Tilden Marsh Logistics - Security Questionnaire
Documentfinal Tilden Marsh Logistics · security questionnaire · final · 28 Dec 2025
Completed security questionnaire for Tilden Marsh Logistics, signed off by Hannah Lowe on 28 Dec 2025. It states TLS 1.3 in transit, AES-256 at rest, and critical incident investigation within one business hour. It is not a contract.
What it says
What this says
As at Fri 9 Oct 2026Completed security questionnaire for Tilden Marsh Logistics, signed off by Hannah Lowe on 28 Dec 2025. It states TLS 1.3 in transit, AES-256 at rest, and critical incident investigation within one business hour. It is not a contract.
What it is: a customer-facing security questionnaire, version 1 marked Final, completed on 28 Dec 2025 by Hannah Lowe, Solutions Engineer. It covers encryption, access control, audit logging and incident response.
Commits: the answers state "Customers are notified within 24 hours of confirmed breach" and logs "retained for a minimum of two years". It also claims annual third-party penetration testing and SOC 2 Type II certification.
Unusual: the access control answer says "Cross-customer queries are technically impossible", an absolute claim that sits beside the multi-tenant wording. The encryption answer says keys are managed by Snowflake.
Not settled: the text does not say whether it was attached to an order form or the MSA, nor who at Tilden Marsh Logistics received it. It gives no review date, so currency of the answers is unconfirmed.
As found in this document
As at Fri 9 Oct 2026- Data in transit encryptionTLS 1.3Source: the AI read of this record
- Data at rest encryptionAES-256 within SnowflakeSource: the AI read of this record
- Critical security incident responseinvestigation within one business hourSource: the AI read of this record
- Breach notificationwithin 24 hours of confirmed breachSource: the AI read of this record
- Log retentiona minimum of two yearsSource: the AI read of this record
- Access reviewreviewed quarterlySource: the AI read of this record
- Penetration testingannual third-party penetration testingSource: the AI read of this record
The document
Body
Tilden Marsh Logistics, Security Questionnaire
Completed: 28 December 2025 Version: 1 Final
Data Security and Encryption
| Question | Response |
|---|---|
| Does the platform encrypt data in transit? | Yes. All data in transit uses TLS 1.3 encryption. |
| Does the platform encrypt data at rest? | Yes. Data is encrypted at rest using AES-256 within Snowflake. Encryption keys are managed by Snowflake. |
| What encryption standards apply to customer data? | TLS 1.3 in transit; AES-256 at rest. Key management follows industry standards. |
Access Control
| Question | Response |
|---|---|
| Are user access controls role-based? | Yes. Access is provisioned by role and function, validated during implementation and reviewed quarterly. |
| How is administrative access restricted? | Administrative access is limited to named BG-Demo personnel with documented business justification. All access is logged. |
| Is customer data isolated from other customers in the multi-tenant system? | Yes. Data isolation is enforced at both the application and database layers. Cross-customer queries are technically impossible. |
Audit and Logging
Read the whole document (2,190 characters)
| Question | Response |
|---|---|
| Are user actions and queries logged? | Yes. All queries, connector changes, configuration updates and user provisioning are logged with timestamp and user identity. |
| What is the log retention period? | Logs are retained for a minimum of two years. |
| Can customers access their own audit logs? | Yes, through the platform; summaries are provided in quarterly business reviews. |
Incident Response
| Question | Response |
|---|---|
| What is the incident response procedure? | Critical security incidents trigger investigation within one business hour. Customers are notified within 24 hours of confirmed breach. |
| Is there a documented incident response plan? | Yes. We maintain a security incident response plan aligned with ISO 27001 principles. |
| Do you perform security testing? | Yes. We conduct annual third-party penetration testing and maintain SOC 2 Type II certification. |
Completed by: Hannah Lowe, Solutions Engineer Status: Final
Unusual terms
As at Fri 9 Oct 2026- Breach notification within 24 hours
- Absolute claim of cross-customer isolation
- SOC 2 Type II certification stated