Corstorphine Building Society / BB-Demo – Security Review
Callcompleted
Corstorphine Building Society: documents · 2026-08-20 14:15
Security review with Corstorphine's security and supplier risk leads. Two findings stay open until BB-Demo evidences standing access and closure of the July outage actions. Five supplier-file documents are outstanding. Decision target is 30 Sep 2026.
What was said
What this says
Current to 11 Oct 26Security review with Corstorphine's security and supplier risk leads. Two findings stay open until BB-Demo evidences standing access and closure of the July outage actions. Five supplier-file documents are outstanding. Decision target is 30 Sep 2026.
What happened: Euan Rattray went through two open findings, standing access and the July outage. Catriona Muir added five supplier-file documents. Hannah Lowe was candid about what she could not yet evidence.
Customer view: Euan wants proof, not status. He said "I won't close anything without evidence." Catriona wants the questionnaire right first time and any review commitment written into the contract.
Commercial: Tom Ashdown restated the deal at £155k including implementation, with the split to follow in writing. Neither customer contact would discuss price. The decision target is 30 Sep 2026, which is before the as-of date, and the evidence does not show the outcome.
Watch: The access list and incident actions were promised for the end of the following week, and the register extract may slip. Late or weak evidence puts the Enterprise deal at risk.
Themes
Current to 9 Oct 26Theme
Security review, open findings
Importance
renewal
Sentiment
mixed
Voice
decision-maker
Who was there
BB-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Hannah Lowe to send the access list, role definitions and incident action evidence, and tell Euan if the register extract slips.
- Tom Ashdown to confirm in writing where a review commitment sits (order form or security schedule) and the exact price split.
- Tom Ashdown to send the insurance evidence and subcontractor list; Hannah to send the exit plan technical section, continuity summary and questionnaire.
Risks
Current to 9 Oct 26- Both security findings stay open until dated evidence arrives, and the incident register extract may slip.
- Some July outage actions are marked done without evidence, which the risk committee will question.
- Review frequency is not in the draft contract, and Catriona wants it there.
Opportunities
Current to 9 Oct 26- Straight, evidenced answers can close the findings and move the Enterprise deal towards the supplier file.
- Running inside the customer's own Snowflake account lets BB-Demo offer role definitions that show what a support grant contains.
Transcript
Tom Ashdown NoneAfternoon, afternoon. Can you hear me alright? I've got a bit of an echo on my side.
Catriona Muir NoneAfternoon Tom. Yes, you're fine. Slight echo but I can hear you.
Euan Rattray NoneGood afternoon. I can hear you both. I'm on the wired connection today, so I should be stable.- Tom Ashdown NoneBrilliant. How's your week been? Anything settled yet or is it still all hands?
- Catriona Muir NoneBusy. We've got the board pack going out and half my supplier files seem to have decided to expire at once. But we're fine. Thank you for asking.
- Tom Ashdown NoneNo drama, we'll try not to add to the pile. Hannah, are you with us?
Hannah Lowe NoneI'm here, sorry, I was just muting a notification. Hello both. Before we start, Euan, what do you most need to leave this call with? I'd rather aim at that than walk through everything again.- Euan Rattray NoneThat's helpful, thank you. I'll be direct. I have two findings open from the first session and I'd like to go through them in order. Then I want the July outage dealt with properly, because the two are connected as far as I'm concerned.
- Hannah Lowe NoneUnderstood. Go ahead.
- Euan Rattray NoneFinding one is standing access. Who has standing access to anything that holds our data, whether that's our Snowflake account or your own environment? I wrote that question down last time and I don't believe I got an answer that I could put in front of the risk committee.
- Hannah Lowe NoneFair. The short answer is that the design doesn't give BB-Demo engineers standing access to your data. The longer answer has a part that I owe you in writing, so let me be precise about which is which.
- Euan Rattray NonePlease do.
- Hannah Lowe NoneThe brain runs inside your own Snowflake account. So the data doesn't leave your estate and the roles that touch it are roles that your administrators create and own. If one of our engineers needs to look at something, say a connector that has stopped loading, your administrator grants access for that piece of work and then removes it. That's how it's meant to work.
- Euan Rattray NoneMeant to work. Is that enforced or is that a procedure?
- Hannah Lowe NoneGood question, and I'd rather not blur it. The grant sits in your account, so you control it technically. What is a procedure is the expectation that grants are time-limited. Nothing on our side stops your administrator leaving a grant in place. So I'd describe that as a control you own with a process we recommend, not a control we enforce.
- Euan Rattray NoneThank you. That's a more honest answer than I had last time. So the access of your engineers to the Snowflake account is only what we give them.
- Hannah Lowe NoneYes. And I'll put that in writing, with the role definitions, so you can see what a support grant would actually contain.
- Euan Rattray NoneAnd your own environment? Build pipelines, the place where the code is kept. Who has standing access there?
- Hannah Lowe NoneThat's the part I can't answer fully on this call. There is a list, and I believe it's short, but I won't give you a number from memory, because if I'm wrong it ends up in your file. I'll get the access list confirmed by our security lead and send it with the date it was taken.
- Euan Rattray NonePlease evidence that. A list with a date, and a statement of who reviews it and how often. I'd like that to be a review that actually happens, not one that exists on paper.
- Catriona Muir NoneCan I just flag, Euan, that if the review frequency ends up as a commitment then I'd like it in the contract. Is that in the contract at the moment, Tom?
- Tom Ashdown NoneNot in the draft as it stands, no. I'd rather be straight with you. Leave that with me, I'll speak to our legal side about where it sits, either the order form or the security schedule, and come back to you in writing.
- Catriona Muir NoneThank you. I'll need that for the file.
- Euan Rattray NoneRight. Finding one stays open until I have the role definitions and the dated list. Finding two. The incident.
- Hannah Lowe NoneYes. Before you ask, I know the July outage is the thing you've been waiting on. I'd like to take it in two halves, what happened and what has been done since. Is that alright?
- Euan Rattray NoneThat's fine. But I should say I'm less interested in the narrative than in the closure of the actions. What's the incident history for this product? Is July the only one?
- Hannah Lowe NoneFor the record I'd rather not say only, because I haven't got the full register in front of me and I don't want to overstate it. I'll ask for the incident register to be extracted and I'll send you what it shows, including July.
- Euan Rattray NoneThank you. Please do not summarise it. I'd like the entries.
- Hannah Lowe NoneUnderstood, the entries themselves. On July: the service was unavailable for a period, customers on the affected platform were told, and a post-incident review followed. The review produced a list of actions. That list is what I think matters most for your question.
- Euan Rattray NoneHow many actions, and how many are closed?
- Hannah Lowe NoneRight, and this is where I have to be careful. I have the review document, and most of the actions are marked done. But marked done is a status, not evidence, and I take your point on that. For a couple of them I can't point you at the thing that proves it. I'd rather tell you that than say they're all complete.
- Euan Rattray NoneI appreciate that. That's the finding, in effect. The report says done. I need to see that it's done. A change record, a test result, a monitoring rule, whatever is appropriate to that action.
- Hannah Lowe NoneAgreed. What I'll do is take each action, state what it was, what the evidence is, who closed it and when. Where there's no evidence yet I'll say so and give the date it will exist.
- Tom Ashdown NoneCan I come in there, just so I understand? Euan, is it the content of the actions you're worried about, or is it more that you can't see the proof?
- Euan Rattray NoneMostly the proof, Tom. If the actions are sensible and evidenced, I'm content. A sensible action with no evidence behind it is a finding. An action that I think is weak, I'll say so, and we'll discuss it.
- Tom Ashdown NoneFair enough. That's clear.
- Euan Rattray NoneOne more on this. Did the outage affect the integrity of anything, or only availability? The risk committee will ask me directly.
- Hannah Lowe NoneThe short answer is that it was an availability event. The longer answer is that I want the review to say so in plain words, and I'll check that it does before I repeat it to you as fact. If there is any wording in it about data being affected, I'll tell you, even if it's awkward.
- Euan Rattray NoneThat's all I ask.
- Catriona Muir NoneCan I bring in my list now? I don't want the time to go. I have a few documents outstanding for the supplier file and I'll go through them quickly.
- Tom Ashdown NonePlease, go on.
- Catriona Muir NoneFirst, the exit plan. What's the exit plan? If the society decided to leave, how do we get our data and our configuration out, and in what format, and how long do you keep anything afterwards?
- Hannah Lowe NoneThe data point is the easier part, because it's all in your Snowflake account already. If we weren't there, it would still be there. What would go is the brain layer and its configuration. I'll write that down properly rather than improvise it now.
- Catriona Muir NonePlease, with the retention position. Second, the list of any subcontractors who could touch our data. Third, the business continuity summary. Fourth, evidence of insurance. And fifth, the outsourcing assessment questionnaire, which is the long one.
- Tom Ashdown NoneRight, I've got those. Exit plan with retention, subcontractors, continuity summary, insurance, the questionnaire. I'll own the insurance and the subcontractor list and Hannah has the technical ones. Is that fair, Hannah?
- Hannah Lowe NoneYes. I'll take the exit plan technical section, the continuity summary and the questionnaire. If the questionnaire has a question I'm not certain of, I'll check it before I answer, not guess.
- Catriona Muir NoneThat's exactly what I want to hear. And I will say, Tom, that the questionnaire answers need to be right first time. I'd sooner wait than have a second round.
- Tom Ashdown NoneWouldn't argue with that. And while we're on the commercial side, the deal as it stands is the one hundred and fifty-five thousand, £155,000, that's the total including the implementation. I'll confirm that in writing with the exact split, I'm not going to quote it from memory.
- Catriona Muir NoneThank you. I don't discuss that on the phone anyway. Send it over and I'll put it with the rest.
- Euan Rattray NoneAnd I don't discuss price at all, so you can carry on without me.
- Tom Ashdown NoneNoted, Euan, and I'll not drag you into it.
- Catriona Muir NoneTiming, then. We've said the target is 30 Sep 2026 for a decision. Realistically, with the committee cycle, I need everything for the file in good time before that. I can't let it slide quietly, so if something is going to be late, tell me early.
- Tom Ashdown NoneThat's fair and we'll do that. Hannah, can you get the written responses out soon, so Euan has time to look at them properly?
- Hannah Lowe NoneI'll aim for the end of next week for the access material and the incident actions. The register extract might take a little longer, because I need it from another team. I'll tell you if it's going to slip.
- Euan Rattray NoneThat's acceptable. I'll review within a few working days of receiving it and I'll write back with whichever findings I can close and any new ones. I won't close anything without evidence.
- Hannah Lowe NoneI wouldn't want you to. One last thing from me. If a call would be quicker than another round of email on the incident actions, I'm happy to do a short one with you and walk through the evidence line by line.
- Euan Rattray NoneI may take you up on that. Let's see what arrives first.
- Tom Ashdown NoneBrilliant. Let's get something in the diary once the paperwork's with you. Anything else before we let you go?
- Catriona Muir NoneNot from me. I'll send a short note of the outstanding items after this so we're all working from the same list.
- Euan Rattray NoneNothing further. Thank you, both, for the straight answers today.
- Hannah Lowe NoneThanks all. Speak soon.
- Tom Ashdown NoneCheers everyone. Have a good rest of the afternoon.
Callsmade from