Kronfeld Assekuranz - Security Questionnaire
Documentfinal Kronfeld Assekuranz · security_questionnaire · final · 2025-12-14
A completed 12-question security questionnaire for the Growth tier, signed off by Hannah Lowe on 14 Dec 2025. It states TLS 1.2 or higher, a 4 hour recovery time objective and incident notice within 24 hours. It states no price or availability figure.
What it says
What this says
Current to 14 Oct 26A completed 12-question security questionnaire for the Growth tier, signed off by Hannah Lowe on 14 Dec 2025. It states TLS 1.2 or higher, a 4 hour recovery time objective and incident notice within 24 hours. It states no price or availability figure.
What it is: a BB-Demo answer sheet to the customer's security assessment, verified by Hannah Lowe, Solutions Engineer. It says it reflects "the Growth tier service".
Commits: incident notice "within 24 hours", critical patches "within 72 hours", other patches "within 30 days of release", and data deleted "within 30 days" of termination. Recovery time objective is "4 hours" within a rolling 90-day window.
Unusual: answer 3 says SSO is "available upon Enterprise upgrade", which is a tier limit, not a Growth feature. Answer 10 claims SOC 2 Type II certification; the document gives no certificate date or scope.
Not settled: it is a questionnaire, not a contract. It names no order form, no price, no availability percentage and no signature by the customer, and it is dated 14 Dec 2025, so it may be stale.
As found in this document
Current to 9 Oct 26- Encryption in transitTLS 1.2 or higherSource: object_read:doc_177_001
- Recovery time objective4 hours for any recoverable state within rolling 90-day window4 hours for any recoverable state within rolling 90-day window · Source: object_read:doc_177_001
- Security patchesapplied within 30 days of releaseapplied within 30 days of release · Source: object_read:doc_177_001
- Critical patchesapplied within 72 hoursSource: object_read:doc_177_001
- Incident notificationwithin 24 hoursSource: object_read:doc_177_001
- Data deletion on terminationwithin 30 daysSource: object_read:doc_177_001
- Audit log retentionminimum one yearSource: object_read:doc_177_001
The document
Body
Kronfeld Assekuranz, Security Questionnaire
Version: 1 Status: Final Completed: 14 Dec 2025
Security and Compliance Assessment
| Question | Answer |
|---|---|
| 1. Data Encryption in Transit | All data transferred to and from the Company Brain uses TLS 1.2 or higher encryption. API endpoints enforce encrypted connections only. |
| 2. Data Encryption at Rest | Customer data at rest in Snowflake is encrypted using Snowflake's native encryption with customer-managed keys. |
| 3. Access Controls | Role-based access control (RBAC) configured at deployment. Customer admins manage user permissions. SSO available upon Enterprise upgrade. |
| 4. Authentication | Multi-factor authentication supported for all user roles via integration with Snowflake and Microsoft 365. |
| 5. Audit Logging | All data queries and user actions logged in Snowflake. Logs retained for minimum one year. Customer has direct access to audit tables. |
| 6. Data Residency | Data runs entirely within Customer's Snowflake account in the region specified at deployment. BB-Demo does not replicate or store copies. |
| 7. Data Backup and Recovery | Snowflake handles backup |
Read the whole document (2,412 characters)
and recovery. Customer retains control. Recovery time objective: 4 hours for any recoverable state within rolling 90-day window. | | 8. Vulnerability Management | BB-Demo conducts quarterly vulnerability scanning. Security patches applied within 30 days of release. Critical patches applied within 72 hours. | | 9. Incident Response | Incident response procedure documented in Data Processing Agreement. Customer notified of security incidents affecting their data within 24 hours. | | 10. Certifications and Standards | BB-Demo holds SOC 2 Type II certification. Company Brain runs on AWS and Azure infrastructure with appropriate regional compliance. | | 11. Third-Party Access | No third-party access to Customer data. Integration with Customer's existing systems is read-only and mediated by published APIs. | | 12. Data Deletion | Upon contract termination, all data is deleted from BB-Demo systems within 30 days. Customer retains data in their Snowflake account indefinitely. |
Completed and verified by: Hannah Lowe, Solutions Engineer, BB-Demo Date: 14 Dec 2025
This questionnaire reflects BB-Demo's current security posture and controls for the Growth tier service.
Unusual terms
Current to 9 Oct 26- SSO only on Enterprise upgrade
- SOC 2 Type II claim with no certificate detail