the customer retains it if the subscription ends. The detailed exit steps, including removal of connectors and access, would be written into the implementation plan. | Contract |
Open points for the next conversation
- Confirm the Snowflake region and whether US data residency is required as an add-on.
- Confirm which source systems are in scope for the first phase.
- Agree the support hours the customer expects against the UK hours of Premium support.
- Confirm the customer's identity provider so that SSO and SCIM can be scoped.
None of these changes the answers above. They are items to settle before an order form is drafted.
Sign-off
| Role | Name | Title | Date |
|---|---|---|---|
| Completed by | Theo Gallagher | Solutions Engineer, BB-Demo | 22 May 2026 |
| Commercial owner | Jordan Pike | Account Owner, BB-Demo | 22 May 2026 |
Thanks, Theo
Unusual terms
Current to 9 Oct 26- Premium support in UK hours only
- US data residency as an add-on
- Sandbox subject to order form