B-Brain
Hannah Lowe

Corstorphine Building Society / BB-Demo – Security Review

Callcompleted

Corstorphine Building Society logo Corstorphine Building Society · 2026-06-25 09:15

First security review with Euan Rattray and Struan Mackay. Euan held three open findings on standing access, data path and SSO, and BB-Demo left owing six written items. Only multi-factor was close to answered.

made from

What was said

What this says

Current to 13 Oct 26

First security review with Euan Rattray and Struan Mackay. Euan held three open findings on standing access, data path and SSO, and BB-Demo left owing six written items. Only multi-factor was close to answered.

What happened: On 25 Jun 2026 Hannah Lowe walked Euan Rattray and Struan Mackay through the architecture. Euan's findings were standing access, where data sits and who can see it, and single sign-on.

Customer view: Euan wants each control evidenced, not assured, and will treat a reference from another customer as background only. He called the missing model data flow a considerable gap.

Commercial: SSO and SCIM sit in the Enterprise tier, so the review is a gate on that sale. Euan keeps commercial matters away from the thread and asked that Tom Ashdown not be on it.

Watch: Struan said the decision timeline is 30 Sep 2026, but Euan will not shorten the review to fit a date. The call does not show the outcome.

AI · claude-sonnet-5-5 · 13 Oct 2026

AImade from

Themes

Current to 9 Oct 26
Theme
Security evidence demands
Importance
neutral
Sentiment
mixed
Voice
decision-maker
AImade from

Who was there

BB-Demo

CRMmade from

Them

CRMmade from

Follow-up

Next steps

Current to 9 Oct 26
  • Hannah to send the model data flow separately, this week if confirmed, ahead of the written pack in a couple of weeks.
  • Hannah to supply connector scopes, sub-processor list, incident history and the administrator answer in the pack.
  • Struan to provide restricted CRM record types so Hannah can agree permission test cases.
AImade from

Risks

Current to 9 Oct 26
  • Six written items are owed by BB-Demo, and Euan wants the model data flow, location and retention answer in days.
  • Standing access, connector scopes and the administrator and break-glass question stay open until written evidence arrives.
  • The 30 Sep 2026 decision date may not hold, because Euan will not shorten the review.
AImade from

Opportunities

Current to 9 Oct 26
  • SSO and SCIM in the Enterprise tier answer the identity finding directly.
  • A permission test on the society's own data, including restricted CRM records, can build the evidence Euan asks for.
  • Struan is practical and offered a restricted record list and an introduction to the identity provider owner.
AImade from

Transcript

  1. Hannah Lowe
    Hannah Lowe None
    Morning, Euan. Morning, Struan. Can you both hear me all right?
  2. Struan Mackay
    Struan Mackay None
    Morning. Yes, loud and clear. Euan, you're on mute.
  3. Euan Rattray
    Euan Rattray None
    Sorry. Good morning. Yes, I can hear you. Bit of a scramble getting into the room, the risk committee papers went out late yesterday.
  4. Hannah Lowe
    Hannah Lowe None
    No problem at all. Thanks for making the time. Before I start sharing anything, what do you most need to know from today? I'd rather aim at that than run my own agenda.
  5. Euan Rattray
    Euan Rattray None
    Right. I'll be direct. I have three open findings from the questionnaire you returned. Standing access to the Snowflake account is the first, where the data actually sits and who can see it is the second, and the third is single sign-on and how identities are managed. Please evidence each of them. I would rather not take an assurance in place of a control.
  6. Hannah Lowe
    Hannah Lowe None
    That's fair, and that's the right order for it as well. The short answer on the first one is that very little needs standing access. The longer answer is that I'd like to draw it so you can see it rather than take my word for it.
  7. Euan Rattray
    Euan Rattray None
    Please do.
  8. Hannah Lowe
    Hannah Lowe None
    Give me a second, just pulling the diagram up. Struan, can you see a box diagram with the society's Snowflake account on the left?
  9. Struan Mackay
    Struan Mackay None
    Yes, I can see it. Slightly small but readable.
  10. Hannah Lowe
    Hannah Lowe None
    I'll make it bigger. So, the important design point first. The brain runs inside your Snowflake account. It is not a copy of your data sitting in our environment. Your data stays where it is, and what we deploy is a set of objects inside your account that you own and can inspect.
  11. Euan Rattray
    Euan Rattray None
    When you say objects, what do you mean? Tables, procedures, something else?
  12. Hannah Lowe
    Hannah Lowe None
    To be precise, schemas, tables and views for the indexed content, plus the jobs that run the nightly refresh. Everything is created under roles that your team grants. We don't hold a login that sits outside of that.
  13. Euan Rattray
    Euan Rattray None
    Who creates the roles?
  14. Struan Mackay
    Struan Mackay None
    That would be me, or someone on my team. We would set up a dedicated role for the deployment and grant it only on the databases we agree. That's how we do it with the other platform tools.
  15. Hannah Lowe
    Hannah Lowe None
    Exactly that. And it's worth saying we would prefer you to create it, not us. It means the scope is something your own team has written down.
  16. Euan Rattray
    Euan Rattray None
    Good. Now the question I asked in the questionnaire and did not get a clear answer to. Who at BB-Demo has standing access to our account? Not occasional, not on request. Standing.
  17. Hannah Lowe
    Hannah Lowe None
    Yes. And I'm going to answer it carefully, because I know the wording in the questionnaire was loose. The design intent is that nobody at BB-Demo has standing access to your account. Support access is something you grant for a defined period and then revoke.
  18. Euan Rattray
    Euan Rattray None
    Design intent is not the same as what happens. How is that enforced?
  19. Hannah Lowe
    Hannah Lowe None
    Understood. It's enforced on your side, which is the point. Because the grant lives in your account, you can see it in your own access history, and you can set an expiry on it. What I don't want to do is tell you that we also have an internal control that does the same thing, unless I can show it to you in writing.
  20. Euan Rattray
    Euan Rattray None
    Then I'll note that as open until I see the written procedure.
  21. Hannah Lowe
    Hannah Lowe None
    That's right to note it. I'll put that in writing, with the procedure for how a support grant is requested, who approves it on your side and how it is removed.
  22. Struan Mackay
    Struan Mackay None
    Can I ask something practical on that? If we do grant support access, can we limit it to metadata, so they can see the job status but not the content?
  23. Hannah Lowe
    Hannah Lowe None
    Good question. In principle yes, because it's a role you define. But I'd like to check precisely what a support engineer needs to diagnose a failed refresh before I say that a metadata-only role is enough. I'd rather come back with the exact privileges than guess.
  24. Struan Mackay
    Struan Mackay None
    That works. If it's a list of privileges I can review it quickly.
  25. Euan Rattray
    Euan Rattray None
    Moving on. The connectors. For the use we are evaluating, intermediary distribution and member services, which systems would the brain read from, and with what credentials?
  26. Hannah Lowe
    Hannah Lowe None
    For the scope in the proposal it's the CRM, the helpdesk and the shared drive, and the call recorder if you decide to include it. Each connector has its own credential, created by you in the source system, stored as a secret in your account, and scoped read-only wherever the source allows it.
  27. Euan Rattray
    Euan Rattray None
    Wherever the source allows it. Which sources do not?
  28. Hannah Lowe
    Hannah Lowe None
    Fair challenge. I don't want to answer that from memory, so I'll go through each connector and list what scopes it requests. I'll mark any that ask for more than read access and explain why.
  29. Euan Rattray
    Euan Rattray None
    Please do. And what's the incident history?
  30. Hannah Lowe
    Hannah Lowe None
    On security incidents, I'd want to give you a considered written answer, not a line on a call. I'll ask for that to be prepared in a form you can put in front of the risk committee.
  31. Euan Rattray
    Euan Rattray None
    That is acceptable. I would like it to include anything affecting customer data, however minor.
  32. Hannah Lowe
    Hannah Lowe None
    Understood. Noted.
  33. Hannah Lowe
    Hannah Lowe None
    Right, second diagram. This one is the data path. Struan, stop me if I'm going too fast.
  34. Struan Mackay
    Struan Mackay None
    No, go on. I'm following.
  35. Hannah Lowe
    Hannah Lowe None
    So, a connector pulls from the source system overnight. The records land in staging tables in your account. Then the indexing job builds the searchable layer. When someone asks a question, the query runs against objects in your account, using the permissions of the person asking.
  36. Euan Rattray
    Euan Rattray None
    Using the permissions of the person asking. Say that again, please. This matters a great deal for us.
  37. Hannah Lowe
    Hannah Lowe None
    Yes. The aim is that the brain does not widen anyone's access. A colleague in member services should not see something through the brain that they could not see in the source system. I want to be careful here, though. How well that holds depends on how the source permissions are mapped, and that is something we design together with Struan's team, not something that just happens.
  38. Struan Mackay
    Struan Mackay None
    That's the bit I'd want to test properly. Our CRM has some quite specific restrictions, especially on anything touching vulnerable members.
  39. Hannah Lowe
    Hannah Lowe None
    Right, and that's what the demo on your own data is for. I would rather you try to break it with your hardest case than only show it the easy ones.
  40. Euan Rattray
    Euan Rattray None
    I would want that test written up, with the cases and the results. A demonstration is not evidence.
  41. Hannah Lowe
    Hannah Lowe None
    Agreed. We can agree the cases in advance and I'll document each result, including any that fail.
  42. Euan Rattray
    Euan Rattray None
    Where is the data stored? Not the platform, the actual location.
  43. Hannah Lowe
    Hannah Lowe None
    It is stored wherever your Snowflake account is hosted, because it is inside that account. We don't move it elsewhere. If you needed a particular region for residency, that is a matter of where your account sits, and we also have a dedicated residency add-on for EU and US cases, which I don't think applies to you.
  44. Struan Mackay
    Struan Mackay None
    Our account is already in a UK region, so that's settled on our side.
  45. Euan Rattray
    Euan Rattray None
    I will want that confirmed in the contract documents, not only on a call.
  46. Hannah Lowe
    Hannah Lowe None
    Yes. I'll make sure the architecture note says it plainly, and that the commercial team sees it as something you need reflected in the order form.
  47. Euan Rattray
    Euan Rattray None
    What about the language model? When a question is asked, where does the text go?
  48. Hannah Lowe
    Hannah Lowe None
    Good, that's the question I'd have asked. The short answer is that I don't want to hand-wave. There is a point where question text and retrieved passages are processed by a model, and what matters is where that runs and what is retained. I'll give you the exact data flow for that step in the written pack, and I will say what is retained and for how long, rather than say it now and get a detail wrong.
  49. Euan Rattray
    Euan Rattray None
    That's a considerable gap, and I'd prefer to have it closed before the next session.
  50. Hannah Lowe
    Hannah Lowe None
    Then that's my first action. You'll have it before we meet again.
  51. Struan Mackay
    Struan Mackay None
    Can I add that from the platform side I'd also want to see what logging we get? If a query goes through, can we see who asked what?
  52. Hannah Lowe
    Hannah Lowe None
    Yes, because queries execute in your account, they appear in your own query history alongside everything else. You also have the questions-asked record in the product itself. I'd show you both and explain how they relate, so you can decide what to forward into your monitoring.
  53. Euan Rattray
    Euan Rattray None
    Forwarding to our monitoring is a requirement, not a preference.
  54. Struan Mackay
    Struan Mackay None
    It should be straightforward, it's already how we handle the rest of the account.
  55. Hannah Lowe
    Hannah Lowe None
    Shall we turn to single sign-on? I think it's the third open item.
  56. Euan Rattray
    Euan Rattray None
    It is. We have an identity provider and I want every person who touches this system to come through it. No local passwords. And I want leavers removed promptly.
  57. Hannah Lowe
    Hannah Lowe None
    That fits the Enterprise tier, which includes SSO and SCIM provisioning. So authentication goes through your identity provider, and SCIM lets you create and remove users from your side, so a leaver is removed when you remove them centrally.
  58. Euan Rattray
    Euan Rattray None
    What happens to a local administrator account? There is always one.
  59. Hannah Lowe
    Hannah Lowe None
    Right. I need to be exact here. There is an initial administrator at setup. What I can't say off the top of my head is whether it can be fully disabled once SSO is enforced, or whether a break-glass account must remain. I'll confirm that and tell you which.
  60. Euan Rattray
    Euan Rattray None
    If a break-glass account must remain, I'll want to know how it is protected and who holds it.
  61. Struan Mackay
    Struan Mackay None
    We'd want it held by us. I'd be uncomfortable if it was anywhere else.
  62. Hannah Lowe
    Hannah Lowe None
    That seems the sensible position, and I'd expect us to agree. I'll write down what I find.
  63. Euan Rattray
    Euan Rattray None
    Multi-factor. Is it enforced by you or by us?
  64. Hannah Lowe
    Hannah Lowe None
    Through your identity provider, so by you. Whatever policy applies to your staff there is what applies to this system. We don't add a second layer of our own login for them.
  65. Euan Rattray
    Euan Rattray None
    Good. That is the first thing today that I can mark as close to answered.
  66. Hannah Lowe
    Hannah Lowe None
    I'll take that. I'd still like to put it in the pack with the setup steps, so it's evidence and not a conversation.
  67. Struan Mackay
    Struan Mackay None
    Can I ask about the nightly refresh? From a platform view I'd want to know what compute it uses and whether it can be capped.
  68. Hannah Lowe
    Hannah Lowe None
    It runs on a warehouse you assign, so the cost and the cap are yours to set. The refresh is meant to complete before seven in the morning, your local time, on business days. If it overruns because the warehouse is capped too low, you'd see that, and we'd talk about sizing.
  69. Struan Mackay
    Struan Mackay None
    Fine. That's the sort of control I can take back to my own team without much argument.
  70. Euan Rattray
    Euan Rattray None
    A different matter. Sub-processors. Who else touches our data on your side?
  71. Hannah Lowe
    Hannah Lowe None
    I'll be honest, that's one I'd rather not answer from memory. I'll send the current list with what each one does. If the model provider is on it, it'll be there, and I'll tie it to the data flow I'm writing up.
  72. Euan Rattray
    Euan Rattray None
    Please. And I will want notification of any change to that list.
  73. Hannah Lowe
    Hannah Lowe None
    Noted. That one I'd expect to sit in the contract terms, so I'll flag it to Tom as well.
  74. Euan Rattray
    Euan Rattray None
    Tom Ashdown, your account owner. I'll remind you I don't discuss commercial matters, so I'd ask that he not be on the security thread.
  75. Hannah Lowe
    Hannah Lowe None
    Understood entirely. The security material comes from me and goes to you and Struan only. Tom will see what the contract needs and nothing more.
  76. Struan Mackay
    Struan Mackay None
    For what it's worth, the timeline we have is to decide by 30 Sep 2026, so the committee would need the evidence well before then.
  77. Euan Rattray
    Euan Rattray None
    The committee meets when it meets. I will not shorten the review to fit a date.
  78. Hannah Lowe
    Hannah Lowe None
    Nor should you. We'll work to your pace and I'll make sure the pack is complete rather than quick.
  79. Hannah Lowe
    Hannah Lowe None
    Let me recap where we are, and then check I've got it right. Euan, stop me if I've misstated anything.
  80. Euan Rattray
    Euan Rattray None
    Go ahead.
  81. Hannah Lowe
    Hannah Lowe None
    One, standing access: your account, your roles, support access granted by you for a period, and I owe you the written procedure and the privilege list for a metadata-only support role. Two, connector credentials: I owe you each connector's scopes, marking anything beyond read. Three, the model step: the exact data flow, location and retention. Four, SSO and SCIM: the setup evidence, plus the answer on the administrator and break-glass account. Five, the sub-processor list and the incident history, prepared properly.
  82. Euan Rattray
    Euan Rattray None
    That is accurate. I would add the permission test. The cases agreed in advance, with the results documented.
  83. Hannah Lowe
    Hannah Lowe None
    Yes, six items, then. Thank you.
  84. Struan Mackay
    Struan Mackay None
    I'd add one from me. A short note on what objects get created in our account, so my team can see the footprint before they approve the roles.
  85. Hannah Lowe
    Hannah Lowe None
    Of course. I'll include the object list with the architecture note.
  86. Euan Rattray
    Euan Rattray None
    One further thing, for the record. I do not accept a reference from another customer in place of a control. If you offer one, I will treat it as background only.
  87. Hannah Lowe
    Hannah Lowe None
    That's clear, and I wouldn't offer one in place of evidence. If it's useful later, it's an extra, not a substitute.
  88. Struan Mackay
    Struan Mackay None
    Practically, how do you want to run the second session? I'd like to get the permission test into it if we can.
  89. Hannah Lowe
    Hannah Lowe None
    I'd suggest the written pack first, so Euan has time to read it, then a second session where we go through the findings one at a time and run the test cases live on your data. How does a couple of weeks from now sound for the pack?
  90. Euan Rattray
    Euan Rattray None
    A couple of weeks is acceptable provided the model data flow comes sooner. That one I would like in days.
  91. Hannah Lowe
    Hannah Lowe None
    Then I'll send the data flow separately, this week if I can get the detail confirmed internally. I won't promise a day until I have it.
  92. Euan Rattray
    Euan Rattray None
    That is a sensible way to put it. Thank you.
  93. Struan Mackay
    Struan Mackay None
    Anything you need from us before then? Access to a test area, sample data?
  94. Hannah Lowe
    Hannah Lowe None
    Two things. A list of the restricted record types in the CRM, so I can design the test cases around them, and the name of whoever manages your identity provider, so the SSO setup note matches your actual configuration.
  95. Struan Mackay
    Struan Mackay None
    I can do both. The identity provider is run by a colleague in IT, I'll put you in touch.
  96. Hannah Lowe
    Hannah Lowe None
    Lovely. Euan, anything else you'd like covered today, or shall we stop there?
  97. Euan Rattray
    Euan Rattray None
    Nothing further today. I will record the session as the first of the series, with the items we've listed all open except the multi-factor point.
  98. Hannah Lowe
    Hannah Lowe None
    That's a fair summary. Thanks to you both, this was useful. Speak soon.
  99. Struan Mackay
    Struan Mackay None
    Thanks, Hannah. Cheers, Euan.
  100. Euan Rattray
    Euan Rattray None
    Thank you. Good day.
Callsmade from

BB-Demo is a fictional company; every organisation and person here is invented. B-Brain is the tool. Built by site/build_site.py from the site tree, data as of Fri 9 Oct 2026. Help & Support

Help & Support

Open as a page

Help & Support

B-Brain is one place to read everything the company knows about its customers: the CRM, calls, emails, support tickets, product usage, invoices, documents, news and HR. Every page is built from those systems and the data is current to Fri 9 Oct 2026.

How to use the site

How to ask

Press Ask Brain in the header. Type a question, or pick one of the examples.

The site itself does not call an AI model; answers in Claude come from the same figures you see here.

What the data covers

DataRecords
Organisations225
People at customers862
BB-Demo staff58
Calls1,995
Email threads3,013
Support tickets1,159
Documents1,218
Deals315
Invoices285
Events49
News items119

Data as of Fri 9 Oct 2026. Text marked AI was written by the brain from the records listed in its made-from link; an AI output that cannot cite its evidence is refused and the previous text kept. Where two systems disagree (for example a contract and the CRM), the key facts show both values and mark the difference.

BB-Demo is a fictional company: every organisation, person and figure here is invented for this demonstration. B-Brain is the tool that reads its data.

Who to contact

Email support@b-brain.example or talk to your B-Brain account team. Tell us the page address and what looked wrong; a screenshot helps.
Help

Ask B

B-Brain · read-only