Kielderside Growth Agency - Security Questionnaire v1
Documentdraft Kielderside Growth Agency · security questionnaire · draft · 9 Jun 2026
A draft security questionnaire for the Enterprise tier public tender, prepared by Theo Gallagher on 9 Jun 2026 for Anil Bhatt. Most answers are open. It states no availability, response time or price, and makes no statement on incidents.
What this says
As at Fri 9 Oct 2026A draft security questionnaire for the Enterprise tier public tender, prepared by Theo Gallagher on 9 Jun 2026 for Anil Bhatt. Most answers are open. It states no availability, response time or price, and makes no statement on incidents.
What it is: a draft supplier assessment for a public tender covering hosting, encryption, access control, penetration testing and incidents. It says "nothing in this document should be read as a completed control until the evidence is attached."
Commits: no service levels, prices, billing terms or connector dates. It commits Theo to chase the platform team, attach evidence and share the next version with Anil.
Unusual: hosting is only partly answered, with data staying in the customer's own Snowflake account. Dedicated EU or US residency is a priced add-on, not yet settled. Single sign-on and SCIM are tied to Enterprise.
Not settled: encryption, standing access, penetration testing, incidents in the last twelve months and certifications are all open. The document is stale as a status check: it will be superseded by a later version, and the evidence does not show one.
The document
Body
Kielderside Growth Agency - Security Questionnaire v1
Status: Draft. Not final. Answers below are marked as confirmed, partly answered or open, and nothing in this document should be read as a completed control until the evidence is attached.
| Prepared for | Anil Bhatt, Head of Digital and Information Security, Kielderside Growth Agency |
| Prepared by | Theo Gallagher, Solutions Engineer, BG-Demo |
| Commercial owner | Tom Ashdown, BG-Demo |
| Date | 9 Jun 2026 |
| Context | Public tender: Enterprise tier of B-Viz for account managers, the enquiries line and the grants team |
Purpose and scope
This questionnaire records Anil's information-security assessment of BG-Demo as a supplier in the tender. It covers five areas: hosting location, encryption, access control, penetration testing and every incident in the last twelve months. Each answer says what we can evidence today and what we cannot yet. Where an answer depends on the platform team, it is marked open until the platform team has confirmed it. We will not answer for them.
How to read the tables
Read the whole document (6,200 characters)
- Confirmed: stated by BG-Demo and supportable from how the product is built.
- Partly answered: the principle is clear, but evidence or detail is still to come.
- Open: no answer is given in this draft.
Open findings at the start
As Anil's findings are the agenda, they are listed first with an owner.
| Finding | Owner at BG-Demo | Status |
|---|---|---|
| Hosting location and residency options | Theo Gallagher | Partly answered |
| Encryption at rest and in transit | Theo Gallagher with the platform team | Open |
| Standing access to customer data | Theo Gallagher with the platform team | Open |
| Penetration testing: scope, date and findings | Theo Gallagher with the platform team | Open |
| Incidents in the last twelve months | Theo Gallagher with the platform team | Open |
| Certifications held | Theo Gallagher | Open |
Section one: Hosting location
| Question | Response (draft) | Evidence | Status |
|---|---|---|---|
| Where will Kielderside data live? | B-Viz is built and run inside the customer's own Snowflake account. The data stays in the customer's account rather than being copied to a BG-Demo environment. The location is therefore the one the customer's Snowflake account is set up in. | Architecture summary to be attached | Partly answered |
| Is dedicated regional residency available? | Dedicated EU or US data residency is a priced add-on. Whether Kielderside needs it depends on the tender requirement and has not been settled. | Add-on description to be attached | Partly answered |
| Please evidence that no data is held outside the stated location. | We will describe the data flow and which components touch data. We will not claim more than the design shows. | Data flow description to follow | Open |
Section two: Encryption
| Question | Response (draft) | Evidence | Status |
|---|---|---|---|
| How is data encrypted at rest? | To be confirmed against the Snowflake account configuration and the platform team's records. No statement is made in this draft. | Control reference to follow | Open |
| How is data encrypted in transit? | To be confirmed by the platform team. | Control reference to follow | Open |
| Who manages the keys? | To be confirmed. We will say who holds keys and whether the customer can control them. | Control reference to follow | Open |
Section three: Access control
| Question | Response (draft) | Evidence | Status |
|---|---|---|---|
| Who has standing access to customer data? | Open. We will list roles at BG-Demo that can reach a customer's Snowflake account, how access is granted and how it is removed. | Access list and approval process to follow | Open |
| How do Kielderside staff sign in? | Single sign-on and SCIM provisioning are part of the Enterprise tier. Configuration for Kielderside would be agreed during implementation. | Tier description to be attached | Partly answered |
| How is access reviewed and logged? | To be confirmed by the platform team, including how long logs are kept. | Control reference to follow | Open |
| Which certifications do you hold? | Not stated in this draft. We will list only certifications we can show a current certificate for. | Certificates, if held | Open |
Section four: Penetration testing
| Question | Response (draft) | Evidence | Status |
|---|---|---|---|
| When was the last independent penetration test? | Open. The platform team must confirm the date, the tester and the scope. | Summary report to follow | Open |
| What were the findings and are they closed? | Open. We will give the severity of findings and the dated commitment for any that remain. | Remediation record to follow | Open |
| How often is testing repeated? | Open. | Testing schedule to follow | Open |
Section five: Incidents in the last twelve months
| Question | Response (draft) | Evidence | Status |
|---|---|---|---|
| List every security incident in the last twelve months. | Open. This draft makes no statement about whether there have been incidents or how many. The platform team must confirm the full list before we answer. | Incident register extract to follow | Open |
| For each incident: impact, cause and customer notification. | Open. To be completed once the list is confirmed. | Incident reports to follow | Open |
| How are customers told about an incident? | Open. We will describe the notification route and the timescale we can commit to. | Notification process to follow | Open |
Next steps
- Theo Gallagher to ask the platform team to confirm the open answers on encryption, standing access, penetration testing and incidents.
- Theo Gallagher to attach evidence to each answer before any item is described as closed.
- Theo Gallagher to share the next version with Anil Bhatt for his review. Anil will close a finding only when the evidence satisfies him.
- Tom Ashdown to be kept informed of progress on the tender. Price is not part of this questionnaire.
Version note
Version one, draft, dated 9 Jun 2026. This will be superseded by the next version once the open answers have evidence behind them.
Thanks, Theo
Unusual terms
As at Fri 9 Oct 2026- Public tender context
- Dedicated EU or US residency as priced add-on, unsettled
- Most answers open pending platform team