Brenneck Pay / BB-Demo – Security Review
Callcompleted
Brenneck Pay: documents · 2026-07-14 13:30
Session one of three with the customer's information security officer. Six findings are open on EU processing locations and access, and the engineering lead says interest in the bigger tier is single sign-on and provisioning.
What was said
What this says
Current to 11 Oct 26Session one of three with the customer's information security officer. Six findings are open on EU processing locations and access, and the engineering lead says interest in the bigger tier is single sign-on and provisioning.
What happened: Theo Gallagher ran session one with Jonas Albrecht and Sabine Kranz on residency architecture, the ingestion service and the Snowflake set-up. Six findings were logged, each open until evidence is delivered.
Customer view: Sabine said EU residency was a condition of signature and that she accepts dated artefacts, not verbal assurances. She was satisfied with how openly the gaps were handled.
Commercial: Jonas said the interest in the bigger tier is single sign-on and account provisioning, which is what Enterprise adds. Theo kept commercial matters out of the review.
Watch: Where the fetching service runs, whether telemetry holds content, and where answers are computed are all unconfirmed. Late or vague written answers would put trust and the Enterprise move at risk.
Themes
Current to 9 Oct 26Theme
Security review, EU residency
Importance
upsell
Sentiment
mixed
Voice
decision-maker
Who was there
BB-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Theo Gallagher to send the revised data flow diagram and connector table before session two.
- Theo Gallagher to obtain attributed, dated written answers from the platform team on findings two, four and five.
- Jonas Albrecht to run the grants, user list and replication export with a date and time.
Risks
Current to 9 Oct 26- EU residency was a condition of signature, and the placement of the ingestion service and any transient processing is not yet evidenced in writing.
- Telemetry content and where questions are answered are unconfirmed, so those findings stay open until the platform team replies.
- The loader role may hold more privileges than it needs, which weakens the least-privilege case.
Opportunities
Current to 9 Oct 26- Single sign-on and provisioning through the customer's identity provider point to a move to Enterprise.
- Session two will treat sign-on as a security topic, which can show how Enterprise simplifies the access review.
Transcript
Theo Gallagher NoneHello, can you both hear me alright?
Jonas Albrecht NoneYep. Afternoon.
Sabine Kranz NoneGood afternoon. I can hear you, and I see you both.- Theo Gallagher NoneLovely. Thanks for making the time. I know it's a busy week, so I'll try to keep us tidy. This is session one of three, and the plan is to cover the residency architecture, the ingestion service, and how the brain sits in your Snowflake account. Access logging and the exit plan come in the later sessions.
- Jonas Albrecht NoneFine by me. Though if the Snowflake bit runs long I'll want to dig into it, the rest can wait.
- Theo Gallagher NoneUnderstood. Before we start, let me list where we are on open findings and owners, so we all see the same page. Finding one is the data flow diagram for the ingestion service. That's mine, I owe you a version with processing locations marked. Finding two is the confirmation of where any transient processing happens. That needs our platform team, so I'll be asking them, and I won't answer it from memory today. Finding three is the role model in your Snowflake account, and that one is Jonas's to evidence from your side.
- Sabine Kranz NoneThank you, Theo. I have my own open questions and they overlap. Shall I read them?
- Theo Gallagher NonePlease do.
- Sabine Kranz NoneQuestion one: where exactly is the data processed, at rest and in transit, including anything that is cached or logged by BB-Demo components? Question two: does any customer content leave the EU region at any point, including for support or monitoring? Question three: which identities, human or service, can read the data, and who approves them? Question four: what evidence can you provide for each of these? I should say at the outset that EU residency is a requirement, not a preference. It was a condition of our signature.
- Theo Gallagher NoneUnderstood, and that's how I've been treating it. Let me take them in order, and I'll tell you where I can evidence something today and where I need to come back to you.
- Sabine Kranz NoneThat is acceptable.
- Theo Gallagher NoneSo, the shape of it. The brain is built and run inside your Snowflake account. That's the key design point. Your records, the indexed content, the question history, all of it lives in objects in your account, in the region you chose, which is the EU region. We don't hold a copy in a BB-Demo environment. What we do run is an ingestion service that reads from your connected systems and writes into your account.
- Jonas Albrecht NoneRight, and that's the part I want to pin down. The service reads from the CRM and the helpdesk and so on. Where does it run while it's doing that? Because the data passes through it.
- Theo Gallagher NoneFair. This is where I have to be careful, because I don't want to overstate it. My understanding is that the ingestion service is deployed for you in the EU region, and that records go from the source, through the service, and straight into your account without being persisted outside it. What I can't yet put in writing is whether there is any transient buffering or log output that sits somewhere else. I'll ask the platform team that directly.
- Sabine Kranz NoneSo at this moment you cannot say where it is processed.
- Theo Gallagher NoneI can say where it is designed to be processed, and I can describe the design. I can't yet hand you the dated, evidenced statement that you need. That's the finding, and it's on me to close it. I'd rather tell you that than give you a comfortable answer.
- Sabine Kranz NoneGood. That is the correct position. I do not accept verbal assurances for this, so please understand that the diagram and the written confirmation are what close it, not the conversation.
- Theo Gallagher NoneCompletely. I'll put it as a control reference in the pack so it's traceable, with the deployment description attached.
- Jonas Albrecht NoneCan I ask something slightly annoying? When you say deployed for us in the EU, is that a thing running in our account, or in yours?
- Theo Gallagher NoneNot annoying, it's the right question. The reason I hesitate is that there are two parts. The objects that hold data and the pipelines that transform it run in your account. The service that fetches from the source systems is the part I need to confirm the exact placement of. I don't want to guess which side of the line it's on.
- Jonas Albrecht NoneOkay. Then I'd like that answered before I touch anything else. Because if the fetcher sits outside, then my network allow-list looks different.
- Theo Gallagher NoneAgreed. I'll log it as the first thing to come back on.
- Sabine Kranz NonePlease also include which regions the source systems themselves are in. For example, if a source is a US-hosted service, I need to know that the brain does not make that worse or better. I want the whole path.
- Theo Gallagher NoneYes. I'll add the source side as a column in the data flow table. For each connector, source location, transit path, landing location. You'll want that for your own outsourcing register as well, I imagine.
- Sabine Kranz NoneCorrect. BaFin expects us to know it, and to be able to show it. That is how DORA applies to this arrangement in practice.
- Theo Gallagher NoneRight. Let me share my screen and walk you through what I do have. Give me a second. Can you see it?
- Jonas Albrecht NoneYes. A bit small.
- Theo Gallagher NoneBetter?
- Jonas Albrecht NoneBetter.
- Theo Gallagher NoneSo this is the architecture as it stands in the current document. On the left, your connected systems. In the middle, the ingestion service. On the right, your Snowflake account with three layers: a raw landing area, a modelled layer, and the index the brain queries. The arrows are the flows. What this version doesn't have is processing locations on the arrows, which is exactly finding one.
- Sabine Kranz NoneI see that the diagram has no boundary drawn. Where is the trust boundary?
- Theo Gallagher NoneGood catch, and that's the weakness. Today the boundary is described in text but not drawn. My proposal is to draw it around your account, and mark clearly anything that sits outside, even if it's only transient.
- Sabine Kranz NoneYes. Draw it, and name the components outside it.
- Jonas Albrecht NoneWhile we're on this slide. The raw landing area. Who creates that schema, you or us?
- Theo Gallagher NoneIt was created during implementation, by a role you provisioned for us, working in your account. It wasn't something we imposed from outside. That role has been scoped to the objects the brain needs.
- Jonas Albrecht NoneWhich role has access to it now? I checked the load history last week and I saw writes from a service role I didn't recognise by name. I assumed it was yours.
- Theo Gallagher NoneI'd want to see the exact role name before I confirm. Can you paste it into the chat?
- Jonas Albrecht NonePasting now. There. It's the one ending in loader.
- Theo Gallagher NoneYes, that matches the ingestion role as it was set up. I'll note it formally against the role model finding rather than just say it in passing. Is there anything else writing to that schema?
- Jonas Albrecht NoneNot that I can see. Which is how I like it, to be honest. One writer, one schema.
- Sabine Kranz NoneJonas, can you export the grants on that role, so that we have a dated record? Not a screenshot.
- Jonas Albrecht NoneI can run the grants query and save the output. Not today, though. Today's Tuesday, fine, but I want to test the query on a copy first. I'm not putting a query I haven't tested in front of an auditor.
- Sabine Kranz NoneThat is reasonable. Please attach the date and the time it was run.
- Jonas Albrecht NoneWill do.
- Theo Gallagher NoneThat's helpful, because it sits alongside the role model finding. So, on your side, grants export with date and time. On our side, I'll document what each privilege on the loader role is for, so the two can be read together and the least-privilege argument is visible.
- Jonas Albrecht NoneGood. Because at the moment I suspect it has more than it needs. That's not a criticism, it's the usual implementation habit. Grant broadly to get it working, narrow it later. Later is now.
- Theo Gallagher NoneFair, and I'd rather you told me that than hid it. If there's a privilege you think is excessive, tell me which, and we'll establish whether the ingestion service genuinely needs it. If it doesn't, you remove it. If it does, we document why.
- Jonas Albrecht NoneThat's a plan. I'll flag the ones I'm unsure about.
- Sabine Kranz NoneMoving to question two. Does any customer content leave the EU region for support or monitoring? Not metadata, content.
- Theo Gallagher NoneLet me be precise about the distinction you've drawn, because it matters. Support: our support engineers don't have standing access to your account. If something needs looking at, it happens through access that you grant, and you can revoke it. Monitoring: the platform emits operational telemetry, things like job status and error counts. What I can't tell you right now is whether any of that telemetry ever contains content, for instance in an error message that quotes a field. I'd be speculating, so I won't.
- Sabine Kranz NoneThen that is a finding. Please record it as such: whether error output or telemetry can contain customer content, and where it is stored.
- Theo Gallagher NoneRecording it as finding four. Owner is me, with the platform team as the source of the answer. I'll ask them in writing so that the reply is itself the evidence.
- Sabine Kranz NoneThank you.
- Jonas Albrecht NoneSlightly related. Suppose the ingestion job fails on a bad record. Where does the failed record go? In our account, in a quarantine table? Or does it get dropped, or sent somewhere?
- Theo Gallagher NoneI believe the intent is that rejected records stay in your account and are flagged, not dropped silently. But again, belief isn't evidence, so I'll add the failed record handling to the flow and confirm it. It's a good example of the kind of thing a questionnaire wouldn't ask but an engineer should.
- Jonas Albrecht NoneThat's a schema change if you're adding a quarantine table, by the way. So if it needs creating, I'm not doing it on a Friday.
- Theo Gallagher NoneNoted, and nobody would ask you to. If it needs creating we'll agree a day that suits you.
- Sabine Kranz NoneTheo, in your description you refer to a region chosen by us. Please confirm in writing that the account region, the storage region and any replication or failover target are all inside the EU. I need all three.
- Theo Gallagher NoneThe account region and storage are in your hands, since it's your Snowflake account. The brain doesn't change that. Replication and failover are the interesting one, because if replication were enabled on the account by your side to another region, then the brain's objects would follow. Jonas, is replication configured on that database?
- Jonas Albrecht NoneNot for that database. We have replication on a couple of others, to another EU region. For the brain's database, no. I'll confirm and put it in the same export. I'm fairly sure, but I haven't tested it, so don't write it down yet.
- Theo Gallagher NoneNot writing it down. I'll write it as pending your confirmation.
- Sabine Kranz NoneGood. That is the right way to record it.
- Jonas Albrecht NoneCan I raise the question of the model calls? The brain answers questions. Something has to read the content and produce an answer. Where does that happen?
- Theo Gallagher NoneYes, and I'm glad you asked it rather than leave it for later. That's the part I most want to get right in writing. The design intent is that question answering uses compute inside your Snowflake account, so content isn't sent to an external endpoint. I want the platform team to confirm that this is how it is deployed for Brenneck Pay specifically, and not just how it's described in general. Until I have that, treat it as the intent.
- Sabine Kranz NoneI will treat it as an open item, not as intent. Please make it finding five. A component that reads customer content and produces output is within the scope of our outsourcing assessment.
- Theo Gallagher NoneFinding five, then. Where is content processed when a question is answered. Owner me, evidence from the platform team.
- Jonas Albrecht NoneIf the answer is inside the account, I'd like to see it in the query history. That's testable. I can run a question and look at what compute it used.
- Theo Gallagher NoneThat would be a very good piece of evidence, because it comes from your side and not ours. Would you be willing to do that once we've got the written confirmation? Then the two agree or they don't.
- Jonas Albrecht NoneHappy to. I like it when claims can be checked.
- Sabine Kranz NoneSo do I. We now have five findings. May I ask that you read them back with owners, so that I can see whether we agree?
- Theo Gallagher NoneOf course. One, data flow diagram with the trust boundary drawn and processing locations marked, including source locations: me. Two, written confirmation of where the ingestion service runs and any transient processing: me, with the platform team. Three, role model and grants export with date and time, plus the replication confirmation: Jonas, with my privilege documentation alongside. Four, whether telemetry or error output can contain customer content, and where it goes: me, via the platform team. Five, where content is processed when a question is answered, with your query history as a cross-check: me, and Jonas for the cross-check.
- Sabine Kranz NoneThat matches my notes. I would add one thing for the record. None of these is closed until the evidence is in my hands. A statement that something has been done is not the same as the artefact.
- Theo Gallagher NoneAgreed, and I'll mark each as open until you tell me otherwise. I won't call anything final.
- Jonas Albrecht NoneCan we use the remaining time on the access side a bit? Not the logging, that's the next session. Just who at BB-Demo could ever touch this. Because that's what the auditor will ask me.
- Theo Gallagher NoneYes. Short answer, nobody has standing access. Longer answer, because short ones aren't good enough here: access during implementation was through the roles you provisioned, and those exist today. What I can't tell you offhand is whether any individual users at our end were also created in your account, as opposed to only service roles. Please check the user list on your side. If you see a name you don't expect, tell me, and I'll tell you whose it is and why.
- Jonas Albrecht NoneI'll check. I'd expect none, but I've been wrong before. Rarely, but it has happened.
- Sabine Kranz NoneThe user list and the role list are both required. Please include them in the same export.
- Jonas Albrecht NoneFine. Same export, same timestamp.
- Theo Gallagher NoneThat makes the pack coherent. And on the BB-Demo side I'll also write down how access would be granted in an incident, who approves it on your side, and how it's removed, so the procedure exists on paper as well as in practice.
- Sabine Kranz NoneYes. On paper and in practice. Both.
- Theo Gallagher NoneBefore we run out of time, one housekeeping point. This security review sits alongside a conversation about moving the account to Enterprise. I want to keep that entirely separate from what we've covered. Nothing in these sessions depends on it, and I won't bring commercial matters into the room.
- Sabine Kranz NoneThank you. That is appropriate. I do not discuss commercial terms, and my assessment must not depend on them.
- Jonas Albrecht NoneFrom my side, the reason we're looking at the bigger tier is the single sign-on and the account provisioning. If I can have users come in through our identity provider rather than creating them by hand, I'm happy. That's the engineering view, not a commercial one.
- Theo Gallagher NoneThat's a fair thing to say, and it ties to the access findings. If sign-on and automated provisioning are in scope, the access model gets simpler to evidence, because the identity provider becomes the source of truth. I'll include how that would change the access review in the next session, so it's treated as a security topic and not a sales one.
- Sabine Kranz NoneYes. Please include it. If it changes the control, I need to review the changed control.
- Theo Gallagher NoneUnderstood. I'll make sure that's flagged as a delta against what we've described today.
- Jonas Albrecht NoneOkay, can we go back to the ingestion service for a minute? I want to walk through failure behaviour. If the source is down for a night, what happens to the nightly refresh?
- Theo Gallagher NoneSure. The refresh is meant to complete by seven in the morning on business days. If a source is unavailable, the connector reports the failure, the run for that source doesn't complete, and the data for it is stale until the next successful load. The rest of the sources are unaffected. What I'd want to show you is where that failure is visible in your account, so you aren't relying on us to tell you.
- Jonas Albrecht NoneThat's what I want. Visible in the account. I'm not going to wait for an email from you to find out a load failed.
- Theo Gallagher NoneNo, quite right. I'll find the table or the view that holds run status and put it in the pack with a sample. If it turns out status is only held outside, then that goes onto finding four.
- Sabine Kranz NoneI have a question about retention. When a source record is deleted at the source, is it deleted in the landing area and the index? We have obligations under data protection law.
- Theo Gallagher NoneGood question, and I don't want to answer it from the general description. My understanding is that deletions propagate on the next run, but I don't know how it behaves for every connector, and I don't know how the index handles it. I'll add that as finding six, retention and deletion propagation, and I'll bring it into the second session so we can do it properly with the access logging.
- Sabine Kranz NoneFinding six. Thank you. Please state the behaviour per connector, not in general.
- Theo Gallagher NonePer connector. Noted.
- Jonas Albrecht NoneWhich connectors are we actually running now? I'd like the list to be in the pack as well. I know them, but the auditor doesn't.
- Theo Gallagher NoneYes. I'll take it from the configuration rather than from my memory of the implementation, so it's current. You'll see each one with its source system, its landing table and its schedule.
- Jonas Albrecht NoneGood. And mark which ones carry personal data. Merchant contacts, mostly, but let's be explicit.
- Sabine Kranz NoneI would add: which carry data subject to payment secrecy or similar supervisory confidentiality. Merchant account details are in that category.
- Theo Gallagher NoneI'll add two columns then. Personal data yes or no, and supervisory sensitivity. I'd ask you or Jonas to classify those, though, because it's your classification and not mine. I can pre-fill it as a draft, clearly labelled as a draft.
- Sabine Kranz NoneThat is the correct division. Send the draft and I will classify.
- Jonas Albrecht NoneRight. I think the account side is clear to me now. I have an export to run, a replication check, a user list, and a look at status tables. Anything else I'm forgetting?
- Theo Gallagher NoneThe query history check, once the written confirmation on question answering has arrived. So five things from you, with the last one waiting on me.
- Jonas Albrecht NoneFive things. Fine. I'll do them in a block so they share a timestamp.
- Sabine Kranz NonePlease do not rush the evidence for the sake of the schedule. A late and correct answer is better than an early and uncertain one.
- Theo Gallagher NoneAgreed. The dated commitment I can give you today is this: the revised data flow diagram and the connector table come to you both before the second session, and the written answers to findings two, four and five come as soon as the platform team has replied. I'll tell you if any of them is going to be late, and why.
- Sabine Kranz NoneI accept that, provided each answer is attributable. Name the person or team who gave it and the date.
- Theo Gallagher NoneAttributed and dated. Yes.
- Jonas Albrecht NoneThere's one more thing I should say, since it's a security review. We've had a decent few months with the brain. Nothing's broken, no tickets from my team. People are using it more. That's why I'm pushing on the controls now, not because anything's wrong, but because more people using it means more reason to be sure.
- Theo Gallagher NoneThat's useful context, thanks, and it's the right way round. Better to tighten the controls while it's quiet.
- Sabine Kranz NoneI will say, for balance, that I am satisfied with the manner in which the findings have been handled so far. You have been clear about what you do not yet know. That is more useful to me than confidence.
- Theo Gallagher NoneThank you, Sabine. I'd say the same of the questions. They've made the document better.
- Jonas Albrecht NoneDon't tell her that, she'll ask more.
- Sabine Kranz NoneI will.
- Theo Gallagher NoneThen let me confirm what happens next. Session two, which we'll set for next week, covers access logging, the retention and deletion behaviour per connector, and how sign-on and provisioning would change the access model. Session three covers the exit plan, meaning how you would get your data and the brain's objects out and what remains afterwards, plus incident handling and the DORA notification chain.
- Sabine Kranz NonePlease send the agenda for session two in advance, with the evidence you intend to bring. I would like to read it before I attend.
- Theo Gallagher NoneI'll send it with the revised diagram, so you have both together. And I'll send a short written summary of today, with the six findings and owners, so there's no dispute about what was agreed.
- Sabine Kranz NoneGood. I will reply to confirm or correct it.
- Jonas Albrecht NoneIs there anything for me in the summary that isn't in the five things?
- Theo Gallagher NoneOnly the privilege review on the loader role, where you flag the ones you think are excessive. So six, if you count that.
- Jonas Albrecht NoneSix. Fine. That one's quick, I've half done it already.
- Theo Gallagher NoneBrilliant. Any question either of you wanted to raise that we haven't touched?
- Sabine Kranz NoneOne. Is the licensed user count of forty relevant to the access model, or is that purely a licensing number?
- Theo Gallagher NonePurely a licensing number, as far as the access model is concerned. Forty users is what the subscription covers. Who can reach what is governed by the roles and by how people are admitted, not by the count. I'd keep those two apart in the documentation.
- Sabine Kranz NoneThank you. That is the answer I expected, but I wished to hear it stated.
- Jonas Albrecht NoneNothing else from me. Except that the diagram had a lot of arrows and I'd like fewer. Simplify if you can.
- Theo Gallagher NoneI'll try. Though if the honest answer needs arrows, there'll be arrows. I'd rather it was accurate than pretty.
- Jonas Albrecht NoneAccurate is fine. Accurate and readable is better.
- Theo Gallagher NoneAccurate and readable, then. Right. I think we're at a good place to stop. Thanks both, I'll get the summary to you today.
- Sabine Kranz NoneThank you, Theo. Thank you, Jonas. I look forward to the documents.
- Jonas Albrecht NoneCheers. Speak next week.
- Theo Gallagher NoneSpeak soon. Thanks, Theo.
Callsmade from