Fenmoor Specialty Underwriting - Security Questionnaire
Documentfinal Fenmoor Specialty Underwriting: documents · security_questionnaire · final · 2024-04-11
B-Brain's answers to Fenmoor's security review of the Growth tier, dated 11 Apr 2024 and marked final. It is a pre-contract disclosure, not an order form, and says contractual security terms sit in the executed order form.
What it says
What this says
Current to 10 Oct 26B-Brain's answers to Fenmoor's security review of the Growth tier, dated 11 Apr 2024 and marked final. It is a pre-contract disclosure, not an order form, and says contractual security terms sit in the executed order form.
What it is: a security questionnaire prepared by Tobias Renwick, Chief Technology Officer and Co-founder, for Fenmoor's security and operations reviewers. It covers architecture, access control, data handling and incident response for the Growth tier.
Commits: it is explicitly subordinate to the paper. "Contractual security commitments are set by the executed order form under the MSA and take precedence over this questionnaire." Stated service points are one business hour P1 first response and a nightly refresh by 07:00 customer local time on business days.
Unusual: nothing off standard terms. It candidly flags that SSO and SCIM are Enterprise only, and that Sandbox, regional residency and Premium support are add-ons not in Growth.
Not settled: it states no certification, audit report or penetration-test summary, and says these must be requested separately. Open points on Sandbox, residency, first connectors and named administrators were unanswered in this document. It is dated 2024, so check it against the current order form.
As found in this document
Current to 9 Oct 26- P1 first responseOne business hour on Growth.Source: object_read:doc_001_001
- Data freshnessThe nightly refresh completes by 07:00 customer local time on business days, on every tier.The nightly refresh completes by 07:00 customer local time on business days, on every tier. · Source: object_read:doc_001_001
- Service creditsService credits on Growth apply to availability only, not to data freshness.Service credits on Growth apply to availability only, not to data freshness. · Source: object_read:doc_001_001
The document
Body
Fenmoor Specialty Underwriting - Security Questionnaire
Status: Final Date: 11 Apr 2024 Prepared by: Tobias Renwick, Chief Technology Officer and Co-founder, B-Brain Prepared for: the security and operations reviewers at Fenmoor Specialty Underwriting Tier under discussion: Growth
Purpose and scope
Fenmoor Specialty Underwriting is a City managing general agent writing marine cargo and professional indemnity for Lloyd's syndicates. Its underwriting operations team wants one view of submissions, bordereaux queries, claims tickets and CRM activity, so that it can answer capacity providers' oversight questions. This questionnaire records how B-Brain answers the security questions raised during review of the Growth tier.
To be precise, the answers describe the product as it is built today. Where an answer depends on how Fenmoor configures its own Snowflake account, we say so rather than claim a control that is not ours to give.
Section A - Architecture and data location
Read the whole document (5,215 characters)
| Question | Answer |
|---|---|
| Where does the brain run? | Inside the customer's own Snowflake account. B-Brain does not copy the customer's data into a separate B-Brain data store. |
| Who owns the data held in the brain? | The customer. The brain is built and run on the customer's warehouse and remains under the customer's controls. |
| Which source systems can be connected? | Systems such as Salesforce, HubSpot, Zendesk, Xero, Gong, Microsoft 365, Google Workspace, Dropbox, SharePoint and Slack. Fenmoor chooses which sources are connected, within the Growth connector allowance. |
| Is a separate environment used for testing? | A Sandbox is an add-on and is not part of the Growth tier. It would need to be agreed in the order form. |
| Can data be held in a specific region? | Dedicated EU or US data residency is an add-on. Fenmoor is a UK organisation, and the brain sits in whichever region its Snowflake account is in. |
Section B - Access control
| Question | Answer |
|---|---|
| How do users get access? | Through accounts managed in the brain by the customer's administrators. Growth is aimed at several teams, so we recommend Fenmoor nominates more than one administrator. |
| Is single sign-on supported? | Single sign-on and SCIM provisioning are part of the Enterprise tier, not Growth. The honest answer is that Growth users are managed directly in the product. |
| Can access be limited by team or role? | Access to data follows the permissions the customer sets in its Snowflake account and the connected source systems. The trade-off is that the brain can only show what the connecting role is allowed to read. |
| Does B-Brain staff access customer data? | Only as needed to build, support and run the brain, and within the access the customer grants in its own account. The customer can withdraw that access. |
Section C - Data handling
| Question | Answer |
|---|---|
| Is data encrypted? | Encryption at rest and in transit is provided by the customer's Snowflake account and the platform it runs on, as configured by Fenmoor. |
| How fresh is the data? | The nightly refresh completes by 07:00 customer local time on business days, on every tier. Availability and freshness are separate measures. |
| What happens to data if the contract ends? | Because the data lives in the customer's own account, it stays there. B-Brain's components and access are removed on exit. The detail belongs in the order form and the data processing terms. |
| Is customer data used to train models for other customers? | No. Each brain is built and run in its own customer's account, and nothing is shared across customers. |
Section D - Service and incident response
| Question | Answer |
|---|---|
| What availability applies? | The Growth service level for availability. Service credits on Growth apply to availability only, not to data freshness. |
| What is the first response for a priority-one issue? | One business hour on Growth. |
| How are incidents reviewed? | Through a blameless review that sets out the timeline, impact, cause and actions, shared with the affected customer. |
| Who is the named contact? | Fenmoor's account owner is Priya Raman and its customer success manager is Daniel Okafor. Named-engineer support is the Premium support add-on and is not part of Growth. |
Section E - Items outside this questionnaire
- Any certification, audit report or penetration-test summary that the reviewers require is not stated here. We will not assert something this document cannot evidence, and any such material should be requested separately.
- Contractual security commitments are set by the executed order form under the MSA and take precedence over this questionnaire.
- Fenmoor's own controls over Snowflake, its CRM and its helpdesk remain Fenmoor's responsibility.
Open points for the reviewers
- Confirm whether the Sandbox or regional residency add-ons are wanted before the order form is drafted.
- Confirm which source systems will connect first, so the connector commitments in the order form are realistic.
- Confirm the named administrators on the Fenmoor side.
Anything further, send it to me directly.
Best, Tobias