Ardcarne Life Assurance / BB-Demo – Security Review
Callcompleted
Ardcarne Life Assurance: documents · 2026-06-02 09:15
Session on the exit and data return schedule with the CISO and procurement lead. Seven open points, several needing commercial or legal answers. Procurement will not discuss price until the exit plan is settled.
What was said
What this says
Current to 11 Oct 26Session on the exit and data return schedule with the CISO and procurement lead. Seven open points, several needing commercial or legal answers. Procurement will not discuss price until the exit plan is settled.
What happened: Theo Gallagher walked Declan Furlong and Aoife Kinsella through a working draft exit and data return schedule, not yet reviewed by BB-Demo legal. Aoife summarised five points and Theo added two more, making seven.
Customer view: Aoife said she would not agree terms on the call and would not discuss price until the exit plan is settled. Declan wants exit to be demonstrably executable under DORA, with dated commitments.
Commercial: Supervisory-exit notice period, transition length and escrow are commercial or legal terms Theo could not set. The configuration export is unproven and stays a commitment until tested.
Watch: Theo owes a revised draft by the end of next week and an export test date by Friday. Declan will not close findings without evidence.
Themes
Current to 9 Oct 26Theme
Exit plan and continuity
Importance
neutral
Sentiment
mixed
Voice
decision-maker
Who was there
BB-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Theo Gallagher to send a revised draft, still marked as a draft, by the end of next week.
- Theo Gallagher to give Declan Furlong the export test date by Friday.
- Commercial owner to state the supervisory-exit notice period and respond on escrow.
Risks
Current to 9 Oct 26- Supervisory-exit notice period is unstated and sits with the commercial owner, so the exit plan stays open.
- Configuration export is unproven and the escrow question is unanswered, which feeds the committee's concentration-risk view.
- Procurement will not discuss price until the exit plan is settled, so commercial progress is gated.
Opportunities
Current to 9 Oct 26- Running inside the customer's own Snowflake account gives a strong data-return story if stated unambiguously in the contract.
Transcript
Theo Gallagher NoneMorning, both. Can you hear me? I'm in a meeting room and it's a bit echoey, so tell me if it's awful.
Aoife Kinsella NoneGood morning, Theo. I can hear you well. Declan, you're on mute, I think.
Declan Furlong NoneGood morning. Apologies. Yes, I can hear you both now. I understand the train from Cork was delayed again, Aoife, so I am glad you made it.- Aoife Kinsella NoneI'm dialling in from the car park, so not quite made it, but I'm connected. Shall we start? First, so that we're all looking at the same thing, can we confirm which draft of the exit plan we are discussing?
- Theo Gallagher NoneYes. It's the exit and data return schedule I circulated after the first session. It's a working draft, and I'd ask that nobody treats it as final. It hasn't been through our legal team's review yet, and I'd rather you see it in that state than see a polished version that's not agreed.
- Aoife Kinsella NoneThank you. Then I'll record it as the working draft, and that everything discussed today is subject to Legal. I should also say at the outset that I will not agree terms on this call, and I won't be discussing price until the exit plan is settled.
- Theo Gallagher NoneThat's entirely fine with me. I wasn't going to raise it.
- Declan Furlong NoneFor the record, my open findings from the first session. The processing path statement, the fallback behaviour, and the subcontractor tables. I received the written answers on the dates committed, and I am reviewing them. Those are not the subject today, but I will not close any of them without evidence.
- Theo Gallagher NoneUnderstood. For today I've got my own list too. The exit plan has to cover termination assistance, return of data, deletion, and what continuity looks like in the transition. Aoife, you tell me where I've missed something from the outsourcing policy.
- Aoife Kinsella NoneThank you. From an outsourcing perspective, the exit plan needs to cover five things. Triggers for exit, including regulator-directed exit. The transition period and the assistance during it. Return of data and of anything derived from it. Deletion, with a certificate. And continuity of the critical function while the move takes place. Let's go through them in that order, if you're content.
- Theo Gallagher NoneContent. Triggers first. In the draft, either party can terminate for the usual reasons, and separately Ardcarne can require exit if a supervisor directs it or if there's a material breach of the security terms. Does that cover the regulator-directed case in the way your policy needs?
- Aoife Kinsella NonePartly. The policy is explicit that exit on supervisory direction must be possible without penalty and on notice that is short enough to be practical. The draft says notice, but the clause as written doesn't say how short. I'd need that stated.
- Theo Gallagher NoneFair. I don't set commercial terms, so I'll flag it to our commercial owner for the account rather than propose a number. What I can say is that nothing technical stops a fast exit. I'll make the technical side explicit.
- Declan Furlong NonePlease ensure that it is explicit. Under DORA we need exit to be demonstrably executable, not merely permitted.
- Theo Gallagher NoneAgreed. Which leads neatly to data return, because that's where our architecture actually helps you. The data sits in your Snowflake account. Return isn't a matter of us sending you an export. It's already yours, in your account, in your tables.
- Aoife Kinsella NoneI understand the argument, but I'd like it to be unambiguous in the contract. If the data is in our account and the relationship ends, what exactly do you still hold, and what precisely do we lose access to?
- Theo Gallagher NoneGood, let me separate those. What you keep: all the source data the connectors landed, the indexes in your schemas, and the tables the brain created. What goes: our service role, our connector configuration and the application layer that sits on top, which is the part you're licensing. Then there's a middle category, which is configuration you've built, like pages and dashboards. Those I'd want to be exportable in a documented format.
- Declan Furlong NoneIs that exportable now, or is it a commitment for the future?
- Theo Gallagher NoneThat's the right question, and I need to be careful. I believe the definitions can be exported, but I haven't seen the export run end to end for a tenant like yours, so I'm not going to tell you it's proven. I'll ask for a test and bring you the output, and until then it goes in the document as a commitment, with a date, not as a control we can evidence today.
- Declan Furlong NoneThat is acceptable, provided the date is stated and the test result is provided in the evidence pack.
- Aoife Kinsella NoneCan I come back to the middle category? If the pages and dashboards are exported, are they usable without your application? Or is it a file we can't open?
- Theo Gallagher NoneHonest answer, I don't know yet whether they're useful without the application, or only as a record of what you built. I'd guess the latter for the dashboards. The underlying queries should run on their own in Snowflake, because they're just queries over your tables. I'll find out and describe it properly.
- Aoife Kinsella NoneThank you, that's candid. I'll note it as an assumption, not a fact. Now, transition assistance. How long do you provide it, and what does it consist of?
- Theo Gallagher NoneThe draft has a transition period during which we keep the service running and provide named support. The length of that is, again, a commercial term and I'd be inventing it if I said. What I can set out is what the assistance consists of. We'd walk your team through the schemas, hand over the documentation of the connectors, remove our access in a controlled sequence, and confirm each step in writing.
- Declan Furlong NoneThe sequence matters. Which comes first, the removal of your access or the handover of documentation?
- Theo Gallagher NoneDocumentation and a read-only period first, then access removal last, and only on your written confirmation. That's the order I'd defend, because removing access first leaves you with a system nobody can explain.
- Declan Furlong NoneThat order is sensible. Please state it in the schedule, with the confirmation as a gate.
- Theo Gallagher NoneYes. Gate it. Noted.
- Aoife Kinsella NoneMoving to deletion. Our policy requires that a supplier deletes our data and anything derived from it, and certifies that it has done so. In your model, what is deleted and what is certified?
- Theo Gallagher NoneYour data we don't hold, strictly, so the deletion of it is yours to perform in your account. What we hold is operational metadata: configuration, status, usage counts, tickets. We'd delete or return that on exit and certify it. For tickets, there may be a retention period we're obliged to keep for our own records, and I won't know the details until I've asked.
- Aoife Kinsella NoneThe retention point matters. If you retain any record that identifies our staff or brokers, even in tickets, the plan needs to say so and say for how long.
- Theo Gallagher NoneUnderstood. I'll ask what's in a ticket by default and how long it stays. If the answer is personal data, I'll tell you it is, and we'll write it in.
- Declan Furlong NoneI have a question relating to the model. If embeddings or indexes were produced from our data, and they are in our account, they are ours to delete. Are there any held outside the account, for example in caches?
- Theo Gallagher NoneNot by design, and that's the same family of question as the processing path I owed you last time. The caches I know of are in your account. I can't swear there's no transient cache elsewhere in the language model path until the platform team confirms. It's on the list already, and I'll tie the two answers together so you don't get them in different documents.
- Declan Furlong NonePlease do. I would prefer one coherent statement.
- Aoife Kinsella NoneNow continuity, which is where my committee will spend its time. If the service stopped tomorrow, because of insolvency, say, how does Ardcarne keep the critical function running?
- Theo Gallagher NoneInsolvency is the hard one, and I'd rather address it than skip it. Because the data and the schemas are in your account, you keep your data and your tables regardless of what happens to us. What you'd lose is the application layer and the connector management, so the question becomes how quickly you could keep the connectors running or replace them. We'd need to look at whether the connector code can be put in escrow, or made available on a failure event. That's a legal and commercial construct, and not something I can promise.
- Aoife Kinsella NoneAn escrow question is for Legal, and I'll raise it internally, subject to the draft. It would materially affect how the committee sees the concentration risk.
- Theo Gallagher NoneThen I'll raise it on our side, too, so it isn't only coming from you. I can't tell you what the answer will be, and I don't want to imply it'll be yes.
- Declan Furlong NoneA related point. The outage in July. During that event, how long would it have taken Ardcarne to operate without the brain, and what did it depend on? I ask because the exit plan and the continuity plan must be consistent with that experience.
- Theo Gallagher NoneThat belongs in session three, where I'll bring the timeline, and I don't want to answer it loosely now. What I'll say is that the source systems carried on working, because the brain reads from them and doesn't replace them. So the business impact was on answers and views, not on policy administration. I'll evidence that with the incident record, not from memory.
- Declan Furlong NoneThat is acceptable for today. Please include the exit consequence explicitly: what an exit during an incident would look like.
- Theo Gallagher NoneWill do. An exit during an incident, as its own scenario.
- Aoife Kinsella NoneLet me summarise what I've taken from this. One, the notice period for supervisory exit needs to be stated, and that's with your commercial owner. Two, the export of configuration needs a test and a date. Three, the transition sequence is gated on our written confirmation. Four, retention in tickets to be disclosed. Five, escrow to be raised by both sides. Is that fair?
- Theo Gallagher NoneThat's fair, and I'd add the single statement on caches and processing path, and the incident exit scenario. So seven in all. I'll send a revised draft, still marked as a draft, with the open points listed against each clause.
- Declan Furlong NonePlease provide a dated commitment for the revised draft, and for the export test.
- Theo Gallagher NoneThe revised draft by the end of next week. The export test result I'll date once the platform team has told me when they can run it, and I'll tell you that date by Friday, even if the answer is that it's later than we'd like.
- Aoife Kinsella NoneThat's acceptable. I'll send you the register template today, if Declan hasn't already, and my comments on the clause wording will come after Legal has seen it. I won't be able to turn that around instantly.
- Declan Furlong NoneI did ask her to send it. Aoife, I assume it is with Theo?
- Aoife Kinsella NoneIt is in the email I sent last night. Theo, check your inbox, it may have landed in a junk folder.
- Theo Gallagher NoneI'll look straight after this. Thanks, both. I'll send the summary and the list this morning. Session three is incident notification, and the following one is the evidence pack, as agreed.
- Declan Furlong NoneThank you, Theo. Regards.
- Aoife Kinsella NoneThank you both. Kind regards, speak soon.
Callsmade from