Etowah Lane Equipment Rental - Security Questionnaire v1
Documentdraft Etowah Lane Equipment Rental · security questionnaire · draft · 30 Jun 2026
Draft security questionnaire prepared by BG-Demo on 30 Jun 2026 for the Etowah Lane review of the Enterprise tier. Most answers are marked open with no evidence attached. It states no price, availability figure or response time.
What this says
As at Fri 9 Oct 2026Draft security questionnaire prepared by BG-Demo on 30 Jun 2026 for the Etowah Lane review of the Enterprise tier. Most answers are marked open with no evidence attached. It states no price, availability figure or response time.
What it is: a draft response to questions raised by Ravi Subramanian, the prospect's Chief Information Security Officer. Theo Gallagher prepared the answers and Jordan Pike is the commercial owner. The text states "Draft. Not a final response."
Commits: very little. Dedicated US data residency is named as an add-on, and the Enterprise tier is said to include single sign-on and SCIM. Figures for availability and first response are deferred: "The figure will be quoted from the order form, not from this draft."
Unusual: no certification or assurance claim is made, and the incident history is deliberately left unstated. At least two named administrators are recommended.
Not settled: model training, standing access, permission handling, notification wording, exit plan, deletion evidence and penetration testing are all open. The connector list has not been agreed, and Sandbox inclusion depends on the order form.
The document
Body
Etowah Lane Equipment Rental - Security Questionnaire v1
Status: Draft. Prepared by BG-Demo on 30 Jun 2026 for the Etowah Lane information security review of the Enterprise tier.
| Prospect | Etowah Lane Equipment Rental, Atlanta |
| Questions raised by | Ravi Subramanian, Chief Information Security Officer |
| Answers prepared by | Theo Gallagher, Solutions Engineer, BG-Demo |
| BG-Demo commercial owner | Jordan Pike |
| Scope | B-Glass on the Enterprise tier, run inside the customer's own Snowflake account |
| Document status | Draft. Not a final response. Answers marked "open" have no evidence attached yet. |
How to read this draft
Each answer states only what BG-Demo can evidence. Where the evidence is not yet attached, the answer says so and names the owner and the next step. No finding should be treated as closed until the evidence has been received and accepted by Etowah Lane. A reference customer is not offered in place of a control.
Section A: Architecture and data location
Read the whole document (7,632 characters)
| Ref | Question | Draft answer | Evidence status | Owner |
|---|---|---|---|---|
| A-a | Where does our data live? | B-Glass is built and run inside the customer's own Snowflake account. BG-Demo does not hold a separate copy of the customer's data in a BG-Demo environment. | Architecture description can be shared. Open: data flow diagram for review. | Theo Gallagher |
| A-b | Which source systems would be connected? | Connectors are configured by the customer from the systems it already uses, for example the CRM, the helpdesk, the call recorder, Microsoft 365 or Google Workspace, and the accounting system. The list for Etowah Lane has not been agreed. | Open: connector list to be agreed with Etowah Lane. | Theo Gallagher |
| A-c | Can data residency be fixed to the United States? | Dedicated US data residency is available as an add-on. Because the brain runs in the customer's Snowflake account, the region is the one the customer chooses for that account. | Open: written confirmation of the residency option for the order form. | Jordan Pike |
| A-d | Is any data used to train models for other customers? | Open. The answer must come from the platform team and will not be given from the sales side. | Open: platform team statement requested. | Theo Gallagher |
Section B: Access controls
| Ref | Question | Draft answer | Evidence status | Owner |
|---|---|---|---|---|
| B-a | Who has standing access to our environment? | Open. The position BG-Demo intends to evidence is that BG-Demo staff hold no standing access to the customer's Snowflake account and that any support access is granted by the customer, for a stated purpose, and removed afterwards. This has to be confirmed against the actual support procedure before it is issued. | Open: support access procedure and access log extract requested. | Theo Gallagher |
| B-b | How do users sign in? | The Enterprise tier includes single sign-on and SCIM provisioning, so joiners, movers and leavers can be driven from the customer's identity provider. | Product documentation can be shared. Open: configuration walkthrough. | Theo Gallagher |
| B-c | How are permissions in the source systems respected? | Open. The way source permissions are carried into the brain needs a precise written description from the platform team, including what happens when a record is restricted in the source. | Open: platform team description requested. | Theo Gallagher |
| B-d | How many administrators does the customer need? | At least two named administrators are recommended, so that one departure does not leave the brain without an owner. | Recommendation only. No control reference. | Theo Gallagher |
Section C: Incident history and response
| Ref | Question | Draft answer | Evidence status | Owner |
|---|---|---|---|---|
| C-a | What is your incident history? | BG-Demo keeps incident reports with a timeline, impact, cause and actions. The record relevant to this review has not yet been extracted and checked, so no statement about history is made in this draft. | Open: incident report summary to be supplied. | Theo Gallagher |
| C-b | How and when would we be told of an incident? | Open. The notification commitment is to be taken from the contract terms and stated exactly, with a dated commitment rather than a general assurance. | Open: contract wording to be confirmed. | Jordan Pike |
| C-c | What first-response commitment applies to a priority one issue? | The Enterprise service level gives the fastest first response of the three tiers, measured in minutes rather than business hours. The exact figure will be quoted from the order form. | Service level schedule can be shared. | Jordan Pike |
Section D: Availability and data freshness
| Ref | Question | Draft answer | Evidence status | Owner |
|---|---|---|---|---|
| D-a | What availability is committed? | The Enterprise tier carries the higher of the two availability commitments. The figure will be quoted from the order form, not from this draft. | Service level schedule can be shared. | Jordan Pike |
| D-b | What happens when data is stale? | The nightly refresh is expected to complete by the start of the customer's business day on business days. Availability and freshness are separate measures. On the Enterprise tier a service credit can apply to both. | Service level schedule can be shared. | Jordan Pike |
| D-c | Is there a non-production environment for testing changes? | A Sandbox is offered with the Enterprise tier from the second price book version. Whether it is included for Etowah Lane depends on the order form. | Open: confirm inclusion in the proposal. | Jordan Pike |
Section E: Exit and deletion
| Ref | Question | Draft answer | Evidence status | Owner |
|---|---|---|---|---|
| E-a | What happens to our data if we leave? | Because the brain sits in the customer's own Snowflake account, the customer's data remains in that account. What BG-Demo must remove at exit is its own access and its own build artefacts. | Open: written exit plan with removal steps and dates. | Theo Gallagher |
| E-b | Can you evidence deletion? | Open. Evidence of removal would be provided at exit. The form of that evidence has not been defined. | Open: define the deletion evidence. | Theo Gallagher |
Section F: Assurance and certification
| Ref | Question | Draft answer | Evidence status | Owner |
|---|---|---|---|---|
| F-a | Which independent assurance reports do you hold? | No claim is made in this draft. Any certification or audit report will be listed only once the document itself is attached and its scope and date have been checked. | Open: documents to be collected from the platform team. | Theo Gallagher |
| F-b | Do you carry out penetration testing? | Open. A summary letter with scope, date and the status of findings is needed before this can be answered. | Open: platform team to supply. | Theo Gallagher |
Open points before this draft can be issued
- Support access procedure and access log extract (B-a).
- Platform team statements on model training and permission handling (A-d, B-c).
- Incident report summary and notification wording (C-a, C-b).
- Written exit plan and deletion evidence (E-a, E-b).
- Assurance documents and test summary (F-a, F-b).
Next steps
Theo Gallagher will open the next call with the list of open findings and their owners, and will issue a second version once the evidence above has been collected. Questions on commercial terms, including data residency and Sandbox inclusion, go through Jordan Pike. Price is not part of this security review.
Thanks, Theo
Unusual terms
As at Fri 9 Oct 2026- No certification or assurance claim made
- Incident history deliberately not stated
- US data residency only as an add-on