Pelton Grange Care - Security Questionnaire
Documentfinal Pelton Grange Care · security questionnaire · final · 19 Jun 2025
Completed security questionnaire for Pelton Grange Care at Growth tier, answered by Anya Petrova on 19 Jun 2025. It states a 4 business hour incident notice and a recovery time objective under 1 hour. It states no availability %, P1 response time or price.
What it says
What this says
As at Fri 9 Oct 2026Completed security questionnaire for Pelton Grange Care at Growth tier, answered by Anya Petrova on 19 Jun 2025. It states a 4 business hour incident notice and a recovery time objective under 1 hour. It states no availability %, P1 response time or price.
What it is: BG-Demo's answers to a customer security questionnaire, completed by Anya Petrova, Solutions Engineer, on 19 Jun 2025 for the Growth tier. It covers information security, data protection, operational security and audit.
Commits: "Customers are notified within 4 business hours of discovery of a security incident affecting their data." Critical security patches go out "within 48 hours", and the recovery time objective is "under 1 hour".
Unusual: the SOC 2 answer says BG-Demo "complies with SOC 2 principles", with audit reports under NDA. The certifications listed belong to Snowflake, not BG-Demo.
Not settled: it is a statement of practice, not an order form. It sets no availability %, P1 response time, service credit or price, and it was not re-dated after 19 Jun 2025.
As found in this document
As at Fri 9 Oct 2026- Security incident notificationCustomers are notified within 4 business hours of discovery of a security incident affecting their dataSource: the AI read of this record
- Critical security patchescritical security patches within 48 hoursSource: the AI read of this record
- Recovery time objectiveunder 1 hourSource: the AI read of this record
- Encryption in transitTLS 1.2 or higherSource: the AI read of this record
- Encryption at restAES-256Source: the AI read of this record
- Activity log retentionLogs are retained for 12 months and available for auditSource: the AI read of this record
- Data on terminationdeleted or returned at the customer's request within 30 daysSource: the AI read of this record
- Audit notice30 days' notice and a signed NDASource: the AI read of this record
The document
Body
Pelton Grange Care, Security Questionnaire
Completed by: Anya Petrova, Solutions Engineer, BG-Demo
Date: 19 June 2025
Tier: Growth
Information Security
| Question | BG-Demo Response |
|---|---|
| What is your SOC 2 certification status? | BG-Demo complies with SOC 2 principles for security, availability, and data confidentiality. Detailed audit reports are available under NDA upon request. |
| Do you encrypt data at rest? | Yes. All data stored in Snowflake is encrypted with AES-256. Encryption keys are managed by Snowflake's Key Management Service. |
| Do you encrypt data in transit? | Yes. All data transmission between customer systems and BG-Demo infrastructure uses TLS 1.2 or higher. |
| What is your incident response process? | We maintain a documented incident response plan covering detection, containment, eradication, and recovery. Customers are notified within 4 business hours of discovery of a security incident affecting their data. |
| How do you handle access control? | Role-based access control (RBAC) is enforced. User accounts are provisioned only with the minimum permissions required for their role. Multi-factor authent |
Read the whole document (4,251 characters)
ication is available for administrators. | | Do you conduct penetration testing? | Yes. BG-Demo commissions annual third-party penetration testing and remediates identified risks before release to production. |
Data Protection and Privacy
| Question | BG-Demo Response |
|---|---|
| Are you GDPR compliant? | Yes. BG-Demo acts as a data processor and has executed Data Processing Agreements (DPAs) with all customers. We comply with GDPR Articles 28–32 and maintain standard contractual clauses for international transfers. |
| Where is customer data stored? | Customer data is stored in Snowflake within the UK region by default. EU and US data residency options are available as an add-on. |
| What is your data retention policy? | Customer data is retained for the duration of the contract. Upon contract termination, data is deleted or returned at the customer's request within 30 days. |
| How do you handle data subject requests? | We respond to customer requests for data subject access, erasure, and portability within the timescales specified in the DPA. The customer is responsible for the end-user communication. |
Operational Security
| Question | BG-Demo Response |
|---|---|
| How do you manage software vulnerabilities? | All BG-Demo personnel receive security training. Dependency scanning is automated in our CI/CD pipeline. Production patches are deployed on a risk-assessed basis; critical security patches within 48 hours. |
| Do you log user activity? | Yes. All user actions (queries, exports, user management) are logged with timestamp, user ID, and action type. Logs are retained for 12 months and available for audit. |
| What is your disaster recovery plan? | Snowflake provides automatic backup and geo-redundant replication. In the event of a data centre failure, customer data remains available with no manual intervention required. Recovery time objective is under 1 hour. |
| How do you manage vendor access? | BG-Demo staff access customer data only for support and incident investigation, with full logging and customer notification. Sub-processor changes are communicated in advance with opt-out rights. |
Compliance and Audit
| Question | BG-Demo Response |
|---|---|
| Are you happy to undertake a security audit? | Yes. Customers may conduct security assessments, including third-party assessments. We ask for 30 days' notice and a signed NDA. Enterprise customers receive a tailored security assessment as part of onboarding. |
| Do you hold any compliance certifications? | BG-Demo's Snowflake environment is hosted by Snowflake, which holds SOC 2 Type II, ISO 27001, and FedRAMP (Moderate) certifications. |
Next Steps
Please confirm receipt of this questionnaire. If any answers require clarification or if you would like to discuss BG-Demo's security posture in greater detail, please contact your Solutions Engineer.
This questionnaire reflects BG-Demo's security practices as of 19 June 2025.
Unusual terms
As at Fri 9 Oct 2026- Incident notice within 4 business hours
- Critical patches within 48 hours
- SOC 2 principles claimed, reports under NDA