Duddingston Payroll - Security Questionnaire
Documentfinal Duddingston Payroll · security questionnaire · final · 8 Nov 2024
Hannah Lowe's answers to Duddingston Payroll's security questions, dated 8 Nov 2024, for the Growth tier. It states a nightly refresh by 07:00 on business days and leaves the availability figure and P1 response time to the order form. No price is stated.
What it says
What this says
As at Fri 9 Oct 2026Hannah Lowe's answers to Duddingston Payroll's security questions, dated 8 Nov 2024, for the Growth tier. It states a nightly refresh by 07:00 on business days and leaves the availability figure and P1 response time to the order form. No price is stated.
What it is: a completed pre-sale security questionnaire, marked Final, covering architecture, access control, freshness and availability for a payroll bureau evaluating Growth. It says B-Viz runs "Inside Duddingston Payroll's own Snowflake account".
Commits: the only firm service term is "A nightly refresh is completed by 07:00 customer local time on business days, on every tier." Availability and P1 response are described only as the standard Growth commitments, with no figures.
Unusual: nothing off standard terms. It flags that SSO, SCIM, the Sandbox and dedicated data residency are not in Growth.
Not settled: the exact availability figure, which "will be stated in the order form". Certification evidence, penetration testing summaries, staff vetting and incident-notification wording are left for follow-up. Role design for client managers is to be agreed during implementation. It is not a contract and is from 2024, so check it against any executed order form.
As found in this document
As at Fri 9 Oct 2026- Data refreshA nightly refresh is completed by 07:00 customer local time on business days, on every tier.Source: the AI read of this record
Body
Duddingston Payroll - Security Questionnaire
Status: Final Completed by: Hannah Lowe, Solutions Engineer, BG-Demo Date: 8 Nov 2024 Prospect: Duddingston Payroll, Edinburgh Tier under evaluation: Growth
1. Purpose and scope
This questionnaire records BG-Demo's answers to the security questions raised by Duddingston Payroll while it evaluates B-Viz on the Growth tier. Duddingston Payroll is an outsourced payroll and HR-administration bureau, so the questions concentrate on how employer and employee data is stored, who can see it and how it is kept current. To be precise, the answers describe the product as it stands for the Growth tier. Where a control belongs to another tier or to a paid add-on, the answer says so.
2. Architecture and data location
Read the whole document (4,150 characters)
| # | Question | Answer |
|---|---|---|
| 1 | Where does B-Viz run? | Inside Duddingston Payroll's own Snowflake account. BG-Demo builds and runs the layer there, so the data does not move to a BG-Demo-owned data store. |
| 2 | Who owns the data? | Duddingston Payroll. B-Viz indexes the connected systems but the customer remains the owner of the source data and of the Snowflake account. |
| 3 | Can data be held in a specific region? | The short answer is yes, as a paid add-on: dedicated EU or US data residency. It is not part of the Growth tier as standard, and nothing is assumed in this document. |
| 4 | Which systems can be connected? | Typical sources are a CRM, the call recorder, mailboxes, the helpdesk and the accounting system. The Growth tier has a connector allowance, and the connectors to be used will be agreed in the order form. |
3. Access control
| # | Question | Answer |
|---|---|---|
| 5 | How is user access managed? | Users are added by the customer's administrators. Access to the underlying data follows the permissions set in the customer's Snowflake account. |
| 6 | Is single sign-on available? | SSO and SCIM are part of the Enterprise tier, not Growth. Growth users sign in with the standard method. If Duddingston Payroll needs SSO, an Enterprise discussion is the route. |
| 7 | Is there a separate test environment? | The Sandbox is available from the second version of the Enterprise tier. It is not included in Growth. |
| 8 | Can client managers see all employers? | Visibility is governed by the permissions the customer configures. We recommend agreeing the role design during implementation, and I will put that in writing before go-live. |
4. Data freshness and availability
| # | Question | Answer |
|---|---|---|
| 9 | How often is data refreshed? | A nightly refresh is completed by 07:00 customer local time on business days, on every tier. |
| 10 | What availability is committed? | The Growth tier carries the standard Growth availability commitment, with service credits for availability only. The exact figure will be stated in the order form. |
| 11 | What support response applies to a priority incident? | The Growth tier carries the standard Growth first-response time for the highest priority. Premium support with a named engineer is an optional add-on. |
5. Items outside this questionnaire
The longer answer on the following is that I will not state a control I have not verified. Where a question needs input from our security lead, I check with Ewan before answering, and I will put the result in writing.
- Independent certification evidence and audit reports.
- Penetration testing summaries.
- Staff vetting and internal policy documents.
- Detailed incident-notification wording for a payroll customer's own regulatory duties.
Duddingston Payroll's team should send any of these as follow-up questions and they will be answered separately.
6. Summary for the evaluation team
- B-Viz runs inside the customer's Snowflake account, which keeps data under the customer's own controls.
- Growth does not include SSO, SCIM, the Sandbox or dedicated data residency. Each can be discussed as an upgrade or add-on.
- Freshness is a nightly commitment on business days. Availability and freshness are separate things, and Growth credits are for availability only.
Thanks, Hannah