Strensall Merchants - Security Questionnaire
Documentfinal Strensall Merchants · security questionnaire · final · 2 Jan 2025
Security questionnaire completed by Hannah Lowe on 2 Jan 2025 for a proposed Enterprise deployment. It states no availability %, P1 response time or price, and defers all figures to the order form and MSA.
What it says
What this says
As at Fri 9 Oct 2026Security questionnaire completed by Hannah Lowe on 2 Jan 2025 for a proposed Enterprise deployment. It states no availability %, P1 response time or price, and defers all figures to the order form and MSA.
What it is: a final security review response by Hannah Lowe, Solutions Engineer, for the proposed Enterprise deployment, covering architecture, access control, service levels and implementation. It says "nothing here is a promise beyond what the executed order form and MSA will say".
Commits: very little. Service levels are described only as the highest in the range, with "The exact figure will be stated in the order form". Connectors named in the order form carry a go-live commitment.
Unusual: nothing off standard terms. It does flag that Enterprise is the only tier credited if freshness is missed, and recommends more than one named administrator.
Not settled: availability, P1 response time, price, residency, Premium support and Sandbox inclusion, certification evidence, encryption specifics, sub-processors and breach notification timing. The last two sit in the DPA and MSA. The document does not show whether the deployment went ahead.
As found in this document
As at Fri 9 Oct 2026- Connector go-liveConnectors named in the order form carry a commitment to go live within a stated number of days.Source: the AI read of this record
- Nightly refreshexpected to complete before the start of the customer's business day on business daysSource: the AI read of this record
- Availability and P1 responseThe exact figure will be stated in the order form.Source: the AI read of this record
The document
Body
Strensall Merchants - Security Questionnaire
Status: Final Completed by: Hannah Lowe, Solutions Engineer, BG-Demo Date: Thursday 2 January 2025 Prospect: Strensall Merchants, York Tier under review: Enterprise BG-Demo account owner: Lewis Kerr Customer Success Manager: Daniel Okafor
Purpose and scope
This questionnaire answers the security review questions raised by Strensall Merchants for the proposed Enterprise deployment of B-Viz. The intended users are the branch, trade-credit and key-account teams, who will see each trade account's orders, deliveries, calls and credit together. Answers describe how B-Viz is designed and operated. Where a control depends on the customer's own configuration, the answer says so. To be precise, nothing here is a promise beyond what the executed order form and MSA will say, and where evidence is needed beyond this document, I'll put that in writing separately.
Section A: Architecture and data location
Read the whole document (6,285 characters)
| Topic | Question | Answer |
|---|---|---|
| Where does B-Viz run? | In whose environment is the service deployed? | B-Viz is built and run inside the customer's own Snowflake account. The short answer is that your data stays in your Snowflake environment. The longer answer is that BG-Demo staff only reach it through access you grant and can withdraw. |
| Data copies | Is customer data copied to a BG-Demo platform? | The design keeps the data layer in your Snowflake account rather than in a separate BG-Demo store. Any exception would be agreed in writing before go-live. |
| Residency | Can data be held in a specific region? | Dedicated EU or US data residency is available as an add-on. It would be scoped and priced in the order form if Strensall Merchants needs it. |
| Connected systems | Which source systems can be connected? | Supported systems include Salesforce, HubSpot, Zendesk, Xero, Gong, Microsoft 365, Google Workspace, Dropbox, SharePoint, Slack and Snowflake. The Enterprise tier carries the highest connector allowance. The connector list for your deployment is agreed during implementation. |
Section B: Access control and identity
| Topic | Question | Answer |
|---|---|---|
| Single sign-on | Is SSO supported? | Yes. SSO is included in the Enterprise tier, so your staff sign in through your own identity provider. |
| User provisioning | Can accounts be created and removed automatically? | Yes. SCIM is included in the Enterprise tier, so leavers can be removed through your normal joiner and leaver process. |
| Administrator access | Who administers the deployment? | Customer administrators manage users and connectors. We recommend more than one named administrator so that a departure does not leave the deployment without an owner. |
| BG-Demo staff access | How is staff access to the customer environment controlled? | Access is limited to named people who need it for implementation or support, and is given through the customer's own Snowflake account. Hannah Lowe leads the technical work on Enterprise reviews. |
| Least privilege | Do users see data they should not? | B-Viz is designed to respect the permissions agreed for each team during implementation. We would walk your IT team through how branch, credit and key-account views are separated before anyone is switched on. |
Section C: Availability, support and service levels
| Topic | Question | Answer |
|---|---|---|
| Availability | What availability is committed? | The Enterprise tier has the highest availability commitment in our range, as written in the order form and the standard Enterprise service level. |
| Incident response | How quickly do you respond to a serious incident? | Enterprise carries the fastest first-response commitment for priority one issues in our range. The exact figure will be stated in the order form. |
| Data freshness | Is the nightly refresh covered? | The nightly refresh is expected to complete before the start of the customer's business day on business days. Enterprise is the only tier credited if freshness is missed, as well as availability. |
| Premium support | Is a named engineer available? | Premium support with a named engineer is an add-on for Enterprise, covering extended UK working hours. It can be included in the order form. |
| Sandbox | Can changes be tested safely? | A Sandbox is available as an add-on for Enterprise so that connector or permission changes can be tried before they reach live users. |
Section D: Implementation and security review support
| Topic | Question | Answer |
|---|---|---|
| Implementation | How is the deployment delivered? | Enterprise is a fixed-fee implementation that includes security review support. Hannah Lowe runs connector design and the review, and the Customer Success Manager, Daniel Okafor, takes over adoption once the service is live. |
| Architecture evidence | Can you supply diagrams? | Yes. We can provide an architecture diagram showing where each connector reads from and where processing happens, and walk your IT team through it. |
| Connector commitments | Are connector go-live dates committed? | Connectors named in the order form carry a commitment to go live within a stated number of days. |
| Training | Is on-site training available? | An on-site training day is available as an add-on. |
Section E: Items outside this document
The following are not answered in detail here, because I would rather confirm them accurately than answer loosely.
- Formal certification evidence and independent test reports: to be provided on request, with the current documents attached.
- Detailed encryption, key management and logging specifics: these follow the customer's Snowflake configuration and will be confirmed after a technical session with your IT team.
- Sub-processors and the data processing terms: these sit in the DPA and MSA that accompany the order form.
- Breach notification timing: set out in the DPA, not in this questionnaire.
Contacts
| Role | Name |
|---|---|
| Security review lead | Hannah Lowe, Solutions Engineer, BG-Demo |
| Commercial terms | Lewis Kerr, BG-Demo |
| Adoption after go-live | Daniel Okafor, BG-Demo |
If your IT team wants a follow-up on any answer above, ask and I'll put the reply in writing.
Thanks, Hannah
Unusual terms
As at Fri 9 Oct 2026- Figures deferred to order form
- Freshness credit for Enterprise only