Corstorphine Building Society / BB-Demo – Proposal
Callcompleted
Corstorphine Building Society · 2026-05-12 09:30
Alasdair Gunn, the Chief Operating Officer, said he will not take the deal to the board or sign until security and supplier risk are complete. He asked for that work to start now, in parallel with commercial terms.
What was said
What this says
Current to 13 Oct 26Alasdair Gunn, the Chief Operating Officer, said he will not take the deal to the board or sign until security and supplier risk are complete. He asked for that work to start now, in parallel with commercial terms.
What happened: Tom Ashdown walked Alasdair Gunn through the Enterprise proposal and Hannah Lowe covered the architecture. Alasdair said he was content for the work to proceed.
Customer view: Alasdair wants supplier risk started now and asked for explicit statements that the brain does not write back. Morag Cowie read his instruction to start the process as him leaning in.
Commercial: Tom said the proposal is £155k, the total deal value and not an annual price. The expected close of 30 Sep 2026 is a working date, and the evidence does not show whether it was met.
Watch: Nothing is signed until Alasdair says the risk work is done. The mailbox source will draw the most security scrutiny.
Themes
Current to 9 Oct 26Theme
Proposal and supplier risk
Importance
neutral
Sentiment
positive
Voice
decision-maker
Who was there
BB-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Morag Cowie to open the supplier-risk process with the third-party risk team and confirm their questionnaire format.
- Tom Ashdown to send the proposal pack with the commercial split and service levels in plain words.
- Hannah Lowe to send the security overview and architecture note, then answer the risk team's questionnaire.
Risks
Current to 9 Oct 26- Alasdair Gunn will not take the deal to the board or sign until security and supplier risk are complete.
- The society's own third-party risk questionnaire may take longer to answer than a standard one.
- The mailbox source holds the most personal information and will draw security scrutiny.
Opportunities
Current to 9 Oct 26- Alasdair Gunn said he is content for the work to proceed, with supplier risk starting in parallel.
- Morag Cowie wants managers to see their own broker list on day one, which supports adoption.
Transcript
Tom Ashdown NoneMorning, Morag. Can you hear me all right? I've got the little green bar moving on my side.
Morag Cowie NoneI can hear you fine, Tom. Morning. Hannah, are you there as well?
Hannah Lowe NoneI'm here, yes. Morning both. Sorry, just getting my headset to behave.- Tom Ashdown NoneNo drama. How's your week been, Morag? Busy, I'd imagine.
- Morag Cowie NoneBusy is the word. I'll give you the broker story of the week, because it's the reason we're all on this call. One of our bigger broker firms in Fife went quiet on us for a fortnight. Two of my business development managers each thought the other one had spoken to them. Nobody had. We only found out because a member rang the branch to ask where their case had got to.
- Tom Ashdown NoneAh, that's never a good phone call to take.
- Morag Cowie NoneNo. And it's exactly the thing we want to stop. Which brokers are slipping, and who in the building society knows about it? Right now the answer is in about four different places.
- Hannah Lowe NoneThat's useful context, actually, because it's what I built the walkthrough around last time. We'll come back to it.
- Morag Cowie NoneAlasdair's just joining, I think. Yes, there he is. Alasdair, good morning.
Alasdair Gunn NoneGood morning, Morag. Good morning, everyone. Apologies, I was finishing something with the board secretary. Before we start, may I ask what decision is required of me today?- Tom Ashdown NoneFair question, and thanks for joining, Alasdair. I'll be straight with you. Today's the proposal. We want to walk you through what we're putting forward for the Enterprise tier, and Hannah will cover how it would sit inside your environment. You don't need to sign anything. What we'd like is a view on whether it's worth taking forward.
- Alasdair Gunn NoneUnderstood. Thank you. Please go ahead.
- Tom Ashdown NoneRight. So, to recap where we've got to, because I know it's been a few weeks. Morag came to us wanting one view of each broker firm, so intermediary distribution and member services are looking at the same picture. At the moment the mortgage submissions sit in your CRM, the conversations sit in email and on calls, and the member side sits in the service tickets. The brain pulls those into one place that you can ask questions of, and it runs inside your own Snowflake account, so your data stays with you.
- Morag Cowie NoneWhich is the bit that matters for us. Our members come first, and so does where their information lives.
- Hannah Lowe NoneYes, and I'll be precise about that, because it's easy to say it loosely. BB-Demo is deployed inside your Snowflake account. We don't copy your data out into a separate platform of ours. The short answer is that your data stays in your tenancy. The longer answer is that there are still access questions: who at BB-Demo can reach the deployment, under what conditions, and how that's logged. I'll put all of that in writing for you rather than rely on this call.
- Alasdair Gunn NoneThank you. That is helpful. How does this sit with our outsourcing policy?
- Hannah Lowe NoneRight, so, I don't want to guess at your policy, because I haven't read it. What I can say is that we'd be a supplier processing data on your behalf, and as a regulated mutual you'll be treating us as an outsourcing or at least a material supplier relationship. So I'd expect your supplier-risk team to want a fair amount from us. We have done this before with regulated customers.
- Alasdair Gunn NoneWho else in our sector uses you?
- Tom Ashdown NoneGood question. I'd want to confirm exactly what I'm able to say there before I name anyone, because customers have different views on being referenced. Leave that with me and I'll come back to you in writing, Alasdair. I don't want to say something off the cuff on a recording.
- Alasdair Gunn NoneThat is fine. I would rather have an accurate answer than a quick one.
- Morag Cowie NoneLet's not overcomplicate it, Alasdair. I think what you're asking is the same thing the board will ask. Is it safe, and is it worth it.
- Alasdair Gunn NoneBroadly, yes. The board will ask. And they will ask in that order.
- Tom Ashdown NoneThen let's do it in that order. Hannah, do you want to take the architecture first? Then I'll do the commercial bit.
- Hannah Lowe NoneSure. I'll keep it concrete. Take one broker firm, say the one in Fife Morag mentioned. Today, to see everything about that firm, someone has to open the CRM, search the shared mailbox, and then ask the service team to look at tickets. With the brain, those three sources are connected, indexed overnight, and a business development manager can type, in plain English, something like: has this firm's submission volume dropped in the last two months, and have we spoken to them since.
- Morag Cowie NoneThat is exactly the question.
- Hannah Lowe NoneAnd the answer comes back with the sources it drew on, so the person can click through and check it. That matters, because I'd never want your team trusting an answer they can't trace.
- Alasdair Gunn NoneDoes it write back to any of our systems?
- Hannah Lowe NoneGood one. To be precise, no. The connectors read from your systems. The brain doesn't change records in your CRM or your mailbox. Everything it produces lives in the Snowflake environment. If you later wanted something that writes back, that would be a separate conversation and a separate review.
- Alasdair Gunn NoneGood. Please note that I would want that stated explicitly in anything you send.
- Hannah Lowe NoneNoted. It'll be in the written pack.
- Morag Cowie NoneCan I ask about the people side? My business development managers are not technical. If they have to learn a new tool, half of them won't use it.
- Tom Ashdown NoneThat's fair, and honestly it's what trips most people up. It's the reason we put training in the plan. Hannah, you've done a few of these sessions.
- Hannah Lowe NoneI have. The honest picture is that people don't learn it from a manual. They learn it by asking it a question about a broker they actually look after. So we'd run the first sessions on your real firms, with Morag's team, and build a handful of saved questions they can reuse every Monday morning. Then the people who take to it become the ones their colleagues ask.
- Morag Cowie NoneThat works for me. I'd want the managers to see their own broker list on day one, not a demo.
- Hannah Lowe NoneAgreed. That's how we'd do it.
- Tom Ashdown NoneOkay, shall I do the numbers? Alasdair, I know you'll want these cleanly. The proposal comes to one hundred and fifty-five thousand pounds. To be clear on what that is, it's the total value of the deal, the figure we've put against the opportunity. It is not an annual price on its own. The order form will split out exactly what is the one-off implementation and what is the ongoing subscription, and I'll make sure that split is in the document so nobody has to infer it.
- Alasdair Gunn NoneThank you for being explicit. I would not want the board to read that as a yearly cost if it is not.
- Tom Ashdown NoneNo, absolutely. I'd rather it was boring and clear.
- Morag Cowie NoneAnd the timeline, Tom? I'm conscious the board calendar is what it is.
- Tom Ashdown NoneSo we've pencilled Wednesday 30 September 2026 as the expected close. That's a working date, not a promise. It depends entirely on how quickly the supplier-risk and security work can go, and that's very much in your hands as much as ours. If it needs to move, it moves, no drama.
- Morag Cowie NoneI'd rather we told the board a realistic date than a hopeful one.
- Alasdair Gunn NoneI agree with Morag. And that brings me to the point I wanted to raise. I will not be in a position to take this to the board, nor to sign anything, until security and supplier risk are complete.
- Tom Ashdown NoneCompletely understood. That's the right order.
- Alasdair Gunn NoneSo I would like the supplier-risk process to start now, in parallel, rather than after we have agreed commercial terms. Morag, I would ask that you open it with our third-party risk team this week and make them aware this is a candidate for a material supplier.
- Morag Cowie NoneI'll do that today, Alasdair. I know who to speak to. And I'll tell them to expect a full questionnaire from BB-Demo, and to be clear it's an Enterprise-tier engagement.
- Alasdair Gunn NoneThank you. And I would ask BB-Demo to respond to their requests as a priority.
- Hannah Lowe NoneWe will. That's actually something I look after. For an Enterprise engagement I run the security review myself, so you'll have one person to ask rather than a queue. If your team sends a questionnaire, I'll answer it in full. And where I'm not certain of an answer, I'll check it with our security lead before I send it rather than give you something approximate.
- Alasdair Gunn NoneThat is what I would hope for. I would rather a slower correct answer.
- Hannah Lowe NoneUnderstood. It'll be right first time, or I'll tell you it's still being checked.
- Tom Ashdown NoneCan I just check I've got the sequence, so nobody's guessing afterwards? Morag opens the supplier-risk process with your third-party risk team. Hannah picks up whatever they send and answers it. Meanwhile I keep the commercial paperwork moving but nothing gets signed until Alasdair says the risk work is done.
- Alasdair Gunn NoneThat is correct.
- Morag Cowie NoneAnd I'd ask that nobody on the BB-Demo side promises a date to the board that the risk team hasn't agreed first.
- Tom Ashdown NoneHa, no. We wouldn't dream of it. Dates come from your side on that one.
- Hannah Lowe NoneOne practical thing, if I may. When the third-party risk team makes contact, it would help me to know whether they use their own questionnaire or want us to fill in a standard one. The short answer is that either is fine. The longer answer is that their own format usually takes a bit longer, because I have to map our controls onto their wording, and I'd rather allow the time up front.
- Morag Cowie NoneI think it'll be their own. They like their own. I'll confirm when I speak to them and let you know.
- Hannah Lowe NonePerfect. I'll put that in writing so we don't lose it.
- Alasdair Gunn NoneOne further question, if I may. In the event of a problem at BB-Demo, who do we speak to, and how quickly?
- Tom Ashdown NoneGood one, and I won't quote the service levels from memory. They're set out by tier and they can be adjusted in the order form, so I'd rather give you the exact wording in the proposal pack than paraphrase it here. I'll make sure that section is easy to find.
- Alasdair Gunn NoneThat is acceptable. Please include the arrangements for a data incident specifically.
- Hannah Lowe NoneYes, I'll cover that in the security pack, including who notifies whom, and in what sort of timeframe. I'd rather you read it than rely on my summary.
- Morag Cowie NoneAlasdair, is there anything else you need from us before you drop off? I know you've another meeting.
- Alasdair Gunn NoneNothing further for now. I am content for the work to proceed on that basis. Thank you, Tom, Hannah. Morag, please keep me informed once the third-party risk team has responded.
- Morag Cowie NoneWill do. Thanks, Alasdair.
- Tom Ashdown NoneThanks, Alasdair. Speak soon.
- Alasdair Gunn NoneGood morning, all.
- Morag Cowie NoneRight, he's gone. Well. That went better than I feared, to be honest.
- Tom Ashdown NoneDid it? I thought he was happy enough. He asked the right questions, anyway.
- Morag Cowie NoneHe did. Alasdair doesn't say much, so when he says start the process, that's him leaning in. He won't say it twice.
- Tom Ashdown NoneGood to know. We've got a bit of time left. Shall we use it to get the broker view properly nailed down, Hannah? Morag, you were going to tell us which sources matter first.
- Morag Cowie NoneYes. If I'm honest, the first thing is the submissions record in the CRM, then the mailbox where the business development managers keep their broker correspondence, then member services tickets. I'd leave anything else for later. Let's not overcomplicate it.
- Hannah Lowe NoneThat's sensible. Starting with three sources gets you the broker picture quickly, and we can add more once people trust it. One thing I'd flag early: the mailbox is where a security conversation will focus, because it holds the most personal information. So I'd want to be clear on which mailboxes, which folders, and who agrees that.
- Morag Cowie NoneUnderstood. I'll make sure that's something I raise with the risk team and not something that gets discovered halfway through.
- Tom Ashdown NoneBrilliant. Okay. So from my side, I'll send the proposal pack today, with the commercial split spelled out and the service levels in plain words. Hannah sends the security overview and the architecture note, and Morag opens things with the third-party risk team. Does that sound about right?
- Morag Cowie NoneThat's right. Send it to me and I'll pass it on to Alasdair when it's worth his time.
- Hannah Lowe NoneFine by me. Once Morag tells me who the contact in third-party risk is, I'll introduce myself directly, so they don't have to go through anyone.
- Tom Ashdown NoneLovely. Let's get something in the diary for a catch-up after they've had a first look, so we're not waiting on each other. I'll send a few slots.
- Morag Cowie NonePlease do. And thanks both. Kind regards, speak soon.
- Hannah Lowe NoneThanks, Morag. Thanks, Tom.
- Tom Ashdown NoneCheers, both. Have a good rest of the week.
Callsmade from