Marlstone Legal - Security Questionnaire
Documentfinal Marlstone Legal · security questionnaire · final · 28 Jan 2025
A completed ten-question security questionnaire filed under Marlstone Legal's security folder, stored as final. It states TLS 1.2 and above in transit, 24-hour breach notification and BG-Demo systems deleted within 30 days of termination. It states no price or service levels.
What it says
What this says
As at Fri 9 Oct 2026A completed ten-question security questionnaire filed under Marlstone Legal's security folder, stored as final. It states TLS 1.2 and above in transit, 24-hour breach notification and BG-Demo systems deleted within 30 days of termination. It states no price or service levels.
What it is: a question and answer sheet created and last modified on 28 Jan 2025, answering a customer security review. The text marks it "Final" and it is signed by no one.
Commits: it states "TLS 1.2 and above for all connections to the brain and Snowflake" and "24-hour notification to customers of confirmed breaches". It also says "BG-Demo systems deleted within 30 days of termination" and that the customer "retains all access control".
Unusual: nothing departs from the standard terms in the company brief. The business continuity answer cites "quarterly testing" and relies on Snowflake for availability.
Not settled: the sheet names no author on the customer side, no party signatory and no contract it sits under. It does not state service levels, price or renewal. It is a statement of practice from January 2025, so its currency should be checked before reuse.
As found in this document
As at Fri 9 Oct 2026- Encryption in transitTLS 1.2 and above for all connections to the brain and Snowflake.Source: the AI read of this record
- Security incident notification24-hour notification to customers of confirmed breaches.Source: the AI read of this record
- Data at end of contractBG-Demo systems deleted within 30 days of termination.Source: the AI read of this record
- Business continuity testingYes, with quarterly testing.Source: the AI read of this record
Body
Marlstone Legal - Security Questionnaire
Status: Final
| Question | Answer |
|---|---|
| What is the legal basis for processing personal data? | Contract, legitimate interest, and consent where required. |
| Do you use multi-factor authentication for user accounts? | Yes, via Microsoft 365 identity. |
| What is your data backup and recovery procedure? | Data held in customer's own Snowflake account; we provide technical support for backup configuration. |
| Is there a business continuity or disaster recovery plan in place? | Yes, with quarterly testing. Snowflake provides availability within service levels. |
| What is the encryption standard for data in transit? | TLS 1.2 and above for all connections to the brain and Snowflake. |
| How do you handle security incidents? | Documented process with 24-hour notification to customers of confirmed breaches. |
| Are staff trained in data security and privacy? | Annual training required; compliance tracked via Microsoft 365. |
| Who is responsible for access control? | Customer retains all access control; we enable SSO and role-based controls. |
| How is the audit trail maintained? | Snowflake audit logs retained by customer; quer |
Read the whole document (1,387 characters)
y history available in the brain. | | What happens to data at the end of the contract? | Retained in customer's Snowflake account; BG-Demo systems deleted within 30 days of termination. |