Quabbin Clinical Research - Security Questionnaire
Documentfinal Quabbin Clinical Research · security questionnaire · final · 1 Feb 2026
A final security questionnaire from Hannah Lowe, dated 1 Feb 2026, answering Enterprise evaluation questions. It states the 07:00 nightly refresh but leaves availability, P1 response and US residency to the order form. Certifications and pen tests are unanswered.
What it says
What this says
As at Fri 9 Oct 2026A final security questionnaire from Hannah Lowe, dated 1 Feb 2026, answering Enterprise evaluation questions. It states the 07:00 nightly refresh but leaves availability, P1 response and US residency to the order form. Certifications and pen tests are unanswered.
What it is: a BG-Demo answer sheet prepared by Hannah Lowe for Quabbin Clinical Research, covering architecture, access, data handling and service levels for the Enterprise tier. It is an information document, not a contract.
Commits: "A nightly refresh completes by 07:00 customer local time on business days, on every tier." It also says "Enterprise credits cover both availability and data freshness" and that SSO and SCIM are included.
Unusual: nothing departs from standard terms. Availability and P1 response are deliberately not given as figures: "The exact figure is stated in the executed order form."
Not settled: third-party certifications, penetration-test results and incident-notification wording are expressly unanswered. US data residency is an add-on, "confirmed in the order form, not assumed". The document does not show whether the order form was signed or what it says.
As found in this document
As at Fri 9 Oct 2026- Nightly refreshA nightly refresh completes by 07:00 customer local time on business days, on every tier.Source: the AI read of this record
- Service creditsEnterprise credits cover both availability and data freshness.Source: the AI read of this record
- Availability and P1 responseThe exact figure is stated in the executed order form.Source: the AI read of this record
The document
Body
Quabbin Clinical Research - Security Questionnaire
Prepared by: Hannah Lowe, Solutions Engineer, BG-Demo Prepared for: Quabbin Clinical Research, Boston (account owner at BG-Demo: Jordan Pike; customer success manager: Hollie Grieve) Date: 1 Feb 2026 Tier in scope: Enterprise Status: Final
Purpose and scope
This document answers the security questions raised during the Enterprise evaluation. Quabbin Clinical Research runs clinical trials for biotech and medical-device sponsors, and it wants its sponsor-relationship, study-management and finance teams to see each sponsor's studies, issues, calls and invoices together. The answers below describe B-Viz as it would be deployed for that purpose.
To be precise, I have only answered what I can state accurately today. Where a control depends on the final order form or on Quabbin's own configuration, the answer says so, and I'll put the detail in writing once it is agreed.
Architecture and data location
Read the whole document (4,197 characters)
| Question | Answer |
|---|---|
| Where does B-Viz run? | Inside Quabbin's own Snowflake account. BG-Demo builds and operates the layer there, so the data is not copied into a separate BG-Demo data store. |
| Who owns the data? | Quabbin. The source records stay in Quabbin's systems and in its Snowflake account throughout. |
| Can data be held in a specific region? | Dedicated US data residency is available as an add-on. The region is confirmed in the order form, not assumed. |
| Which systems would be connected? | Only the systems Quabbin chooses from the supported list, for example the CRM, the helpdesk, the call recorder, the accounting system and Microsoft 365 or Google Workspace. Each connector is listed in the order form. |
Access and identity
| Question | Answer |
|---|---|
| Is single sign-on supported? | Yes. SSO and SCIM are included in the Enterprise tier. |
| How are leavers handled? | With SCIM, removing a person in Quabbin's identity system removes their access. That depends on Quabbin keeping its identity provider current. |
| Are roles separated? | Yes. Admin and standard user roles are separate, and Quabbin decides who holds admin rights. |
| Can BG-Demo staff see Quabbin data? | Only as needed to build and support the deployment, and only through access Quabbin can see and remove. The short answer is yes for named engineers during support. The longer answer is that the access sits inside Quabbin's Snowflake account, so Quabbin controls it. |
Data handling
| Question | Answer |
|---|---|
| Is data refreshed automatically? | Yes. A nightly refresh completes by 07:00 customer local time on business days, on every tier. |
| Is clinical or patient-level data needed? | No. The use case is commercial and operational: sponsors, studies, issues, calls and invoices. If Quabbin wants any source with sensitive fields excluded, we scope the connector to leave those fields out. |
| What happens at the end of the contract? | The layer sits in Quabbin's account, so Quabbin keeps its data. Removal of the BG-Demo components is agreed as part of exit planning. |
Service levels and support
| Question | Answer |
|---|---|
| What availability is offered? | The Enterprise service level. The exact figure is stated in the executed order form. |
| What is the first response for a P1 issue? | The Enterprise P1 response commitment, also stated in the order form. |
| Are there service credits? | Enterprise credits cover both availability and data freshness. |
| Is there a test environment? | The Sandbox and Premium support, with a named engineer, are part of Enterprise from the second price book. |
Items I have not answered here
I have deliberately not stated anything about third-party certifications, penetration-test results or the formal incident-notification wording. I will not answer those from memory. I will confirm each with the right internal owner and put it in writing before anyone relies on it.
Next steps
- Quabbin's security team to send any follow-up questions to Hannah.
- Hannah to answer follow-ups in writing, checking each one internally first.
- Jordan to carry the agreed controls into the order form.
Thanks, Hannah
Unusual terms
As at Fri 9 Oct 2026- Availability and P1 figures deferred to order form
- US data residency only as add-on