Kempenland Distributie - Security Questionnaire
Documentfinal Kempenland Distributie · security_questionnaire · final · 2025-10-14
Completed security questionnaire for a Growth tier deployment, dated 14 Oct 2025. It answers eight control areas, including AES-256 encryption at rest, TLS 1.2 minimum in transit, 24-hour breach notification and a one-hour recovery objective.
What it says
What this says
Current to 14 Oct 26Completed security questionnaire for a Growth tier deployment, dated 14 Oct 2025. It answers eight control areas, including AES-256 encryption at rest, TLS 1.2 minimum in transit, 24-hour breach notification and a one-hour recovery objective.
What it is: a BG-Demo response to eight security control questions for Kempenland Distributie, completed on 14 October 2025 and signed off by Hannah Lowe, Solutions Engineer. It is stored as final.
Commits: incident escalation "within one business hour", breach notification "within 24 hours", and "recovery time objective is one hour for complete restore". Audit logs are kept "90 days minimum".
Unusual: the incident answer says the commitment will be put in writing in the incident response procedure, so the written procedure is a separate document the evidence does not show.
Not settled: it is not a contract, carries no price and names no signatory at the customer. It does not say whether it was attached to an order form, and it is now a year old, so the answers may need reconfirming before any renewal.
As found in this document
Current to 9 Oct 26- Encryption at restall customer data is encrypted at rest using AES-256all customer data is encrypted at rest using AES-256 · Source: object_read:doc_215_001
- Encryption in transitTLS 1.2 minimum for all data in motionTLS 1.2 minimum for all data in motion · Source: object_read:doc_215_001
- Incident escalationWe classify and escalate within one business hourWe classify and escalate within one business hour · Source: object_read:doc_215_001
- Breach notificationCustomers are notified of any breach affecting their data within 24 hoursCustomers are notified of any breach affecting their data within 24 hours · Source: object_read:doc_215_001
- Recovery time objectiveone hour for complete restoreSource: object_read:doc_215_001
- Audit log retention90 days minimumSource: object_read:doc_215_001
- Recovery testingWe test recovery quarterlySource: object_read:doc_215_001
The document
Body
Kempenland Distributie - Security Questionnaire
Framework
This questionnaire documents BG-Demo's security controls and commitments for Growth tier deployment to Kempenland Distributie.
| # | Control Area | Question | Response |
|---|---|---|---|
| 1 | Data Protection | How do you protect customer data at rest? | To be precise: all customer data is encrypted at rest using AES-256. The short answer is your data lives in your Snowflake account under your control. The longer answer is we enforce role-based access and maintain isolation between customers. |
| 2 | Encryption | What encryption do you use for data in transit? | TLS 1.2 minimum for all data in motion. All API integrations use certificate-pinned HTTPS connections. |
| 3 | Access Management | How do you restrict access to customer data? | Role-based access control at the database level. Users authenticate through your identity provider using standard protocols. Administrators require multi-factor authentication. |
| 4 | Audit Logging | Do you maintain audit logs of user actions and access? | Yes. Snowflake provides complete audit logs of all queries, logins and administrative actions. Logs are retained for 90 days min |
Read the whole document (2,256 characters)
imum and available to you for export. | | 5 | Incident Response | What do you do if a security incident occurs? | We classify and escalate within one business hour. Customers are notified of any breach affecting their data within 24 hours. I'll put that commitment in writing in our incident response procedure. | | 6 | Business Continuity | What is your recovery commitment? | To be precise: recovery time objective is one hour for complete restore. Backups are in geographically distributed locations. We test recovery quarterly. | | 7 | Vendor Risk Management | How do you manage your own vendor risks? | We conduct security assessments annually. Material vendors must meet our security standards. We maintain exit plans for critical dependencies. | | 8 | Compliance Standards | What certifications do you hold? | ISO 27001 certified. Compliant with GDPR and UK GDPR. We serve customers in regulated sectors including distribution and finance. |
This questionnaire was completed on 14 October 2025. For updates, contact Hannah Lowe, Solutions Engineer.
Unusual terms
Current to 9 Oct 26- 24-hour breach notification
- one-hour recovery objective
- written incident procedure promised