Brenneck Pay / BB-Demo – Security Review
Callcompleted
Brenneck Pay: documents · 2026-07-28 11:00
Second security review session: the call-transcription sub-processor handles audio outside the EU, and Sabine Kranz said her function will not support the Enterprise upgrade until audio is processed in the EU. Evidence list agreed.
What was said
What this says
Current to 11 Oct 26Second security review session: the call-transcription sub-processor handles audio outside the EU, and Sabine Kranz said her function will not support the Enterprise upgrade until audio is processed in the EU. Evidence list agreed.
What happened: Theo Gallagher hosted the second of three security review sessions on 28 Jul 2026 with Sabine Kranz, Information Security Officer, and Matteo Ricci. The Enterprise expansion was aiming for signature on 28 Aug 2026.
Customer view: Sabine said audio processed outside the EU is not something she can sign off under BaFin outsourcing requirements and DORA. She stated her function does not support the upgrade until audio is processed in the EU.
Commercial: Sabine does not discuss commercial terms. She said merchant risk are happy with the product, so this is a finding, not dissatisfaction.
Watch: engineering has given no date for EU processing. The evidence does not show whether the 28 Aug 2026 signature happened.
Themes
Current to 9 Oct 26Theme
EU residency blocks Enterprise upgrade
Importance
upsell
Sentiment
mixed
Voice
unknown
Who was there
BB-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Theo Gallagher sends the architecture diagram, access log sample and retention document after the call.
- Matteo Ricci confirms in writing the platform team's answer on EU processing, with a date only once engineering agrees one.
- Theo Gallagher arranges the exit walkthrough on a test account and sends Sabine Kranz the record.
Risks
Current to 9 Oct 26- The Enterprise upgrade is blocked for the security function until call audio is processed in the EU, and engineering has given no date.
- Further findings remain open: access log retention, a tested exit walkthrough, and two more sub-processor questions.
- Existing audio already processed outside the EU raises a deletion question that BB-Demo could not yet answer.
Opportunities
Current to 9 Oct 26- Merchant risk are happy with the product and colleagues at Brenneck Pay are sponsoring the expansion.
- A configuration that sends no audio, using only the customer's own recorder transcript, was called possibly acceptable.
- Closing findings with evidence before the third session could clear the way for the Enterprise order.
Transcript
Matteo Ricci NoneGood morning, Sabine. Can you hear us all right? We seem to have a bit of an echo on our side.
Sabine Kranz NoneGood morning. Yes, I hear you clearly. No echo here. I can see Theo as well.
Theo Gallagher NoneMorning both. Sorry, I was just finding the right document. Give me a second to share.- Matteo Ricci NoneWhile Theo does that, let me restate where we are, so we all have the same picture. This is the second of three security review sessions. The expansion to Enterprise is aiming for signature on 28 Aug 2026, and I understand from our last conversation that the residency question has to be closed before anything is signed. Have I got that right?
- Sabine Kranz NoneYou have. This is a requirement, not a preference. And I should say, I do not discuss commercial terms. That is for the people who sign. I am only here for the findings.
- Matteo Ricci NoneOf course. Understood, and I will keep to that. I only wanted the timeline on the record.
- Sabine Kranz NoneGood. I have my open questions written down. Shall I go through them?
- Theo Gallagher NoneIf I may, I will list the open findings first, with owners, and then you can add yours. There are three. First, the access log export for your admins. That one is mine. Second, the sub-processor register, which is also mine, with input from our platform team. Third, the exit plan, which sits with Matteo and me jointly. Does that match your list?
- Sabine Kranz NoneIt matches in number. I have a fourth, which is really a part of the second. I want to start there. Where exactly is the data processed? Not stored. Processed.
- Theo Gallagher NoneRight. Let me answer in two parts, because the answer is different for the two parts. The brain itself runs inside your own Snowflake account, in the EU region you chose. The tables, the indexes, the question and answer processing, all of that stays in that account. We can evidence that, and I have the account region setting and the architecture diagram, which I will send after the call.
- Sabine Kranz NoneThat part I accept, subject to the diagram. And the second part?
- Theo Gallagher NoneThe second part is the sub-processors that sit beside the brain. Most of them handle metadata or text, and they are in the register I sent. I have gone through the register line by line since session one, and there is one entry I need to be plain about.
- Matteo Ricci NoneTheo, if I may, I would rather you heard this from me first, Sabine. I would rather you heard it from us than found it in the paper yourself.
- Sabine Kranz NonePlease. Go on.
- Matteo Ricci NoneThe call-transcription sub-processor. When the brain ingests recorded calls, the audio is sent to that sub-processor to be turned into text. Theo's review shows that this processing happens outside the EU.
- Sabine Kranz NoneOutside the EU. Where, specifically?
- Theo Gallagher NoneWhat I can say with evidence is that it is not in the EU. The register entry names a non-EU processing location, and I have the contract extract that says so. What I do not have is a statement of every place the audio might be routed or cached. I am not going to guess at that.
- Sabine Kranz NoneThank you. That is a clearer answer than I usually get. But it is also a problem. You know our position. Audio of merchant conversations, which may include account details and names, leaving the EU, under BaFin's outsourcing requirements and DORA, is not something I can sign off.
- Matteo Ricci NoneNo, and we do not expect you to. I will say it directly, so there is no confusion later: I understand that, until this is resolved, you will not support the upgrade.
- Sabine Kranz NoneThat is correct. The finding stays open and the upgrade is blocked, as far as my function is concerned, until the audio is processed in the EU. Not promised. Processed.
- Matteo Ricci NoneUnderstood. What does your regulator need to see, for you to close it? I would like us to produce exactly that and nothing vaguer.
- Sabine Kranz NoneThree things. A written statement from the sub-processor of the processing location for audio, including any temporary storage. The data processing terms showing that location as a contractual commitment. And an updated entry in your register, with the date of the change. Please provide evidence for each, not a description of it.
- Theo Gallagher NoneThat is clear, and I can mirror it as a numbered list in the follow-up. One, location statement. Two, contract extract. Three, register entry with a change date. Can I check one thing? If the change in location is not possible, would a configuration where audio is not sent at all be acceptable to you, so that only text from your own recorder goes in?
- Sabine Kranz NonePossibly. But that depends on what your own recorder connector does with the audio before it reaches you. Which brings me to my other question. What is the data flow, step by step, from our call recorder to your index?
- Theo Gallagher NoneFair. I would rather walk it than describe it. The recorder connector pulls the recording and the recorder's own transcript, if there is one. Where there is no usable transcript, the recording goes to the transcription sub-processor. Then the text is written into your Snowflake account and indexed. The step that leaves the EU is that one, and only that one.
- Sabine Kranz NoneAnd is the audio retained by the sub-processor afterwards?
- Theo Gallagher NoneI believe the terms say it is deleted after processing, but I believe is not a good enough word for you, and it is not for me either. I will ask our platform team for the retention clause and the deletion evidence, and I will not answer for them until I have asked.
- Sabine Kranz NoneGood. I appreciate that you did not simply say yes.
- Matteo Ricci NoneI would like to add something, if it is useful, Sabine. Our platform team is already looking at whether the sub-processor can offer processing in an EU region. I do not have an answer, and I will not give you a date that engineering has not agreed. Let me confirm that in writing, with whatever they say, as soon as they say it.
- Sabine Kranz NoneA date from engineering, then. Not from sales. That is the correct order.
- Matteo Ricci NoneExactly the correct order.
- Sabine Kranz NoneI want to be fair here. In the first session I was worried you would be defensive. You are not. The merchant risk team are quite happy with the product, and that is partly why I am being so insistent. I do not want to lose it over one entry in a register.
- Theo Gallagher NoneThat is helpful to hear, and I would rather it was one entry than several. Can we move to the access logs? That is my finding, and I would like to close what I can today.
- Sabine Kranz NoneYes. I asked for who accessed which merchant records, with timestamps, exportable, for at least the retention period our policy requires.
- Theo Gallagher NoneRight. Control reference for this is the access logging control in the review pack. Because the brain runs in your Snowflake account, the query history and the access history belong to you. Your own team can export them. We can evidence that with a sample export from a test account, which I have prepared. What we also log, on our side, is administrative access by BB-Demo staff, and that is retained separately.
- Sabine Kranz NoneRetained for how long?
- Theo Gallagher NoneI have the figure in the control document, but I would rather send you the document than read a number off from memory and get it wrong. It will be in the follow-up with the sample export.
- Sabine Kranz NoneFine. Send it with the sample. If the retention is shorter than our policy, tell me now rather than after I have found it.
- Theo Gallagher NoneUnderstood. If it is shorter, I will say so in the covering note, in the first line.
- Sabine Kranz NoneNext, the exit plan. DORA is explicit. If the arrangement ends, or the sub-processor fails, I must be able to show how we continue without disruption.
- Matteo Ricci NoneThis is one where I think we are in a decent place, because the data is in your own account. If the relationship ended tomorrow, the tables remain yours. What you would lose is the brain's layer on top. Theo, you have the detail.
- Theo Gallagher NoneYes. The exit plan has the steps in order. Revoke the connectors, export the indexed content and the configuration, confirm deletion of anything we hold, and certify it in writing. What I cannot yet show you is a tested run. A paper plan that has not been tried is only half an exit plan, so I would propose we do a walkthrough on a test account and I give you the record of it.
- Sabine Kranz NoneA tested walkthrough would be welcome. I will want to see the record, not a summary of the record.
- Theo Gallagher NoneThe record, with the steps and the outcomes. Agreed.
- Sabine Kranz NoneNow, DORA's register of information. Your entry for the call-transcription sub-processor will need to appear in ours as a subcontractor of an ICT provider. Do you notify us of changes to your sub-processors?
- Theo Gallagher NoneWe do, under the order form and the data processing terms. What I would suggest is that, for your account, we tell you before a change takes effect, not after, and that we name a contact on your side. Is that you, or somebody in your third-party risk function?
- Sabine Kranz NonePut me first, and copy our third-party risk function by role. I will give you the address in writing.
- Matteo Ricci NoneNoted, and I will make sure the account team has it. Sabine, may I ask whether there is any other entry in the register that worries you, apart from this one? I would rather we found it today.
- Sabine Kranz NoneTwo others I want to read again. The email connector sub-processor and the monitoring provider. The locations looked fine, but I want to see the dates on the confirmation. I will send those two questions after the call.
- Theo Gallagher NonePlease do. I will answer in the same numbered format, and where the platform team needs to answer I will say so.
- Sabine Kranz NoneOne more point, for completeness. If the transcription is moved to an EU region, I will need the old processing to be stopped, not run in parallel. And I will want to know what happened to audio that has already been processed.
- Theo Gallagher NoneThat is a good question and I do not have the answer today. I will put it to the platform team as a specific question: what happens to audio already processed, and can we evidence deletion. Whatever they say, I will give you the evidence and not the wording.
- Sabine Kranz NoneGood. Then let me summarise, so we are not each remembering a different call.
- Sabine Kranz NoneOne. The brain's own processing is in the EU region in our account, pending your diagram. Two. The call-transcription sub-processor processes audio outside the EU, and until that is not the case, my function does not support the upgrade. Three. You will send the location statement, the contract extract and the register entry. Four. You will send the access log sample with the retention document. Five. You will arrange the exit walkthrough. Six. I will send my two further questions.
- Theo Gallagher NoneThat is exactly my list as well. I would only add, under item three, the question about audio already processed, and the retention and deletion clause.
- Sabine Kranz NoneYes. Add them.
- Matteo Ricci NoneAnd from my side, I will tell our colleagues at Brenneck Pay who are sponsoring the expansion, so that they hear about the blocker from us and not through a rumour. Is that all right with you, Sabine?
- Sabine Kranz NoneThat is entirely fine. I will tell them myself as well. I do not want anyone thinking this is a delay for the sake of it. It is a finding.
- Matteo Ricci NoneUnderstood. For the third session, then, I suggest we aim to have the evidence in your hands beforehand, so that the session is for closing findings rather than opening new ones. I will not name a day until the platform team has agreed one.
- Sabine Kranz NoneAgreed. Send the evidence before the third session, with the day in your covering note once it is confirmed. Not after.
- Theo Gallagher NoneHere is the dated commitment, then, in the form I can give it today: the follow-up with the diagram, the access log sample and the retention document comes from me after this call, and the sub-processor evidence comes as soon as the platform team has confirmed it, with the day written in the note.
- Sabine Kranz NoneThank you. That will do. Thank you both, and thank you for being direct about the audio.
- Matteo Ricci NoneThank you, Sabine. Grazie, and speak soon. Best regards from us both.
- Theo Gallagher NoneThanks, Sabine. Speak soon.
Callsmade from