Kelbrook Mutual Insurance - Security Questionnaire
Documentfinal Kelbrook Mutual Insurance · security questionnaire · final · 24 Nov 2023
BG-Demo's answers to Kelbrook's security questions for the Growth tier, completed by Tobias Renwick on 24 Nov 2023. It states no availability %, P1 response time or price. It excludes SSO and SCIM, the Sandbox and freshness credits.
What it says
What this says
As at Fri 9 Oct 2026BG-Demo's answers to Kelbrook's security questions for the Growth tier, completed by Tobias Renwick on 24 Nov 2023. It states no availability %, P1 response time or price. It excludes SSO and SCIM, the Sandbox and freshness credits.
What it is: A final questionnaire in which Tobias Renwick records how B-Viz is designed and run for Kelbrook's member services, underwriting and claims. It says B-Viz runs "Inside Kelbrook's own Snowflake account".
Commits: It states no numeric service levels, price or dates. It says the nightly refresh "applies to every tier", and that a data processing agreement is "signed alongside the order form, under the master services agreement".
Unusual: It is candid about Growth limits: SSO and SCIM are "not included in Growth", the Sandbox "is not part of Growth", and "Only Enterprise is credited for data freshness." It asserts no third-party certifications.
Not settled: The order form is meant to name the connectors and live-by commitments, and this document does not. Kelbrook's reviewer is named only as "Security reviewer", and the evidence does not show Kelbrook's reply. Four open points are left to Kelbrook, including whether Enterprise is the better fit.
As found in this document
As at Fri 9 Oct 2026- Nightly refreshThe nightly refresh completes before the start of the business day in customer local time on business days. This applies to every tier.Source: the AI read of this record
- Growth service creditsThe standard Growth availability level, with service credits for availability only.Source: the AI read of this record
- Data processing agreementIt is signed alongside the order form, under the master services agreement.Source: the AI read of this record
- Connector deliverythe order form will name the connectors and the live-by commitment for eachSource: the AI read of this record
The document
Body
Kelbrook Mutual Insurance - Security Questionnaire
Status: Final Completed by: Tobias Renwick, Chief Technology Officer and Co-founder, BG-Demo Date: 24 Nov 2023 Customer: Kelbrook Mutual Insurance, Leeds Tier under review: Growth BG-Demo account owner: Tom Ashdown BG-Demo customer success manager: Marcus Bell
About this document
This questionnaire records BG-Demo's answers to the security questions raised by Kelbrook Mutual Insurance while it considers B-Viz on the Growth tier for member services, underwriting and claims. To be precise, the answers describe how the product is designed and run. Where a control belongs to Kelbrook's own Snowflake account rather than to BG-Demo, the answer says so, because the honest answer is that those controls are yours to set.
Where a question touches something we do not offer on the Growth tier, we say that plainly rather than soften it. Nothing here is a roadmap commitment.
Section A: Architecture and data location
Read the whole document (7,159 characters)
| Question | Answer |
|---|---|
| Where does B-Viz run? | Inside Kelbrook's own Snowflake account. BG-Demo does not copy your data into a separate BG-Demo environment to build the layer. |
| Who owns the data? | Kelbrook. Policy, claims, call, email and ticket data stays under your account and your existing controls. |
| Does data leave the Snowflake account? | The layer is built and queried inside the account. Questions asked through chat, search and pages are answered from data held there. Your security team should confirm the exact flows they need to see, and we will walk through them together. |
| Can the data location be chosen? | Your Snowflake account sits where you chose to create it. Dedicated EU or US data residency is a separate add-on and is not part of the Growth tier as scoped here. |
| Is the design simple enough to explain on one page? | Yes. Source systems feed connectors, connectors load into your Snowflake account, and B-Viz sits on top as one queryable layer. We can supply that one-page view on request. |
Section B: Access control
| Question | Answer |
|---|---|
| How do users sign in? | Through the standard B-Viz sign-in. Single sign-on and automated user provisioning (SSO and SCIM) are Enterprise features and are not included in Growth. The trade-off is that user lifecycle on Growth is managed by your administrators rather than synchronised from your identity provider. |
| Who can administer the product? | Administrators nominated by Kelbrook. We recommend at least two, so that a single departure does not leave the account without an admin. |
| Can access be limited by team? | Access to data follows the permissions you grant in your Snowflake account. Member services, underwriting and claims can be given different views. How finely you split them is a design decision for your team. |
| How is leaver access handled? | Kelbrook administrators remove the user. Because there is no automated provisioning on Growth, we advise adding this to your standard leaver checklist. |
| Does BG-Demo staff access customer data? | BG-Demo staff work inside your environment only as far as the implementation and support need, and only through access that Kelbrook grants and can withdraw. |
Section C: Connectors and integrations
| Question | Answer |
|---|---|
| Which systems can be connected? | Salesforce, HubSpot, Zendesk, Xero, Gong, Microsoft 365, Google Workspace, Dropbox, SharePoint, Slack and Snowflake. The Growth tier carries a connector allowance, and the order form will name the connectors and the live-by commitment for each. |
| What credentials do connectors use? | Credentials are granted by Kelbrook for each source system. We ask that they are scoped to read what is needed and no more. |
| What happens if a source system changes? | A connector can stop loading after a change in the source. We watch for records that stop growing, and we tell the customer rather than letting the layer go quietly stale. |
| Can a connector be removed? | Yes. Kelbrook can withdraw a connector's access at any time from the source system. |
Section D: Availability and service levels
| Question | Answer |
|---|---|
| What availability is offered on Growth? | The standard Growth availability level, with service credits for availability only. |
| What is the response to a serious incident? | The Growth first-response level for the highest priority tickets applies. Enterprise carries a faster response, and Premium support is a separate add-on. |
| When is data refreshed? | The nightly refresh completes before the start of the business day in customer local time on business days. This applies to every tier. |
| Is staleness credited? | Not on Growth. To be precise, availability and freshness are different things: B-Viz answering on stale data counts as available. Only Enterprise is credited for data freshness. |
| Is there a test environment? | The Sandbox is an Enterprise inclusion from the second version of that tier, and is not part of Growth. |
Section E: Incident handling
| Question | Answer |
|---|---|
| How are incidents reviewed? | Blamelessly. We look for what in the design or the process allowed the problem, not for who caused it. |
| Will Kelbrook be told? | Yes. If an incident affects your environment, your named contacts are told, and we share the timeline, impact, cause and actions afterwards. |
| Do you blame customer data for platform faults? | No. If the platform caused it, we say so. |
Section F: Governance and assurance
| Question | Answer |
|---|---|
| Is there a data processing agreement? | Yes. It is signed alongside the order form, under the master services agreement. |
| Do you hold third-party certifications? | This questionnaire does not assert any. If your assurance team requires specific certificates, please ask Tom Ashdown, who will route the request to me, and I will answer it directly rather than imply cover we cannot evidence. |
| Is a full security review included? | A security review is part of the Enterprise implementation. For Growth, this questionnaire and a call with your security team are the route. |
| Can Kelbrook ask follow-up questions? | Of course. I would rather answer ten extra questions now than leave one assumption in place. |
Open points for Kelbrook's security team
These are not gaps in the answers above. They are the choices that belong to Kelbrook.
- Which Snowflake roles should see claims data and which should not.
- How leaver removal will be handled without automated provisioning.
- Whether the Growth service levels meet your regulatory and operational needs, or whether Enterprise is the better fit.
- Whether data residency beyond your current Snowflake location is needed.
Sign-off
| Role | Name | Date |
|---|---|---|
| Completed for BG-Demo | Tobias Renwick, Chief Technology Officer and Co-founder | 24 Nov 2023 |
| Commercial contact, BG-Demo | Tom Ashdown, account owner | 24 Nov 2023 |
| Customer success, BG-Demo | Marcus Bell, customer success manager | 24 Nov 2023 |
| Received for Kelbrook Mutual Insurance | Security reviewer | 24 Nov 2023 |
Best, Tobias
Unusual terms
As at Fri 9 Oct 2026- No SSO or SCIM on Growth
- No freshness credit on Growth
- No Sandbox on Growth
- No third-party certifications asserted