Eccup Software - Security Questionnaire
Documentfinal Eccup Software · security questionnaire · final · 27 Feb 2024
Final version 1 security questionnaire prepared by Tobias Renwick on 27 Feb 2024 for a Growth tier discussion. It is descriptive, not a contract: it states no availability %, P1 time or price, and defers service levels to the order form.
What it says
What this says
As at Fri 9 Oct 2026Final version 1 security questionnaire prepared by Tobias Renwick on 27 Feb 2024 for a Growth tier discussion. It is descriptive, not a contract: it states no availability %, P1 time or price, and defers service levels to the order form.
What it is: BG-Demo's written answers to the customer's security team, prepared by Tobias Renwick, Chief Technology Officer and Co-founder. It says B-Viz is "built and run inside your Snowflake account", so storage, retention and deletion sit under the customer's controls.
Commits: the nightly refresh "completes before the start of the business day on business days, on every tier". BG-Demo will notify named contacts "as soon as we have confirmed that your deployment is affected".
Unusual: nothing off standard terms. SSO and SCIM are Enterprise only, and data residency and Premium support are add-ons, not Growth as standard.
Not settled: availability and P1 response are only "the standard Growth service level, set out in the order form", so no figures are given here. Source systems in scope, residency and SSO are listed as open items, and the document does not show how they were resolved.
As found in this document
As at Fri 9 Oct 2026- Nightly refreshcompletes before the start of the business day on business days, on every tierSource: the AI read of this record
- AvailabilityThe standard Growth service level, set out in the order form.Source: the AI read of this record
- P1 first responseThe standard Growth first-response commitment applies to priority one issues.Source: the AI read of this record
- Incident notificationWe will tell your named contacts as soon as we have confirmed that your deployment is affected.Source: the AI read of this record
Body
Eccup Software - Security Questionnaire
Status: Final, version 1 Prepared for: Eccup Software, Leeds Prepared by: Tobias Renwick, Chief Technology Officer and Co-founder, BG-Demo Date: 27 Feb 2024 Tier under discussion: Growth
About these answers
Eccup Software builds care-planning and compliance software for social-care providers, so we expect your security team to read this carefully. To be precise, the answers below describe how B-Viz is designed to run for a Growth customer. Where an answer depends on a choice your team makes in your own Snowflake account, we say so rather than promise an outcome on your behalf.
The short version is that B-Viz is built and run inside your Snowflake account. The trade-off is that you carry more of the control, and we carry less of the custody.
1. Architecture and data location
Read the whole document (4,693 characters)
| # | Question | Answer |
|---|---|---|
| 1.1 | Where does B-Viz run? | Inside the customer's own Snowflake account. BG-Demo does not move your data into a separate BG-Demo platform. |
| 1.2 | Who controls the storage? | You do. Storage, retention and deletion sit under your Snowflake controls. |
| 1.3 | Can we choose a data region? | Your Snowflake account's region applies. Dedicated EU or US data residency is a separate add-on and is not part of the Growth tier as standard. |
| 1.4 | Is customer data used to serve other customers? | No. Each deployment is built for one customer's account. |
2. Connectors and source systems
| # | Question | Answer |
|---|---|---|
| 2.1 | Which systems can be connected? | Systems such as Salesforce, HubSpot, Zendesk, Xero, Gong, Microsoft 365, Google Workspace, Dropbox, SharePoint and Slack. The Growth tier has a fixed connector allowance. |
| 2.2 | How is access to a source system granted? | Through credentials your own administrators create and can revoke at any time. |
| 2.3 | What scope do connectors need? | The honest answer is that it depends on what you want to ask B-Viz. We recommend the narrowest read access that answers your use case, and we will go through each connector with your team. |
3. Access control
| # | Question | Answer |
|---|---|---|
| 3.1 | How do our staff sign in? | Through the access methods available in your Snowflake account and the B-Viz application. |
| 3.2 | Is single sign-on included? | SSO and SCIM are Enterprise features and are not included in Growth. |
| 3.3 | Can we restrict who sees which data? | Yes. Role-based restrictions are applied in your Snowflake account, and B-Viz answers only from what a user's role may read. |
| 3.4 | Who at BG-Demo can see our data? | Only staff working on your deployment, and only where you grant access to your account. You can withdraw that access at any time. |
4. Data protection
| # | Question | Answer |
|---|---|---|
| 4.1 | Is data encrypted? | Encryption at rest and in transit is provided by the Snowflake platform and the connectors' own transport. We rely on those controls and do not replace them. |
| 4.2 | Is personal data processed? | Potentially, because your tickets, calls and emails may contain personal data about providers and their staff. A data processing agreement sits alongside the order form. |
| 4.3 | Can records be deleted? | Yes. Because the data sits in your account, deletion follows your own retention rules. |
5. Availability and support
| # | Question | Answer |
|---|---|---|
| 5.1 | What availability level applies? | The standard Growth service level, set out in the order form. |
| 5.2 | How quickly do you respond to a serious incident? | The standard Growth first-response commitment applies to priority one issues. |
| 5.3 | How fresh is the data? | The nightly refresh completes before the start of the business day on business days, on every tier. |
| 5.4 | Is a named engineer available? | Premium support is an add-on and is not part of Growth as standard. |
6. Incident handling
| # | Question | Answer |
|---|---|---|
| 6.1 | How are incidents reviewed? | We run blameless reviews, record the timeline, impact and cause, and agree actions with the affected customer. |
| 6.2 | Will you notify us of an incident affecting our deployment? | Yes. We will tell your named contacts as soon as we have confirmed that your deployment is affected. |
Open items for your team
- Confirm which source systems are in scope for the first phase.
- Confirm whether regional data residency is a requirement, since that would change the scope.
- Confirm whether single sign-on is a requirement, since that points to the Enterprise tier.
If your security team wants more detail on any line, ask and we will answer in writing.
Best, Tobias