Etowah Lane Equipment Rental / BB-Demo – Security Review
Callcompleted
Etowah Lane Equipment Rental · 2026-07-07 17:45
Ravi Subramanian, the CISO, took Theo Gallagher through open security findings for an Enterprise deal. Theo gave dated commitments, not assurance. Carlos Medina wants a decision by 4 Dec 2026, but Ravi will decide on evidence, not the date.
What was said
What this says
Current to 13 Oct 26Ravi Subramanian, the CISO, took Theo Gallagher through open security findings for an Enterprise deal. Theo gave dated commitments, not assurance. Carlos Medina wants a decision by 4 Dec 2026, but Ravi will decide on evidence, not the date.
What happened: Ravi Subramanian, the CISO, went through open findings with Theo Gallagher, and the list reached eight by the end of the call. Theo said "I don't know yet" on several points and promised dated written answers with control references.
Customer view: Ravi said design intent is not evidence and that open items matter more to him than closed ones. He said price plays no part in his view and that a reference customer is no substitute for a control.
Commercial: Carlos Medina is comparing BB-Demo with the group-wide analytics suite already in some departments. He has a decision date of 4 Dec 2026 and gave the all-in figure with implementation as £155k.
Watch: the two-role test, where a branch role asks a question that would be richer for the credit role, is a live session Ravi wants recorded. Vague written answers will cost patience.
Themes
Current to 9 Oct 26Theme
Enterprise security review
Importance
neutral
Sentiment
mixed
Voice
decision-maker
Who was there
BB-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Theo Gallagher sends written answers on SSO, local login and SCIM evidence before the end of the following week.
- Theo runs the recorded two-role test with exported query history once Carlos Medina creates two test accounts.
- Theo sends the incident register, subcontractor table, connector scopes and exit steps with a control reference against each.
Risks
Current to 9 Oct 26- Eight findings are open and the CISO will close them on evidence only, not on the decision date.
- Written answers that come back vague will lose the CISO's patience.
- The group-wide analytics suite is already in some departments and is the comparison.
Opportunities
Current to 9 Oct 26- Enterprise SSO and SCIM plus the dedicated US data residency add-on answer the identity and region questions raised.
- A recorded two-role test could close the credit-data concern in one session.
Transcript
Theo Gallagher NoneHello, can you both hear me alright? Good evening from London, and good afternoon to you.
Carlos Medina NoneLoud and clear, Theo. Hi. Ravi's still finishing something else, he said to start without him if he's not on by quarter to, but I'd give him a minute.- Theo Gallagher NoneNo problem at all. How's the week been in Atlanta? Hot?
- Carlos Medina NoneHot and wet. We had a storm come through at lunch and a fair chunk of the branch network lost connectivity for a while, so it's been a fun afternoon on my side. Everything's back now, I think. Touch wood.
- Theo Gallagher NoneAh, that's never what you want in a week with a security review in it. Here it's grey and it's been drizzling since the morning, so I won't complain.
Ravi Subramanian NoneGood afternoon. Apologies, I'm here. Ravi Subramanian. Can you hear me?- Theo Gallagher NoneYes, clearly. Hello Ravi, Theo Gallagher, I'm the solutions engineer on your review. Thanks for making the time, I know it's late for me and I hope not too awkward for you.
- Ravi Subramanian NoneIt's fine. I'd like to go through my open findings first, if I may, so that we both know where we are before you present anything.
- Theo Gallagher NonePlease do. I'll say how I've got them on my side as well, so we can check they match. As I have it there are four open. One, an architecture diagram with the trust boundaries marked: that's mine. Two, where the compute and the storage sit for a US customer: that's mine, with our platform team. Three, evidence for SSO and SCIM behaviour: mine. Four, a list of who at BB-Demo can reach a customer's account and how: also mine. And there's yours, the incident history, which I owe you in writing.
- Ravi Subramanian NoneThat matches my list, with one addition. Five: what is the process for revoking access when one of your people leaves? I asked for it in the questionnaire and the answer was a paragraph of assurance.
- Theo Gallagher NoneFair. I'll add it as five and put my name on it. I'd rather give you the control reference and the log than a paragraph, so please hold me to that.
- Ravi Subramanian NoneI will. Please evidence that, whichever way it comes out.
- Carlos Medina NoneCan I just say where I'm coming from, so the questions make sense? We're comparing you with the group-wide analytics suite that's already in the building in a couple of departments. Branch, national accounts and credit all want one view of a contractor account. Ravi's the reason this is a proper review and not a nod.
- Ravi Subramanian NoneQuite. The audit committee will ask me what we allowed in and why, so I need to be able to answer.
- Theo Gallagher NoneUnderstood. Let me share my screen and start with the architecture, because most of the other findings hang off it. Give me a second. Can you see a diagram with three boxes?
- Carlos Medina NoneYes, I see it.
- Ravi Subramanian NoneYes. The text is small but I can read it.
- Theo Gallagher NoneI'll make it bigger in the written version. So the key point is that the company brain is built and run inside your own Snowflake account. It is not a BB-Demo tenant that your data gets copied into. The box on the left is your sources: whichever of your CRM, helpdesk, accounting system and the rest you choose to connect. The connectors read from those and land the data in the middle box, which is a set of schemas in your Snowflake. The right-hand box is the layer that people actually ask questions of. Everything in the middle and right sits inside your account boundary and under your roles.
- Ravi Subramanian NoneQuestion one. What sits outside that boundary? I don't want the answer 'nothing'.
- Theo Gallagher NoneGood, because it isn't nothing. Outside the boundary there's our support access, the way our engineers reach in when you ask us to, and some operational telemetry about the service itself. What I need to be careful about is exactly what that telemetry contains. My understanding is it's job status and counts, not your row-level data, but I want to evidence that from the configuration and not tell you from memory.
- Ravi Subramanian NoneThen it's an open finding until you do. Question two. Where does the language model run when someone asks a question?
- Theo Gallagher NoneRight, and that's one I'm going to take to our platform team rather than answer for them. I could give you a confident sentence, but if the platform team's answer differs in a detail you'd be right to be annoyed with me. I'll bring you a dated answer with the control reference.
- Ravi Subramanian NoneThat is the correct answer, thank you. It's better than most vendors manage. Please note it down as finding six.
- Theo Gallagher NoneNoted. Six. Done.
- Carlos Medina NoneSorry, can I jump in on the US side? Our Snowflake account is in a US region already. Does the brain just follow that, or is there something separate you stand up?
- Theo Gallagher NoneMm, good question. Because it runs in your account, it lives in the region your account is in. That's the point of the design. Separately, we sell dedicated US data residency as an add-on, and that's about the parts that are ours: what we host, if anything, for operating the service. In your scope that's something to settle with Jordan, but the technical question for today is the same: which of our components, if any, sit outside your region. That's finding two and I'll answer it with the diagram.
- Ravi Subramanian NoneAnd if the answer is that something sits outside the US?
- Theo Gallagher NoneThen I'll tell you plainly, name the component, and say what it holds. I'm not going to describe a control we don't have.
- Ravi Subramanian NoneGood. Moving on to access. Who has standing access to a customer's account at BB-Demo?
- Theo Gallagher NoneMy understanding is that nobody holds standing access to a customer's account. Support access is requested, approved, time-limited and logged. But I'm going to be careful here: until you've seen the policy and a sample of the log format, treat what I've just said as a statement, not evidence. I'll send the control reference with it.
- Ravi Subramanian NoneAgreed, that is how I'll record it. Who approves a request? The customer or you?
- Theo Gallagher NoneIdeally both. On your side an admin approves in your account, since it's your Snowflake, and on ours there's an internal approval. Carlos, I'd guess that's a role that sits with you or your team?
- Carlos Medina NoneProbably me, to start with, yes, or one of my two admins. But I'd want Ravi's team to have a view of it. We don't let anybody into the credit data without a trail.
- Ravi Subramanian NoneWhich brings me to my main concern. The credit team's data. A branch manager should not be able to see a credit assessment of a contractor, even if the question they type seems innocent. What stops that?
- Theo Gallagher NoneThe short version is that the brain doesn't get its own idea of who can see what. It works through the roles and grants in your Snowflake account. If a branch role cannot read a credit table, the brain can't read it on that person's behalf. That is the design intent.
- Ravi Subramanian NoneDesign intent is not evidence. Please evidence that.
- Theo Gallagher NoneQuite right. What I can do is set up a test with two roles, one with the credit grant and one without, ask the same question as each, and give you the output and the query history. We can evidence that, and I'd rather do it on a call where you're watching than send you a screenshot.
- Carlos Medina NoneThat would help me too, actually. The thing I worry about isn't the tables. It's the summaries. If the brain writes a paragraph about a contractor, can that paragraph pull in something the person asking shouldn't see?
- Theo Gallagher NoneRight, that's the sharper version, and it's a better test than mine. I'll include it: a question where the answer would be richer for the credit role, asked by the branch role. If the summary leaks, you should see it there and not in production. I'll add that as finding seven, mine, with the platform team.
- Ravi Subramanian NoneSeven. Good. Now SSO. I have three questions on that, numbered.
- Theo Gallagher NoneGo ahead, I'll answer in the same order.
- Ravi Subramanian NoneOne: does authentication happen at our identity provider, and do we keep multi-factor enforcement there? Two: how are accounts removed when someone leaves us? Three: is there any local account, any break-glass login, that bypasses single sign-on?
- Theo Gallagher NoneOne. In the Enterprise tier, sign-on goes through your identity provider and the multi-factor policy stays with you; we don't hold a second set of credentials for your people. Two. SCIM provisioning is part of Enterprise, so a leaver removed in your directory should be deprovisioned in the brain. I say should, because I haven't got the timing from a log in front of me, and I don't want to promise a figure I can't show. Three. That is the one I'm least sure of, so I'll check whether any local or support login exists and report back.
- Ravi Subramanian NoneThen three is an open finding, with a date.
- Theo Gallagher NoneHere is the dated commitment: I'll have written answers on one to three, with evidence for the SCIM behaviour, before the end of next week.
- Ravi Subramanian NoneThank you. Now, your incident history. What's your incident history?
- Theo Gallagher NoneI don't want to summarise that from memory, because I'd either undersell it or make it sound tidier than it is. I'll send the incident register for the period you asked about, with what happened, what was affected and what changed afterwards. If there are any that touched customer data you'll see them marked.
- Ravi Subramanian NonePlease include anything that touched availability, even if no data was exposed. And I should say now, so that it is on the record: I am not interested in a reference customer in place of a control. Another company being comfortable is not a reason for us to be.
- Theo Gallagher NoneUnderstood, and I wouldn't offer one in place of a control. If a reference ever helps, it's on top.
- Carlos Medina NoneCan I ask something slightly practical while you're both looking at notes? On the connectors. If we hook up the CRM and the helpdesk, does each connector get its own credential, and who holds it?
- Theo Gallagher NoneYes, each connector has its own credential and I'd want the principle to be least privilege: read-only where the source allows it. The credentials sit in your account, in your secrets handling, not with us. I'll list them against each connector in the pack, with the scope each one requests.
- Ravi Subramanian NonePlease include which of those scopes are write scopes, if any.
- Theo Gallagher NoneWill do. If there's a write scope anywhere I'll flag it and say why it's needed, or whether it can be removed.
- Carlos Medina NoneAnd the nightly refresh, that's all inside the same boundary?
- Theo Gallagher NoneYes. It's a job that runs in your account, and the commitment on our side is that it's complete by seven in the morning your local time on business days. That's a service level, not a security control, but it's useful to know the job is yours to see.
- Ravi Subramanian NoneLet's talk about logs. If I wanted to know, six months from now, who asked what, where do I look?
- Theo Gallagher NoneQuery history in your Snowflake is the base record, and it's yours. What I need to confirm is what the brain adds on top: whether the question text and the person are logged together, how long we keep it, and whether you can export it. I'll write that down as finding eight rather than guess.
- Ravi Subramanian NoneEight. And retention. If we end the contract, what happens to what you hold?
- Theo Gallagher NoneThat's the exit plan, which I care about quite a lot. Because the data and the layers are in your account, the starting position is that they stay with you. What we'd remove is our access and anything of ours that's outside. I'll set it out as steps, with who does each one, so it's a plan and not a promise.
- Ravi Subramanian NoneGood. I'd like the steps to include confirmation that credentials are revoked, in writing.
- Theo Gallagher NoneYes. Added.
- Carlos Medina NoneWhile you're writing, Theo, can I check how long this review is likely to take? I have a decision date in mind, Friday 4 December 2026, and I'd like the security part not to be the thing that moves it.
- Theo Gallagher NoneI'd say we can get through it well before then, provided the findings get closed in the order we've set out. I don't want to promise that every one closes, because that's down to the evidence, and Ravi will decide that. But the pack I'm sending is meant to close most of them in one go.
- Ravi Subramanian NoneI will decide it on evidence, and not on the date. I say that without any unkindness, Carlos.
- Carlos Medina NoneNo, understood, that's what I'd expect. I'm just saying it out loud so we all know the calendar.
- Ravi Subramanian NoneAnd on price, so there's no confusion: I don't discuss it, and it plays no part in my view.
- Carlos Medina NoneRight, that's with me and Jordan. For everyone's information the all-in figure with implementation is one hundred and fifty-five thousand, and that's all I'll say about it here.
- Theo Gallagher NoneThanks, Carlos. I'll leave that with Jordan too.
- Theo Gallagher NoneRavi, one thing from my side, if I may. The questionnaire you sent has a section on subcontractors. Rather than answer in the abstract, can I ask what you'd need to see? I'd rather match your question than guess.
- Ravi Subramanian NoneThe names of anyone who processes our data, what they process, where, and under what terms. Not categories. Names.
- Theo Gallagher NoneGood, that's clear. If our list is short that's a short answer, and if it isn't I'll show you the whole thing. I'll put it in the pack as a table.
- Ravi Subramanian NoneFine. Then penetration testing. When was your last independent test, who did it, and can I see the findings summary and the remediation?
- Theo Gallagher NoneI'll bring you the report summary and the remediation status as they stand, with dates. I can't state the date from memory and I won't try. What I can say is that I'd want you to see open items as well as closed ones.
- Ravi Subramanian NoneYes. Open items matter more to me than closed ones.
- Carlos Medina NoneOkay, I've been scribbling. Can I play back what I think we've agreed, because otherwise I'll be chasing myself next week?
- Theo Gallagher NonePlease, that would help.
- Carlos Medina NoneSo: Theo sends an architecture diagram with the boundary marked, a statement on what's outside the US region if anything, the support access policy and log format, the SCIM evidence, the incident register, the subcontractor table, the connector scopes, and the exit steps. And separately he's checking with the platform team on where the model runs, on telemetry content, on any local login and on what the brain logs. Did I miss any?
- Theo Gallagher NoneYou've got the lot, and you've been more orderly than my own notes. The only addition is the two-role test, the one that includes the summary question. That's a live session, not a document.
- Ravi Subramanian NoneI will want that session to be recorded, and I'd like the query history exported afterwards and attached to the finding.
- Theo Gallagher NoneYes, I'll set it up that way. Carlos, it'll need two test users in your identity provider, one that holds the credit role and one that doesn't. Is that something you can arrange?
- Carlos Medina NoneYes. I'd rather not use real people, so I'll make two service-style accounts and tell Ravi's team when they exist.
- Ravi Subramanian NonePlease do. And tell me who has the credentials for them.
- Carlos Medina NoneUnderstood. Me, and one admin, and that's all.
- Ravi Subramanian NoneA closing point from me. This session has been useful because you said 'I don't know yet' on several things. I would rather hear that than assurance. I will be less patient if the written answers come back vague.
- Theo Gallagher NoneThat's fair, and thank you. They'll come back dated, with a control reference against each. If any of them can't be evidenced, the document will say so.
- Ravi Subramanian NoneThen I'll send my next numbered questions after I've read the pack, not before. Carlos, copy me on the scheduling.
- Carlos Medina NoneWill do. Theo, can you send over some times for the second session once the pack is with us? Something that's not this late for you.
- Theo Gallagher NoneI'd be glad to, though honestly I'm happy to do these in the evening if it suits you better. I'll offer a couple of options. Thanks, both.
- Carlos Medina NoneBrilliant. Thanks Theo, thanks Ravi. Speak soon.
- Ravi Subramanian NoneThank you. Goodbye.
- Theo Gallagher NoneCheers both, speak soon.
Callsmade from