Ardcarne Life Assurance / BB-Demo – Security Review
Callcompleted
Ardcarne Life Assurance: documents · 2026-05-19 15:45
Declan Furlong, Chief Information Security Officer at Ardcarne Life Assurance, held the first of four review sessions on 19 May 2026. Eight findings were open at the close, all owned by Theo Gallagher, and nothing is to be signed on a promise to close later.
What was said
What this says
Current to 11 Oct 26Declan Furlong, Chief Information Security Officer at Ardcarne Life Assurance, held the first of four review sessions on 19 May 2026. Eight findings were open at the close, all owned by Theo Gallagher, and nothing is to be signed on a promise to close later.
What happened: the session covered architecture, residency and subcontractors. Declan found gaps in the draft diagram, the subcontractor list, logging retention and the model call data flow.
Customer view: he wants dated written commitments and was clear that security findings run independently of commercial terms. He accepts the 30 Jun 2026 target only as conditional on evidence.
Commercial: his account is in an EU region and he wants the contract to say it stays there, with a notice period for change. Theo raised the dedicated EU data residency add-on and said he would confirm what it adds before calling it required.
Watch: Theo could not yet evidence model provider terms on retention and training. The evidence does not show how the later sessions went.
Themes
Current to 9 Oct 26Theme
Security review findings
Importance
neutral
Sentiment
neutral
Voice
decision-maker
Who was there
BB-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Theo Gallagher to send the findings list with committed dates within the hour of the call.
- Theo Gallagher to send the draft NDA to Declan by the end of that week.
- Theo Gallagher to send the invitation and agenda for the access and identity session.
Risks
Current to 9 Oct 26- Eight findings are open, so the 30 Jun 2026 target depends on evidence not yet delivered.
- Model provider terms on retention, training and region of processing are unconfirmed and could block approval.
- A delayed penetration test summary or NDA would add friction to the review.
Opportunities
Current to 9 Oct 26- The dedicated EU data residency add-on may fit if it adds anything beyond the customer's own EU region configuration.
- Clear, dated evidence builds trust with a security officer who values honest gaps over tidy answers.
Transcript
Theo Gallagher NoneGood afternoon, Declan. Can you hear me all right? I had a bit of a hiss on the headset earlier, so I switched to the other one.
Declan Furlong NoneGood afternoon, Theo. Yes, you're clear. And I can see the recording notice, so I assume that's on.- Theo Gallagher NoneIt is, yes. It's for our own notes and so that I can attach the transcript to the evidence log. If you'd rather I stopped it at any point, just say.
- Declan Furlong NoneThat's fine. I'd prefer it kept, actually. Anything said today I will want to be able to point to later. How has your week been?
- Theo Gallagher NoneBusy but orderly. Two other questionnaires on my desk, both from the EU side, so I have had DORA on the brain all week. Yours is the most thorough, I will say that.
- Declan Furlong NoneGood. That is rather the point. Shall we begin? I have the agenda you sent. As I understand it, this is the first of four sessions.
- Theo Gallagher NoneCorrect. Today is architecture, data residency and subcontractors. The later sessions cover access and identity, then incident handling and notification, then exit and the register of information. I'll open by listing the findings we have so far, if that suits you.
- Declan Furlong NonePlease. I open every review that way, so I am pleased you do too.
- Theo Gallagher NoneSo, nothing is closed yet, because we have only just started. Open items from the written questionnaire: one, the architecture description needs a diagram that shows where BB-Demo components run relative to your Snowflake account. That one is mine. Two, residency, which needs a statement of where each category of data sits. That is also mine, with input from our platform team. Three, the subcontractor list, which you asked to be complete and dated. That sits with me and our legal team. Does that match your list?
- Declan Furlong NoneIt matches, with one addition. I have a fourth: the questionnaire answer on logging says logs are retained, but it does not say for how long, nor who can read them. I have recorded that as open under your name as well.
- Theo Gallagher NoneFair. I'll take that as number four. I won't promise a retention period from memory, I'll give you the control reference and the dated document.
- Declan Furlong NoneThank you. That is the habit I want to see. Let us begin with architecture. Explain to me, in your own words, where my data physically is when someone at Ardcarne asks the brain a question.
- Theo Gallagher NoneRight. The core design point is that the brain is built and run inside your own Snowflake account. The data from your CRM, your call recorder, the helpdesk and so on is loaded into tables in your account. The indexing and the query layer run there as well. BB-Demo does not keep a separate copy of your data in a store that we own.
- Declan Furlong NoneYou say it does not keep a separate copy. Please be careful. Is there anything at all that leaves the account? Prompts, query text, metadata, embeddings, telemetry?
- Theo Gallagher NoneThat's the right question, and I want to answer it precisely rather than reassure you. There are three categories I need to separate. The data itself, which stays in your account. The service operation information, such as job status and error codes, which we need to see to support you. And the model calls. I can describe the first two confidently. For the third I want to come back with the exact data flow, because I will not answer for the platform team without asking them first.
- Declan Furlong NoneUnderstood, and I appreciate that you did not guess. Please note it as a finding. Under DORA we need to know every route by which information about our customers could leave our control, including routes that carry only fragments.
- Theo Gallagher NoneNoted as finding five: model call data flow, owner me, with the platform team's confirmation. Can I propose a date for it? I would say the end of the second session, but I'd like to check it with them before I put it in writing.
- Declan Furlong NonePlease provide a dated commitment, in writing, after you have checked. A verbal estimate is not something I can show the Central Bank.
- Theo Gallagher NoneAgreed. I will send it today with the date in it. Shall I share the architecture diagram now? It's the current draft, so I'll say clearly it is a draft.
- Declan Furlong NoneYes, go ahead. Please label it as a draft in the file name as well, so that nobody mistakes it later.
- Theo Gallagher NoneDone. You should see it now. On the left are your source systems, so the CRM, the call recorder, email, the helpdesk and the accounting system. Those arrive through connectors into a landing area inside your Snowflake account. In the middle is the transformed layer, where records are joined by organisation and person. On the right is the query layer that serves pages, chat and search.
- Declan Furlong NoneMm. Where is the boundary of your responsibility on this picture? I do not see a line.
- Theo Gallagher NoneThat's a fair criticism, there isn't one yet, and that is a gap in the draft. The line should run around the whole of the right-hand and middle layers: those run in your account but are operated by us under the agreement. The Snowflake platform itself belongs to Snowflake and to you as the account holder. I'll add the boundary and label who operates each box.
- Declan Furlong NonePlease add also who has administrative access to each box, by role, not by name. I need to separate your engineers from my own.
- Theo Gallagher NoneYes. That overlaps with the access session, but I'll put a first version in the diagram so we are not waiting. I'll mark it as draft against the identity findings.
- Declan Furlong NoneGood. Now, residency. Ardcarne is an Irish insurer. My supervisory expectation is that policyholder data stays within the European Economic Area, and that I can demonstrate it. What can you evidence?
- Theo Gallagher NoneSo the location of the data is determined by the region of your Snowflake account. If your account is in an EU region, then the tables, the index and the query layer sit in that region. That part we can evidence from the account configuration, and I can ask you to confirm it from your side as well, which is better evidence than my statement.
- Declan Furlong NoneI can do that. It is in the EU. I want the contract to say that it will remain so, and I want a notification period if it ever changes.
- Theo Gallagher NoneThat's reasonable and it is the sort of thing we can put in the order form. There is also a dedicated EU data residency add-on, which exists precisely for cases like yours, and we should talk about whether you need it given your account is already in region. I will not say it's required until I've confirmed what it adds beyond your own configuration.
- Declan Furlong NonePlease do. I do not want to buy something that duplicates what I already control, but I do not want to find later that I should have.
- Theo Gallagher NoneUnderstood. That becomes finding six, residency statement and add-on clarification, owner me.
- Declan Furlong NoneBefore we go further, a practical matter. Support staff. When your engineers are helping us, where are they located? If someone in a third country can view my data during a support case, that matters for my register.
- Theo Gallagher NoneYes. I know our engineering and support are based in London, but I do not want to give you a full answer on out-of-hours cover or any contractors without checking. I'll put the question to the platform team and to our people team, and I'll give you the answer with the date it's valid from.
- Declan Furlong NoneThat will be finding seven. And this leads me naturally to subcontractors. Please tell me what you have.
- Theo Gallagher NoneRight. In the questionnaire we listed the categories: hosting through the data platform, the model provider or providers used for the language features, and a small number of tooling services for support and monitoring. What I have not given you is a dated list with each one's role, the data it could touch and where it sits. That is exactly what you asked for.
- Declan Furlong NoneCorrect. The questionnaire gave me categories, and categories are not a register. For the register of information I need legal entity, service, location and whether it supports a critical or important function.
- Theo Gallagher NoneUnderstood. I'll produce the list in that structure. One caution: some of those entries will be providers that BB-Demo uses, and some will be providers inside your own Snowflake arrangement. I'll separate the two so you can see which relationships are yours and which are ours.
- Declan Furlong NoneThat distinction is helpful. Chain of subcontracting also. If your supplier uses a supplier, I need that to the extent it touches my data.
- Theo Gallagher NoneYes. I'll ask each for their own subprocessor statement and attach it, rather than summarise from memory. Where a provider will not give us one, I'll say so plainly.
- Declan Furlong NonePlease do. An honest gap is more useful to me than a tidy answer.
- Theo Gallagher NoneNoted. Can I check how you would like the evidence delivered? I could put it into a single shared folder with an index that mirrors your numbering, so each finding has its own folder and the dated documents sit under it.
- Declan Furlong NoneYes. Mirror my numbering. And put the version date in every file, since I will be asked to show what I knew at what time.
- Theo Gallagher NoneWill do. Now, the model calls. Since we flagged that as open, shall I walk through what I do know about the language features, and be explicit about where my knowledge stops?
- Declan Furlong NonePlease.
- Theo Gallagher NoneSo when someone asks the brain a question, the system retrieves relevant records from within your account, builds a prompt and sends it to a language model for the answer. What I can say is that the retrieval happens inside your account. What I cannot yet say with evidence is what the contractual terms are on retention at the model provider, and whether prompts are used for training. I believe not, but a belief is not a control, so I'll get the written terms.
- Declan Furlong NoneThank you for saying that. In many reviews I hear the opposite. Let me be direct about what I need there: no training on our data, no retention beyond the request, region of processing, and notification if the provider changes. I want each of those as a dated commitment, not as marketing.
- Theo Gallagher NoneFour items, each with a dated commitment. I'll record them under finding five. Can I ask a clarifying question? If the region of processing for the model were outside the EEA, would that be a blocker or something you would accept with safeguards?
- Declan Furlong NoneAnswering a question with a question, I see. It is a fair one. It would not be an automatic blocker, but I would need transfer safeguards documented, a risk assessment and approval from our data protection officer. I would much prefer in region.
- Theo Gallagher NoneUnderstood. Then I'll ask the platform team first whether an in-region option is available for your deployment, and only then describe fallbacks.
- Declan Furlong NoneGood. Let me move to something else while we have time. Segregation. Ardcarne's broker distribution and customer service teams will both use this. Within the brain, can one team's access be separated from another's?
- Theo Gallagher NoneYes, at the data level it follows the roles and permissions you configure in your account, so the brain returns only what the person asking is allowed to see. I'd want to demonstrate that to you in the sandbox or on a test set rather than describe it, since it is a control, and we can evidence that. I'd suggest we cover it properly in the access and identity session.
- Declan Furlong NoneAgreed. Put it there. I will also want to see what happens when a person leaves Ardcarne, and how fast they lose access.
- Theo Gallagher NoneYes. That is session two. I'll bring the steps with the timings.
- Declan Furlong NoneRight. Now, one point I raised in writing and which I do not think has been answered. Penetration testing. When was your most recent test, who performed it, and may I read the summary?
- Theo Gallagher NoneI have the summary report, but I'm not going to quote its date from memory, because I'd like it to be exact. I'll send it with the cover note. It will be under NDA, so I'll ask our legal team to put the right paperwork in place before it goes anywhere.
- Declan Furlong NonePlease do that today as well, so the NDA is not what delays it. I'll ask our legal counsel to expect it.
- Theo Gallagher NoneGood. Finding eight, penetration test summary, owner me, with legal. I'll have the draft agreement over to you by the end of this week.
- Declan Furlong NoneThank you. Let us return to architecture for a moment. Your diagram shows a landing area. What happens to raw data that fails to load, or is malformed? Is it quarantined, retained, deleted?
- Theo Gallagher NoneIt is held in the landing area inside your account, flagged, and the job reports the failure. It isn't moved elsewhere. How long it sits there is a configuration, and I want to make sure I tell you the default correctly, so that goes with the retention answer under finding four.
- Declan Furlong NoneFine. I will merge it into finding four. Now, change management. If you alter the connectors or the query layer, how do I learn of it before it affects us?
- Theo Gallagher NoneWe announce planned changes ahead of time through the customer success lead, which for you would be Elena Novak, and the release notes. For a security-relevant change I'd want a defined notice period written into the agreement rather than relying on custom. I will propose wording for you to mark up.
- Declan Furlong NoneYes, propose wording, and I will mark it up. Matteo Ricci has been in touch about commercial terms. I want it understood that the security findings run independently of those, and nothing is signed on the strength of a promise to close later.
- Theo Gallagher NoneThat's understood and I'd say the same. Matteo's side and mine are separate. The target on the commercial side is the end of June, 30 Jun 2026, but the review goes at the pace the evidence allows, and I won't tell you something is closed when it isn't.
- Declan Furlong NoneGood. I note the date. I will tell my committee that the review is intended to complete ahead of it, but that the date is conditional on evidence.
- Theo Gallagher NoneThat's an accurate way to put it. Shall I summarise where we've got to, and then you can correct me?
- Declan Furlong NonePlease.
- Theo Gallagher NoneEight findings are open, all with me as owner. One, architecture diagram with the responsibility boundary and administrative access by role. Two, residency statement, which I've merged with the add-on clarification as six. Three, the dated subcontractor list in the register structure, with sub-subcontractors. Four, logging retention and who can read logs, now including the quarantine default. Five, the model call data flow with four written commitments. Seven, support location. Eight, the penetration test summary and the NDA. Did I miss anything?
- Declan Furlong NoneYou have covered it, although I would keep two and six separate. I report them to the board risk committee as different items. Otherwise it is complete.
- Theo Gallagher NoneFine, I'll keep them apart, and the numbering stays as you have it. I'll send the findings list within the hour, with the dates I'm able to commit to, and flag the ones where I'm waiting on the platform team.
- Declan Furlong NoneExcellent. In that case, thank you, Theo. The next session is in about a week, I believe. Please send the invitation with the agenda for access and identity.
- Theo Gallagher NoneWill do. Thanks, Declan. Speak soon.
- Declan Furlong NoneRegards. Goodbye.
Callsmade from