Quillmark Health / BB-Demo – Discovery
Callcompleted
Quillmark Health: documents · 2026-03-09 15:30
Discovery call on a possible Enterprise engagement. Ben Kowalski described the client-services gap; CISO Megan Alvarez set out written-only security requirements. Nothing is approved and no security documentation had been sent.
What was said
What this says
Current to 10 Oct 26Discovery call on a possible Enterprise engagement. Ben Kowalski described the client-services gap; CISO Megan Alvarez set out written-only security requirements. Nothing is approved and no security documentation had been sent.
What happened: Jordan Pike ran a 30-minute discovery call with Ben Kowalski and Megan Alvarez. Ben described client-services answers scattered across five places; Megan put five numbered security questions and asked for written answers.
Customer view: Ben wants a usable layer on their Snowflake estate and cares that it is Snowflake-native. Megan will not approve verbally and wants completeness with no best-effort language.
Commercial: Jordan gave a planning figure of one hundred and fifty-five thousand pounds including implementation, stated as not a quote. Ben said it goes to procurement and Megan said it does not influence security review.
Watch: Megan would not commit to a date, and the board risk committee receives the review outcome. The solutions engineer owes written answers on data residency, access, incidents and controls.
Themes
Current to 9 Oct 26Theme
Enterprise discovery, security review
Importance
neutral
Sentiment
mixed
Voice
decision-maker
Who was there
BB-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Jordan Pike to send a recap the same day.
- Solutions engineer to send written answers to Megan's numbered questions, including incident disclosure and access.
- Jordan Pike and Ben Kowalski to schedule a demo for the client-services leads.
Risks
Current to 9 Oct 26- Security review is a gate with no committed date, and the CISO will not approve verbally.
- Any incident or control gap not stated plainly in writing could damage trust with the CISO.
- The planning figure was floated before procurement has seen anything in an order form.
Opportunities
Current to 9 Oct 26- Enterprise fits company-wide client-services use, with SSO, SCIM and security review support in implementation.
- Snowflake-native design answers Ben's concern about copying data elsewhere.
Transcript
Jordan Pike NoneHi, Ben. Hi, Megan. Good afternoon. Thanks for making the time. I'll keep an eye on the clock: we have thirty minutes, and the agenda is simple. First, Ben gives me the problem in his own words. Second, Megan tells us what she needs to see from a vendor. Third, next steps.
Ben Kowalski NoneHey, Jordan. Afternoon, Megan. Quick one, it's finally stopped raining here, so we're all in a good mood. Which is rare.
Megan Alvarez NoneGood afternoon. For the record, I have the invite for scope and I'd like to restate it so we're aligned: this is a discovery conversation about a possible Enterprise engagement, nothing has been approved, and I have not yet seen any security documentation. Is that correct, Jordan?- Jordan Pike NoneThat's correct. Nothing's approved, and to be transparent, you haven't seen our security documentation because we haven't sent it. I'd like to fix that today by agreeing what you want.
- Megan Alvarez NoneThank you. Ben, please begin.
- Ben Kowalski NoneSure. So the pain is client services. We run revenue-cycle work for hospital groups, and when somebody asks how a hospital client is doing, the answer lives in five places. CRM, ticket system, call recordings, a couple of spreadsheets, and my team's heads. We built our Snowflake estate and we just don't have the layer that makes it usable by non-engineers.
- Jordan Pike NoneAnd when you say usable, who's the person you're picturing?
- Ben Kowalski NoneA client-services lead. Smart, not technical. They need to ask, 'what's going on with this account,' and get an answer they can trust. Right now they ask me. This is exactly the gap.
- Jordan Pike NoneWhat have you tried so far?
- Ben Kowalski NoneDashboards, mostly. They go stale. Someone leaves, nobody maintains them, and then they're wrong and everyone knows. Plus nobody wants another tool that copies our data off somewhere. Which is why Snowflake-native matters to me.
- Megan Alvarez NoneI will come to that point. May I ask a first question here, Ben?
- Ben Kowalski NonePlease. That's why you're here.
- Megan Alvarez NoneJordan, I have several numbered questions. One: where does the data physically reside when your product operates, and does any patient-related data leave our environment? Two: what access does your staff have to that environment? Three: please describe any incidents in the last ninety days. Four: which controls are certified, as opposed to planned?
- Jordan Pike NoneOkay. Let me take those in order, and I'll tell you what I can answer and what I can't. On one, the brain is built and runs inside your own Snowflake account. That's how it's designed. The details of exactly what is and isn't processed outside it, I'm not going to give you from memory.
- Megan Alvarez NoneI would not want that given from memory. I require it in writing.
- Jordan Pike NoneUnderstood, and you'll get it in writing from our solutions engineer, who handles every Enterprise security review. On two, access, same answer: written, with roles. On three, incidents. I'm a salesperson, so I'm not the right person to attest to that, and I won't give you a verbal answer for the record. You'll get a written statement.
- Megan Alvarez NoneNoted. And I would prefer a statement that is complete, rather than a statement that is reassuring. If there has been an incident, I want to hear it from you before I find it.
- Jordan Pike NoneThat's how I'd want it handled too. If there's something, you'll hear it from us first. Never from a third party.
- Ben Kowalski NoneCan I jump in? I don't want this to sound like we're against it. I just want the process to run. Megan, is it fair to say the first thing is a questionnaire?
- Megan Alvarez NoneIt is one input. Our risk posture requires a documented review, and the board risk committee receives the outcome. I will not give approval verbally in any meeting, to anyone.
- Ben Kowalski NoneRight. Which is fine. I'm not asking you to.
- Jordan Pike NoneWhat would make this a yes, Megan? Not your answer, I mean, what would you need to see?
- Megan Alvarez NoneI will not share how the review is scored. What I can say is that I want completeness, written evidence, and no best-effort language. If the answer is that something is not yet in place, I want it stated as such.
- Jordan Pike NoneGot it. Then I'd rather tell you now what I know. I can say the Enterprise tier includes single sign-on and SCIM, and a security review support step in the implementation. What I can't tell you today is every control and its status. That comes from the questionnaire.
- Megan Alvarez NonePlease send the questionnaire response in a form we can annotate. And please include the process by which you disclose incidents to customers.
- Jordan Pike NoneI'll add that to the list. Anything else on that front?
- Megan Alvarez NoneFive. Please confirm who within your organisation is accountable for security, by role, and who would be our contact during an incident.
- Jordan Pike NoneWritten, by role. Yes.
- Ben Kowalski NoneJordan, can I ask the thing I'd normally ask? What does the shape of the deal look like? Not price, that's for our procurement lead, just the scope.
- Jordan Pike NoneSure. Scope first. Enterprise, company-wide use for client services, a first set of connectors from your CRM, ticketing and call recordings, and a twelve-week implementation with security review support. The total deal value we've sketched is one hundred and fifty-five thousand pounds, implementation included. To be clear, that's a planning figure, not a quote, and the number your procurement team sees will come in an order form.
- Ben Kowalski NoneGot it. I'm not going to react to that. It goes to procurement. I just wanted Megan to hear the shape.
- Megan Alvarez NoneI noted it only as scope context. It does not influence security review.
- Jordan Pike NoneGood. That's how it should work.
- Ben Kowalski NoneOkay, next steps? I've got a hard stop in a few minutes.
- Jordan Pike NoneHere's what I have. One, I send a recap today. Two, our solutions engineer sends the written responses to Megan's numbered questions, including incident disclosure and access. Three, Ben, we schedule a demo for the client-services leads, so they can see it on realistic data. Does that sound right, Megan?
- Megan Alvarez NoneIt is acceptable as a sequence. I will review the documentation when it arrives. I will not commit to a date.
- Jordan Pike NoneUnderstood. Ben, anything else?
- Ben Kowalski NoneNope. Let me socialise it internally. Thanks, both. Really good call. Ben.
- Megan Alvarez NoneThank you, Jordan. Megan Alvarez, CISO.
- Jordan Pike NoneThanks, both. Speak soon. Thanks, Jordan.
Callsmade from