Stanedge Healthcare - Security Questionnaire
Documentfinal Stanedge Healthcare · security questionnaire · final · 19 Mar 2026
Completed 19 Mar 2026 by Hannah Lowe for a prospect evaluating Enterprise. It states no figures: availability, P1 response and price are not given. The prospect did not proceed, so no order form exists and no recurring revenue.
What this says
As at Fri 9 Oct 2026Completed 19 Mar 2026 by Hannah Lowe for a prospect evaluating Enterprise. It states no figures: availability, P1 response and price are not given. The prospect did not proceed, so no order form exists and no recurring revenue.
What it is: a final, version 1 questionnaire answering Stanedge Healthcare's security questions for B-Viz Enterprise, covering architecture, access control, patient data, service levels and incident handling. It is a record of answers given, not a contract.
Commits: nothing binding. Service levels are described only by reference, for example "The Enterprise availability level, which is the highest of the three tiers." Credits are described as applying "for both availability and data freshness" on Enterprise.
Unusual: C2 leaves NHS accreditation open: "Not stated in this document." Clinical systems would need their own review (C1).
Not settled: the document gives no availability percentage, response time, price or contract terms, and says contract detail sits elsewhere. Section 7 says Stanedge "did not proceed", so answers should be re-checked before any reuse.
The document
Body
Stanedge Healthcare - Security Questionnaire
Status: Final, version 1 Completed: 19 Mar 2026 Prepared by: Hannah Lowe, Solutions Engineer, BG-Demo Account owner: Tom Ashdown Tier evaluated: Enterprise Organisation: Stanedge Healthcare, Sheffield (prospect)
1. Purpose and scope
This document answers the security questions raised by Stanedge Healthcare while it evaluated B-Viz Enterprise for its insurer-relations and patient-services teams. Answers describe the product as it is offered to Enterprise customers. Where a control depends on the customer's own environment, the answer says so. Where an answer needs written confirmation beyond this document, it is marked as such, and Hannah will put that in writing.
2. Architecture and data location
Read the whole document (4,896 characters)
| Ref | Question | Answer |
|---|---|---|
| A1 | Where does B-Viz run? | Inside the customer's own Snowflake account. BG-Demo builds and runs the layer there, so the data is not copied into a separate BG-Demo platform. |
| A2 | Who controls the underlying data? | The customer. The source systems and the Snowflake account remain under the customer's administration. |
| A3 | Can data residency be fixed to the UK, EU or US? | Dedicated EU or US data residency is available as an add-on. For a UK customer, residency follows the region of the customer's own Snowflake account. |
| A4 | Which systems can be connected? | Systems such as Salesforce, HubSpot, Zendesk, Xero, Gong, Microsoft 365, Google Workspace, Dropbox, SharePoint and Slack. Enterprise includes the highest connector allowance of the three tiers. |
3. Access control
| Ref | Question | Answer |
|---|---|---|
| B1 | Is single sign-on supported? | Yes. SSO and SCIM provisioning are included in Enterprise. |
| B2 | Can user accounts be removed automatically when staff leave? | Yes, through SCIM, provided the customer's identity provider is configured to send those changes. |
| B3 | Can access be limited by team? | To be precise, access follows the roles and permissions set in the customer's Snowflake account and in B-Viz. The exact role design is agreed during implementation. |
| B4 | Does BG-Demo staff access customer data? | Only as needed to build and support the service, and only through access the customer grants. The detail of that arrangement is set out in the contract, not in this questionnaire. |
4. Healthcare and patient data
| Ref | Question | Answer |
|---|---|---|
| C1 | Will B-Viz hold patient clinical records? | The short answer is that this depends on which sources Stanedge chooses to connect. The longer answer is that the evaluation focused on insurer-relations and patient-services data, and any connection of clinical systems would need its own review before agreement. |
| C2 | Does BG-Demo hold any NHS-specific accreditation? | Not stated in this document. BG-Demo will confirm its position in writing if Stanedge asks for it, rather than answer from memory here. |
| C3 | Can personal data be excluded from indexing? | Connectors are configured per source, so a source or a category of content can be left out. Field-level exclusion would be scoped during design. |
5. Availability, freshness and support
| Ref | Question | Answer |
|---|---|---|
| D1 | What availability is committed? | The Enterprise availability level, which is the highest of the three tiers. |
| D2 | How fast is a first response to a critical incident? | The Enterprise response time, which is the fastest of the three tiers. |
| D3 | How fresh is the data? | The nightly refresh completes before the start of the business day, customer local time, on business days. |
| D4 | Are there service credits? | On Enterprise, credits apply for both availability and data freshness. |
| D5 | Is there a test environment? | The Sandbox and Premium support, with a named engineer, are part of Enterprise from the second version of the offering. |
6. Incident and change handling
| Ref | Question | Answer |
|---|---|---|
| E1 | How are incidents communicated? | Affected customers are told through their support channel and their named contacts. Timings and content are agreed in the contract. |
| E2 | How are product changes released? | Release notes are shared with customers. Changes that affect a connected source are discussed with the customer's administrators first. |
7. Open items and outcome
- Written confirmation of accreditation status (C2) was offered but not requested before the evaluation closed.
- Any clinical-system connection (C1) would have required a separate review.
- Stanedge Healthcare evaluated Enterprise and did not proceed. No order form was signed and no contracted recurring revenue exists.
- This questionnaire is kept as a record of answers given on 19 Mar 2026. Should Stanedge return, the answers should be re-checked against the current product before reuse.
Thanks, Hannah
Unusual terms
As at Fri 9 Oct 2026- NHS accreditation not stated
- Clinical systems need separate review