Delaunay Brisset Courtage - Security Questionnaire
Documentfinal Delaunay Brisset Courtage · security questionnaire · final · 19 Feb 2026
Security questionnaire completed on 19 Feb 2026 for the Growth tier implementation, prepared by Theo Gallagher. It records the customer's controls and says the brain will sit in a Snowflake workspace in the EU (Frankfurt region). It sets no price or service levels.
What it says
What this says
As at Fri 9 Oct 2026Security questionnaire completed on 19 Feb 2026 for the Growth tier implementation, prepared by Theo Gallagher. It records the customer's controls and says the brain will sit in a Snowflake workspace in the EU (Frankfurt region). It sets no price or service levels.
What it is: a customer security questionnaire completed on 19 Feb 2026 and prepared by Theo Gallagher, Solutions Engineer. It records the customer's own controls: a DPO on staff, RBAC, TLS 1.3, AES-256 for call recordings, and a 4 hour RTO.
Commits: the only BG-Demo-side statement is residency: "The BG-Demo brain will be provisioned within a Snowflake workspace in the EU (Frankfurt region)". The customer states a 72 hour breach notification target, as required by GDPR.
Unusual: multi-factor authentication is required for remote and administrative access, but user rollout is only "planned for next month". The incident response test is "scheduled in spring", so neither item is confirmed complete.
Not settled: the document carries no price, availability figure, P1 response time or signature. It is filed as final, but the questionnaire has no sign-off and next steps remain open.
As found in this document
As at Fri 9 Oct 2026- Data residencyThe BG-Demo brain will be provisioned within a Snowflake workspace in the EU (Frankfurt region)Source: the AI read of this record
- Customer breach notification target72 hours, as required by GDPR. Internal notification to the DPO within 4 business hours.Source: the AI read of this record
The document
Body
Delaunay Brisset Courtage, Security Questionnaire
Completed: 19 Feb 2026 Tier: Growth Prepared by: Theo Gallagher, BG-Demo
Overview
This questionnaire documents the security controls at Delaunay Brisset Courtage relevant to the BG-Demo Growth tier implementation.
Security Assessment
| Control Area | Question | Response |
|---|---|---|
| Data Protection | Do you have a data protection officer (DPO) or equivalent role? | Yes. DPO on staff reports to the compliance committee. |
| Data Protection | Is a Data Protection Impact Assessment (DPIA) completed for new processing of personal data? | Yes. DPIA required for all new IT initiatives; last completed in February for BG-Demo integration. |
| Access Control | How is access to client and financial data controlled? | Role-based access control (RBAC) on all systems. Access provisioned by IT manager; reviewed quarterly by department heads. |
| Access Control | Do you enforce multi-factor authentication? | Yes. Required for all remote access and administrative accounts; user rollout planned for next month. |
| Encryption | Are client communications encrypted in transit? | Yes. All email and f |
Read the whole document (3,016 characters)
ile transfers use TLS 1.3. Call recordings are encrypted using AES-256. | | Encryption | Is sensitive data encrypted at rest? | Yes. Encryption at rest enabled in the financial system and the case management system. | | Incident Response | Do you have an incident response plan for security breaches? | Yes. Plan documented and tested annually; next test scheduled in spring. | | Incident Response | What is your target for notifying affected parties of a data breach? | 72 hours, as required by GDPR. Internal notification to the DPO within 4 business hours. | | Business Continuity | What is your recovery time objective (RTO) for critical systems? | 4 hours for client-facing and financial systems. | | Backup & Recovery | How often are backups tested? | Monthly restore test; full backup daily; 30 days' retention. | | Vendor Management | Do you conduct security assessments of software vendors? | Yes. All SaaS vendors and critical integrations assessed using a standard questionnaire before go-live. | | Audit & Logging | Are system logs retained and reviewed? | Yes. 24 months' retention; logs reviewed quarterly for anomalies and annually for compliance audit. | | Compliance | What regulatory frameworks apply to your business? | GDPR (personal data processing); French financial regulations (client assets); insurance-specific data security standards. |
Residency and Snowflake
The BG-Demo brain will be provisioned within a Snowflake workspace in the EU (Frankfurt region) to meet data residency requirements.
Next Steps
- Review this questionnaire with your IT and DPO teams
- Confirm Snowflake account creation and networking prerequisites
- Schedule implementation kick-off for early spring
Prepared by: Theo Gallagher, Solutions Engineer, BG-Demo
Unusual terms
As at Fri 9 Oct 2026- EU Frankfurt residency
- MFA user rollout still planned
- Customer-side breach notification target