Annual supplier security review
Documentfinal Kelbrook Mutual Insurance · security questionnaire · final · 9 Dec 2025
Final annual security review of B-Viz on the Growth tier, completed 9 Dec 2025 by Gareth Lumb and Hannah Lowe. No new findings and no open actions. It states a term to 16 Jan 2026, which is now past, so it is stale.
What it says
What this says
As at Fri 9 Oct 2026Final annual security review of B-Viz on the Growth tier, completed 9 Dec 2025 by Gareth Lumb and Hannah Lowe. No new findings and no open actions. It states a term to 16 Jan 2026, which is now past, so it is stale.
What it is: a customer-led security questionnaire, with BG-Demo answers and review outcomes. It states "No new findings were raised." and lists no open actions for either side.
Commits: Hannah will "put any later change to a control in writing before it takes effect." The nightly refresh is stated as "By 07:00 customer local time on business days, as for every tier." Data stays in the customer's own Snowflake account.
Unusual: nothing off the standard terms. It confirms single sign-on and automated provisioning are Enterprise features, Premium support is not included and no residency add-on is part of the contract.
Not settled: it states a term running to 16 Jan 2026 and contracted annual recurring revenue of £56k, but it is not the order form and does not show what happened at renewal. It states no availability figure, P1 response time or price. The next review is not dated.
As found in this document
As at Fri 9 Oct 2026- Date end16 Jan 2026Source: the AI read of this record
- Date signed9 Dec 2025Source: the AI read of this record
- Nightly refreshBy 07:00 customer local time on business days, as for every tier.Source: the AI read of this record
- Control changesHannah Lowe will put any later change to a control in writing before it takes effect.Source: the AI read of this record
- SupportGrowth service levels apply, as set out in the order form.Source: the AI read of this record
Body
Annual supplier security review
Status: Final Customer: Kelbrook Mutual Insurance Supplier: BG-Demo Product and tier: B-Viz, Growth Review date: 9 December 2025 Reviewer (customer): Gareth Lumb, Head of IT Security Respondent (supplier): Hannah Lowe, Solutions Engineer
Summary of outcome
This is the annual supplier security review for Kelbrook Mutual Insurance, completed on 9 December 2025. Gareth Lumb reviewed the answers below against the previous review and the current contract. No new findings were raised. There are no open actions on either side.
Context for the review:
- Kelbrook Mutual Insurance has been a customer since 17 Jan 2024 on the Growth tier.
- The current term runs to 16 Jan 2026.
- Contracted annual recurring revenue is £56k, covering 80 licensed users.
- Support activity over the last month has been light, with one ticket and none at high priority.
How to read this document
Read the whole document (6,245 characters)
Each row gives the question, BG-Demo's answer and the outcome of the review. Where an answer depends on how Kelbrook Mutual Insurance configures its own environment, the answer says so. Answers describe the controls as they stand; they do not claim anything beyond that.
Section A: Data location and architecture
| Question | BG-Demo answer | Review outcome |
|---|---|---|
| Where is Kelbrook Mutual Insurance data stored and processed? | B-Viz is built and run inside Kelbrook Mutual Insurance's own Snowflake account. Data stays in that account and is not copied to a separate BG-Demo data store. | Accepted. No change since the last review. |
| Has the architecture changed since the last review? | No material change. The same connectors and the same nightly refresh pattern are in place. | Accepted. |
| Is dedicated regional data residency in place? | Residency follows the region of the customer's Snowflake account. No separate residency add-on is part of this contract. | Noted. No action. |
| When does the nightly refresh complete? | By 07:00 customer local time on business days, as for every tier. | Accepted. |
Section B: Access control
| Question | BG-Demo answer | Review outcome |
|---|---|---|
| Who at BG-Demo can reach the customer environment? | Access is limited to named staff who need it for support or implementation work, and is granted through the customer's own Snowflake access controls. | Accepted. |
| How is access to B-Viz for Kelbrook Mutual Insurance staff managed? | Users are provisioned by the customer's administrators within the licensed user count. Joiners, movers and leavers remain the customer's process. | Accepted. Gareth Lumb confirmed this matches how his team works. |
| Is single sign-on included? | Single sign-on and automated user provisioning are Enterprise features and are not part of the Growth tier. | Noted. No action. |
| Is access reviewed regularly? | The customer reviews its own user list. BG-Demo supports this by providing the current user list on request. | Accepted. |
Section C: Data protection and handling
| Question | BG-Demo answer | Review outcome |
|---|---|---|
| Is data encrypted? | Encryption at rest and in transit is provided by the Snowflake platform and by the connections B-Viz uses. To be precise, the underlying controls are those of the customer's Snowflake account. | Accepted. |
| Does BG-Demo use customer data to train models for other customers? | No. Customer data is used only to serve that customer's own B-Viz queries. | Accepted. |
| What happens to data at the end of the contract? | Data sits in the customer's own account, so the customer retains it. BG-Demo removes its components and access on request after the term ends. | Accepted. |
| Which source systems are connected? | Those listed in the order form for Kelbrook Mutual Insurance. No connector has been added or removed without the customer's agreement since the last review. | Accepted. |
Section D: Incident response and support
| Question | BG-Demo answer | Review outcome |
|---|---|---|
| How are security incidents handled? | Incidents are triaged on receipt, owned by a named person and reported to the customer contact. A written incident report follows any material event. | Accepted. |
| Have there been incidents affecting this customer since the last review? | None reported to the customer or recorded against this account. | Accepted. |
| What is the support position on this tier? | Growth service levels apply, as set out in the order form. Premium support is not part of this contract. | Noted. |
| Are there open high-priority tickets? | None. One ticket was raised in the last month and it is not security related. | Accepted. |
Section E: Governance and continuity
| Question | BG-Demo answer | Review outcome |
|---|---|---|
| Does BG-Demo review its security policies regularly? | Yes, on a regular internal cycle. Any change that affects a customer is notified to the named contact. | Accepted. |
| Are staff trained in data protection? | Yes. Training is part of onboarding and is repeated on a regular cycle. | Accepted. |
| How are subcontractors handled? | The only third-party platform in the data path is Snowflake, which the customer already contracts directly. No other subcontractor processes the customer's data. | Accepted. |
| Is there a business continuity arrangement? | Yes. Because the data sits in the customer's own account, recovery of the data follows the customer's Snowflake arrangements, and BG-Demo restores its own components from managed configuration. | Accepted. |
Findings and actions
| Item | Detail |
|---|---|
| New findings | None |
| Carried-over findings | None |
| Open actions for BG-Demo | None |
| Open actions for Kelbrook Mutual Insurance | None |
Notes
Gareth Lumb asked that this review be kept on file alongside the contract ahead of the term ending on 16 Jan 2026, so that the next review can start from this version. Hannah Lowe will put any later change to a control in writing before it takes effect.
Sign-off
| Role | Name | Date |
|---|---|---|
| Reviewer, Head of IT Security, Kelbrook Mutual Insurance | Gareth Lumb | 9 December 2025 |
| Respondent, Solutions Engineer, BG-Demo | Hannah Lowe | 9 December 2025 |