Fenmoor Specialty Underwriting / BB-Demo – Security Review
Callcompleted
Fenmoor Specialty Underwriting: documents · 2025-11-07 15:45
Hannah Lowe took Fenmoor's IT Security Lead Nadia Osei through encryption, keys and data location. Six written answers are owed by BB-Demo. Nadia will not sign off or set a date until her capacity providers see the full pack.
What was said
What this says
Current to 10 Oct 26Hannah Lowe took Fenmoor's IT Security Lead Nadia Osei through encryption, keys and data location. Six written answers are owed by BB-Demo. Nadia will not sign off or set a date until her capacity providers see the full pack.
What happened: Hannah Lowe ran a security review session with Nadia Osei on 7 Nov 2025. They covered where data sits, encryption at rest and in transit, key custody and deletion.
Customer view: Nadia wants evidence she can attach, not statements on a call. She welcomed answers that were held back until checked.
Commercial: Residency matters to Fenmoor more than boilerplate, so the two remaining sessions on access control and residency decide the pack. Hannah also advised deciding early on a customer-managed key.
Watch: Six items are owed in writing, and Nadia will check the Snowflake edition and the retention setting. No sign-off date exists.
Themes
Current to 9 Oct 26Theme
Encryption and key custody
Importance
neutral
Sentiment
positive
Voice
decision-maker
Who was there
BB-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Hannah Lowe sends the written answers, marking confirmed and unconfirmed items, to Nadia and copies Daniel.
- Nadia Osei checks the Snowflake edition and the retention setting and says which way Fenmoor leans on keys.
- Hannah aligns the diagram legend with the questionnaire and prepares access control and residency for the next session.
Risks
Current to 9 Oct 26- Several answers are still unconfirmed, including key-withdrawal behaviour and connector credential storage, so a slip in the written replies could stall the review.
- Whether a customer-managed key is possible depends on a Snowflake edition that neither side has confirmed.
- Residency matters more to Fenmoor than usual and is still open for the next session.
Opportunities
Current to 9 Oct 26- A clear, evidenced pack gives Fenmoor's capacity providers what they need and moves the review towards sign-off.
- Early advice on the customer-managed key option positions BB-Demo as the careful supplier in a regulated buyer's review.
Transcript
Hannah Lowe NoneHello Nadia, can you hear me alright? I've got you on my side but the audio's a touch tinny.
Nadia Osei NoneI can hear you, yes. Good afternoon, Hannah. Is it better if I switch my camera off?- Hannah Lowe NoneNo, it's cleared up now, you're fine. Afternoon. Right, before we start, what do you most need to come away with today? I've got the encryption and key management material ready, but I'd rather aim it at what you actually need.
- Nadia Osei NoneThank you, that's helpful. If you don't mind, I'll go through the open items from last time first, for the audit trail. First, you owed me the architecture diagram showing where data sits at rest. Second, the written answer on who at BB-Demo can reach customer data. Third, whether keys can be customer-managed. And fourth, I'd like to understand what is encrypted, where, and who holds the keys.
- Hannah Lowe NoneGood, that's a clean list, and it maps almost exactly onto today. The diagram went to you on Wednesday by email, so you should have it. The access question is session four, along with data residency, so I'll park that one. Today is the third and fourth of your list, really.
- Nadia Osei NoneI did receive the diagram, thank you. I have it open. I'll come back to it, because I have a couple of questions on the arrows. Can we start with the foundation, though? Where does the data physically live?
- Hannah Lowe NoneSo the short answer is, in your own Snowflake account. The longer answer is that the brain is built and run inside your account, not ours. BB-Demo doesn't keep a separate copy of your submissions, bordereaux or claims data in some environment of our own. The tables, the indexes, the embeddings, all of it sits in Snowflake under your account, under your controls.
- Nadia Osei NoneMm. And the embeddings, to be precise, are they derived data in the same account, or are they somewhere else?
- Hannah Lowe NoneSame account. To be precise, nothing derived leaves it. I'll put that in writing so it's on the record, because it's the sort of thing a capacity provider will ask.
- Nadia Osei NoneThey will. Can you evidence that? I need something I can attach, not just a statement on a call.
- Hannah Lowe NoneYes. The diagram you've got is the starting point, and I'll add a short written statement that sits beside it and says exactly that. You can also verify it yourself, because it's your account. Your own administrators can see every object the brain creates. That's probably the strongest evidence you can have.
- Nadia Osei NoneThat's a fair point, and I'd like that in the pack. Moving on to encryption at rest. What is actually doing the encrypting?
- Hannah Lowe NoneSnowflake. Data at rest in your account is encrypted by the platform, and that applies to the objects the brain creates just as it does to anything else you store there. We don't add our own layer of storage encryption on top, and I wouldn't want to suggest we do. What BB-Demo contributes is how it's configured and what it's allowed to touch.
- Nadia Osei NoneUnderstood. So the strength and the algorithm are Snowflake's attestation, not yours.
- Hannah Lowe NoneCorrect. And I'd rather you rely on their published documentation and their audit reports for that than on anything I say. I can point you to the sections, and I'll list them in the follow-up. If your supplier review needs the reports themselves, you'd normally obtain those through your own relationship with the platform.
- Nadia Osei NoneYes, we do hold that relationship. I'll pull the reports myself. That's actually cleaner for the audit trail. Now, keys. Who holds them?
- Hannah Lowe NoneBy default the platform manages a hierarchy of keys, and rotation happens on a schedule without anyone at your end or ours doing anything. Nobody at BB-Demo has the keys to your data. That's the default position.
- Nadia Osei NoneAnd the non-default position? You'll have seen from my list that my capacity providers like to see that the firm itself controls its keys, or at least can revoke them.
- Hannah Lowe NoneRight, this is where I want to be careful. There's an option for the customer to bring a key of their own that works together with the platform's, so that you can effectively cut off access by withdrawing it. Whether that's available to you depends on the edition of Snowflake you hold, and on how it's been set up. I don't know which edition Fenmoor is on, and I'm not going to guess.
- Nadia Osei NoneThat is an answer I can use. I'll find out the edition on my side. Would the brain continue to work if we withdrew a key?
- Hannah Lowe NoneThe honest answer is no, and that's the point of it. If the key were withdrawn, the data would be unreadable and the brain would have nothing to answer from. It would fail closed. What I'd like to do is confirm exactly how it behaves, what the user sees, and how it recovers when the key comes back, before I describe it to you in detail. I'll check that with a colleague in security and put it in writing.
- Nadia Osei NoneThank you. Please include recovery time, if it's known. Not a promise, just what has been observed.
- Hannah Lowe NoneI'll say what's observed and what's expected, and keep the two separate. That seems the right way to do it.
- Nadia Osei NoneGood. Next, data in transit. Between your connectors and Snowflake, and between the browser and the brain.
- Hannah Lowe NoneEverything goes over encrypted connections, using current versions of TLS, and unencrypted connections aren't accepted. The connectors pull from your sources, so Salesforce, Zendesk, Microsoft 365 and the rest, over the sources' own encrypted interfaces, and then write into Snowflake. Between the user's browser and the brain it's the same.
- Nadia Osei NoneI noticed on the diagram that the connectors have a box of their own. What do they hold? Specifically credentials.
- Hannah Lowe NoneGood, I was hoping you'd ask, because it's the part I'd rather not answer from memory. Each connector needs some form of credential for the source system. How those are stored, who can read them, and how they rotate are exactly the sort of detail that has to be right first time. Let me take it as an action, check with our security colleague, and give you a written answer instead of a half-remembered one.
- Nadia Osei NoneThat is entirely acceptable. I'd rather wait for the right answer. I'll note it as item five. And I'll need that in the questionnaire, not in an email on its own.
- Hannah Lowe NoneUnderstood, it goes straight into the questionnaire, with the email as a cover note. Do you want to give me the reference for the question so I put it in the right place?
- Nadia Osei NoneIt's the section headed key custody. Give me a moment, I'm just scrolling. Yes, key custody and rotation. There are three sub-questions underneath.
- Hannah Lowe NoneRight, I've got it. While you're there, can I read back what I think the three are, so we're not talking at cross purposes? Who generates the keys, who can rotate or revoke them, and what evidence exists that rotation actually happens.
- Nadia Osei NoneAlmost. The third one is worded slightly differently. It asks what evidence can be produced to a third party on request. That's the audit angle. The capacity providers don't want to take our word for it.
- Hannah Lowe NoneThat's a better question than the one I read back. So evidence that can be handed to a third party. The platform's own reporting would be the main route there, and I'll say so plainly rather than inventing something of ours.
- Nadia Osei NoneThank you. Now, a related point on backups and deletion. If we ask for the brain to be removed, what happens to the data and the keys?
- Hannah Lowe NoneBecause it all sits in your account, removal is largely something you control. We'd decommission the brain's objects and connectors, and you'd retain or delete your data under your own policy. I should be careful about retention windows, though, because the platform has its own recovery features and those apply to your account's settings, not to anything BB-Demo decides.
- Nadia Osei NoneSo the retention is governed by our configuration.
- Hannah Lowe NoneYes. And I'd suggest your team looks at what that's currently set to, because I haven't seen it and wouldn't want to claim a number.
- Nadia Osei NoneNoted. I'll check it. Let me ask about something slightly different, and tell me if it's session four. Logging. If somebody queried the brain and retrieved something they shouldn't, would we see the key being used?
- Hannah Lowe NoneThat's partly session four, and I don't want to blur it, so let me answer the key part only. Access to data is recorded by the platform in your account, and your administrators can see it. Whether that is granular enough to show key usage specifically, I'd want to check. I'll add it to the list.
- Nadia Osei NonePlease do. Again, evidence. I appreciate that you're not stretching to answer.
- Hannah Lowe NoneIt's not worth anyone's time otherwise. If I overstated a control and your auditors found it, that would be worse for both of us than a slower answer.
- Nadia Osei NoneQuite. Now, one more on the architecture. Does the embedding step ever send content outside the account, to be processed?
- Hannah Lowe NoneAnother one to be precise about. The design intent is that processing happens inside your Snowflake account. I want the written answer to name exactly which steps run where, so rather than say a flat no now, I'll confirm it against the design and return it with the diagram annotated. If there is any step that doesn't, you'll see it flagged.
- Nadia Osei NoneThat is how I'd want it handled. Annotated, step by step. I'll list it as item six.
- Hannah Lowe NoneFine. That's six now. Can I just play the list back so we agree it? One, the written statement on where derived data sits. Two, the customer-managed key option, subject to your edition. Three, the behaviour when a key is withdrawn, and recovery. Four, how connector credentials are stored and rotated. Five, whether key usage is visible in the logs. Six, the annotated diagram showing where processing runs.
- Nadia Osei NoneThat's right, though I'd renumber, because the access question from last time is still open, and I want the audit trail to keep the original numbers intact. I'll keep the old ones and number yours continuing from where mine finish.
- Hannah Lowe NoneSensible. Then you own the numbering and I'll follow yours. It stops us creating two versions of the list.
- Nadia Osei NoneThank you. Let me also be clear about timing, so there's no misunderstanding. I can't sign anything off today, and I wouldn't set a date for sign-off until the capacity providers have seen the full pack. They'll want to review this in one go.
- Hannah Lowe NoneThat's absolutely fine, and it's what we'd planned for. There are two more sessions. The next one is access control and data residency, and the last one is the wrap-up, where we pull everything into the pack. Nobody's asking for a sign-off on a verbal answer.
- Nadia Osei NoneGood. On residency, can I flag now that it matters to us more than the usual boilerplate suggests? The capacity providers ask where data is held, and the honest answer for us depends on which region the account sits in.
- Hannah Lowe NoneUnderstood, and thank you for flagging it. It's the region of your Snowflake account, which you control, so I'd come to the next session with that spelled out. I'll also be clear about what BB-Demo staff can see when they support the brain, because that's the other half of the residency question.
- Nadia Osei NoneYes, that's the half I care about. Right. I think I have what I need from my side on encryption, at least for the questions I came with. Is there anything you'd flag that I haven't asked?
- Hannah Lowe NoneOne thing, and it's more of a suggestion. Decide early whether you want the customer-managed key option, because it's much easier to design in than to retrofit once the brain has been running a while. If you can tell me which way you're leaning once you've checked the edition, I can make sure the written answers cover both cases.
- Nadia Osei NoneThat's useful. I'll take that to our own people and revert. I'd expect to know the edition quickly, within a few days, and the decision may take longer.
- Hannah Lowe NoneThat's fine. I'll aim to get the written answers to you next week, so you have them before the next session, and I'll say clearly in the email which items are confirmed and which are still being checked.
- Nadia Osei NoneThank you, Hannah. And would you copy Daniel on it? He's been very good at keeping the thread together on our side and I'd like him to have the paper trail too.
- Hannah Lowe NoneOf course. I'll copy Daniel and keep everything on the one thread, so it can be found later.
- Nadia Osei NoneLovely. I think that's everything. Oh, one small thing. The diagram's legend uses a different symbol for external sources than the one in the questionnaire. Would you align them? Auditors do notice.
- Hannah Lowe NoneYes, I'll make them match. Fair point, and exactly the kind of thing that costs a reviewer ten minutes of confusion. Thanks for catching it.
- Nadia Osei NoneNot at all. Then let me close the loop on my list. Items one and two from last time are answered or parked to session four. Three and four are open pending your written answers and the edition check. Five and six are yours. Does that match your notes?
- Hannah Lowe NoneIt matches. I'll send the written answers and the annotated diagram, and I'll say which ones I've checked with our security colleague. You'll check the edition and the retention setting. Next session, access control and residency.
- Nadia Osei NoneAgreed. Thank you for not rushing the answers. It makes my side easier.
- Hannah Lowe NoneThank you, it's a proper review and it should feel like one. Same time for the next session, I think, but I'll confirm by email.
- Nadia Osei NoneKind regards, Hannah. Speak soon.
Callsmade from