Corstorphine Building Society / BB-Demo – Security Review
Callcompleted
Corstorphine Building Society: documents · 2026-06-25 09:15
First security review with Euan Rattray and Struan Mackay. Nothing was closed: all three findings discussed await written evidence from BB-Demo, and data-scoping work sits with the customer.
What was said
What this says
Current to 11 Oct 26First security review with Euan Rattray and Struan Mackay. Nothing was closed: all three findings discussed await written evidence from BB-Demo, and data-scoping work sits with the customer.
What happened: Hannah Lowe took Euan Rattray through three open findings on data location, standing access and single sign-on. Struan Mackay raised connector credentials, role design and leavers.
Customer view: Euan preferred evidence to reassurance and summarised that nothing closed today. Several answers were deferred because Hannah would not answer from memory.
Commercial: This is the security review gating the Enterprise proposal, which includes SSO and SCIM. Delays on the written evidence directly hold up signature.
Watch: Outstanding items include the telemetry field list, a written statement on standing access, an incident summary, the delivery mechanism and the break-glass answer. Struan needs about a week for the source and field list.
Themes
Current to 9 Oct 26Theme
Security review findings
Importance
neutral
Sentiment
mixed
Voice
decision-maker
Who was there
BB-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Hannah Lowe to send the architecture diagram with telemetry list, the standing access statement, the incident summary and a numbered SSO answer before the next session.
- Struan Mackay to send the source and field list, the role and network policy set-up, and the service user standard.
- Hannah Lowe to tell Tom Ashdown today so he can find a slot covering encryption, key management and subprocessors.
Risks
Current to 9 Oct 26- All three findings stay open until BB-Demo supplies written evidence and a logged test.
- A break-glass administrative account outside SSO has not yet been confirmed or denied.
- Member personal data from the helpdesk and email may come through, and its scope is not yet agreed.
Opportunities
Current to 9 Oct 26- Answering with clear written evidence can close the findings and move the Enterprise deal towards signature.
- Struan Mackay offered a sandbox account for a non-production test.
Transcript
Hannah Lowe NoneMorning, Euan. Morning, Struan. Can you both hear me alright?
Struan Mackay NoneMorning. Yes, loud and clear. Euan, I think you're on mute.
Euan Rattray NoneApologies. Good morning both. Is that better?- Hannah Lowe NoneMuch better. Thanks for making time. Before I share anything, what do you most need to know from today? I'd rather spend the hour on your questions than on my slides.
- Euan Rattray NoneRight. I'll go through my open findings, if I may, because that's how I track these. I have four open from the questionnaire you returned. Today I'd like to close, or at least properly progress, the first three, and they all hang on architecture, standing access and single sign-on.
- Hannah Lowe NoneThat's exactly the right three for session one. Go ahead.
- Euan Rattray NoneFinding one. Your answer on data location says processing happens within the customer's Snowflake account. It doesn't say whether anything leaves the account. Please evidence that.
- Hannah Lowe NoneFair. The short answer is that your content stays in your account. The longer answer is that there's a difference between content and operational telemetry, and the questionnaire blurred the two. Do you mind if I share the diagram and walk it?
- Euan Rattray NonePlease do.
- Hannah Lowe NoneOkay, you should see it now. Can you see the box labelled customer Snowflake account?
- Struan Mackay NoneYes, I see it. Quite small though, could you zoom in?
- Hannah Lowe NoneIs that better? Good. So, inside that box is everything that touches your data. There's a dedicated database for the brain, the tables where the indexed records sit, the search structures, and the application objects that run the questions. Your CRM, your helpdesk, your mailboxes, they all land in that database through the connectors, and the connectors run inside the account too.
- Euan Rattray NoneAnd outside the box?
- Hannah Lowe NoneOutside the box there's our side: the release pipeline that delivers new versions of the application, and a small amount of operational telemetry. By that I mean things like whether a refresh job succeeded or failed. I'm being careful here, because I don't want to recite from memory exactly which fields are in that telemetry. I'll put that in writing, with the field list, so you can test it.
- Euan Rattray NoneThat would be welcome. I'd want to know specifically whether any record content, or any identifier that could be tied back to a member, is in it.
- Hannah Lowe NoneUnderstood. To be precise, my expectation is that it's not, but my expectation isn't evidence, so I'll give you the list and the answer together.
- Euan Rattray NoneThank you. I'd rather have that than a reassurance.
- Struan Mackay NoneCan I come in on the connectors? Where do they get their credentials? Because for us the question is where the secrets for the CRM and the helpdesk live.
- Hannah Lowe NoneGood question. They're held in your account, using Snowflake's own secret handling, not on our side. You create them, you rotate them. We never see them in clear.
- Struan Mackay NoneRight, mm. So if we rotate the CRM credential, the connector just picks up the new one?
- Hannah Lowe NoneIt should, on the next run. Actually, let me say that properly: I've seen it work that way in other deployments, and I'll confirm the exact behaviour for your set of connectors when we do the design. I'd hate to promise it and then have a refresh fail at night.
- Euan Rattray NoneLet me move to finding two, since it's the one that matters most to my committee. Who has standing access to the society's Snowflake account? And I mean standing, as in without a request, without an approval, without an expiry.
- Hannah Lowe NoneTo be precise, in the design, nobody at BB-Demo has standing access to your account. The brain runs under a service role that your team creates and owns, with the privileges you grant it and no more. If one of our engineers needs to look at something for support, that's access you grant to a named person, for a limited period, and you can revoke it whenever you like.
- Euan Rattray None'In the design.' Is that how it works in practice with your other customers?
- Hannah Lowe NoneThat's the model for every deployment, and I'm not aware of an exception. But I'm wary of saying 'never' about eighty or so other accounts from memory, so I'll raise it with our head of security and give you a written statement you can hold us to.
- Euan Rattray NoneI'd appreciate that. And what's the incident history? Has there ever been an occasion where a BB-Demo person has had access they should not have had?
- Hannah Lowe NoneI don't know of one, but I'm not the right person to give you a clean answer, and I'm not going to guess in front of your security lead. I'll ask for the incident summary we can share under your confidentiality terms and send it with the rest.
- Euan Rattray NoneGood. I'll note that as outstanding rather than closed.
- Struan Mackay NoneOn our side, can I ask about the service role itself? We'd create it, fine, but what does it need? Because our platform team is quite strict about role sprawl.
- Hannah Lowe NoneSure. Let me pull up the role sheet. So, there's a role that owns the brain's database and schemas, a role for the connectors to write, and a role for reading, which is what the application uses when somebody asks a question. Three roles, and the read one is the one that respects your existing masking and access policies.
- Struan Mackay NoneRespects them how? Because if a member's details are masked for most of our staff, I need the brain to show the same thing.
- Hannah Lowe NoneThat's the point of running inside your account. The question runs as a role in your account, so Snowflake's policies apply to it. The caveat, and I want to be straight about it, is that you have to map who is allowed to ask what. We'll build that mapping with you, and I'd want to test it with you on real examples before anyone relies on it.
- Euan Rattray NoneIs member personal data in scope at all? My understanding was this was about broker firms.
- Struan Mackay NoneMostly, yes. The aim is one view of each mortgage broker firm for intermediary distribution and for member services. But member services will have cases that touch individual members, so some personal data will come through, particularly from the helpdesk and from emails.
- Euan Rattray NoneThen I need that scoped explicitly. Which sources, which fields, and whether we exclude some of them at the connector rather than relying on masking.
- Hannah Lowe NoneAgreed, and excluding at the connector is cleaner. Less in the brain means less to protect. I'd suggest that's a task for the next session: Struan lists the sources, and we mark every field as in, masked or out.
- Struan Mackay NoneYeah, I can do that. I'd need a week or so, honestly, because the helpdesk fields are a bit of a jungle.
- Euan Rattray NoneBack to standing access, if you don't mind. You said support access is granted by us. Through what? By whom? And is it logged somewhere I can see?
- Hannah Lowe NoneGranted by you, through whatever your process already is for a third party getting a role in Snowflake. I'd expect that to be a ticket and an approval on your side. The logging is Snowflake's own access history in your account, so you already own the record. We don't hold the only copy.
- Euan Rattray NoneThat's a better answer than 'trust us'. Who has standing access to the account on your side of the design, then? I mean the application itself. Does anything on your side call into the account on a schedule?
- Hannah Lowe NoneGood catch. The application runs inside the account, so the schedules are your tasks, not our systems calling in. The one thing I want to verify before I say it flatly is how the release pipeline delivers an update, because that's the only place our side touches your account. I believe it's a controlled deployment that you approve, but I'll write that up properly with the diagram, and I'll check it with our head of security first.
- Euan Rattray NonePlease do. For the avoidance of doubt, finding two stays open until I have that in writing and I've seen the logs from a test.
- Hannah Lowe NoneUnderstood, and that's reasonable. A test in a non-production account first, if you have one.
- Struan Mackay NoneWe do. We have a sandbox account for the platform team. I could stand that up for the review.
- Hannah Lowe NoneThat would be ideal.
- Euan Rattray NoneFinding three, then. Single sign-on. Your response says SSO is available on the Enterprise tier. Available is not the same as configured the way I need it.
- Hannah Lowe NoneRight. So, Enterprise includes SSO and SCIM. Users sign in through your identity provider, and provisioning and deprovisioning come from the same place. The point is that there's no separate list of people to maintain in the brain.
- Euan Rattray NoneWhich means no local passwords for ordinary users?
- Hannah Lowe NoneFor ordinary users, no. The part I need to confirm is whether there's any local administrative account that sits outside SSO, a break-glass account. I don't want to say yes or no from memory, because it's precisely the kind of thing you'd test.
- Euan Rattray NoneIt is precisely what I'd test. If there is one, I need to know who holds it, how it's stored and how its use is alerted.
- Hannah Lowe NoneNoted, all three. I'll answer as a numbered list so you can map it to your findings.
- Euan Rattray NoneThat's how I'd prefer it. Thank you.
- Struan Mackay NoneOn SCIM, what happens to a leaver? Because our joiners, movers and leavers process is audited, and I'd want the brain to fall in line, not be an exception.
- Hannah Lowe NoneWhen the account is disabled in your identity provider, SCIM removes or deactivates them in the brain. The question I'd ask is how quickly, and whether any session already open survives. I'll find out the session lifetime and put it in the same document.
- Euan Rattray NoneSession lifetime, re-authentication for sensitive actions, and whether you can force a sign-out centrally. Please add those.
- Hannah Lowe NoneAdding them now. Session lifetime, re-authentication, forced sign-out. Anything else on that one?
- Euan Rattray NoneRole mapping. Do group memberships in our identity provider drive what someone can see in the brain, or is there a second set of permissions held by BB-Demo?
- Hannah Lowe NoneThe short answer is that groups drive it. The longer answer is that the application has a few roles of its own, such as who can administer connectors and who can build dashboards, and those would be assigned from groups. What a person can actually see in the data stays governed by the Snowflake role, so there's no second set of data permissions. I'll draw that on the diagram, because I think it's clearer as a picture.
- Struan Mackay NoneThat fits how we'd want it. Fewer places to review.
- Euan Rattray NoneFewer places to review is the right instinct. Hannah, may I summarise where I think we are, and you correct me?
- Hannah Lowe NonePlease.
- Euan Rattray NoneOne: content remains in our account, but I'm awaiting the telemetry field list. Two: no standing BB-Demo access in the design, but I'm awaiting a written statement, the incident summary, the delivery mechanism and a logged test. Three: SSO and SCIM for ordinary users, but I'm awaiting the break-glass answer and the session details. Nothing closed today.
- Hannah Lowe NoneThat's a fair and accurate summary, and I'd rather you didn't close anything today on my say-so. Everything on that list I'll evidence.
- Euan Rattray NoneThen we understand each other.
- Struan Mackay NonePractically, then. What do you need from me, and by when?
- Hannah Lowe NoneThree things. The list of sources with fields marked in, masked or out. The current role and network policy set-up in the account you'd use for the test. And whether your platform team has a standard for service users, so we design to it rather than the other way round.
- Struan Mackay NoneFine. I'll get those over before the next session. And I'll ask our platform team about the sandbox account today.
- Hannah Lowe NoneBrilliant. And from me: the architecture diagram with the telemetry list, the written statement on standing access, the incident summary, and a numbered answer on SSO. I'll try to have it in your inbox before the next session, Euan, so you've time to read it properly.
- Euan Rattray NonePlease. And when we meet again, I'd like to take encryption, key management and the list of subprocessors, if any.
- Hannah Lowe NoneAgreed. Tom Ashdown will help us find a slot, since he's coordinating the evaluation on our side. I'll let him know today.
- Struan Mackay NoneSounds good. Thanks, Hannah. Thanks, Euan.
- Euan Rattray NoneThank you both. Speak soon.
- Hannah Lowe NoneThanks, both. Speak soon.
Callsmade from