Conditions for bringing merchant-risk data into scope

Dear Matteo, Before merchant-risk data comes into scope of the brain, information security needs the following confirmed in writing: 1. All processing takes place in the EU. Where exactly is the data processed, including any processing done for support and for the nightly refresh? 2. Every sub-processor is named, with its location, and the evidence is attached. 3. Every support access to our environment is logged, and we can see those logs. This is a requirement, not a preference. Our outsourcing register and BaFin's expectations apply to this data in the same way as to the data you already hold for us. Please provide evidence for each point, not a description. Sabine Kranz Information Security Officer, Brenneck Pay

Dear Sabine, Thank you for setting this out so clearly. I would rather you heard it from me directly: I have read your three conditions and I do not see anything in them that we cannot meet in principle, but I will not claim more than we can show you. I have copied Theo, who runs our security questionnaires. He will answer in the same order as your list: 1. Processing location: he will describe where each step runs for your account and what is kept in the EU region. 2. Sub-processors: the list with the location of each, with the supporting documents. 3. Support access: how it is granted, how it is logged, and how you can see the logs. Where an answer depends on our platform team, Theo will check with them first rather than answer for them. Let me confirm that in writing: no date will go to you until engineering has agreed it, and I will tell you straight away if one of the points turns out to be harder than we expect. What does your regulator need to see, beyond the documents themselves? If there is a format you must use for the outsourcing register, please tell us and we will follow it. Best regards, Matteo

Dear Matteo, Thank you, this is a helpful answer and I appreciate that you will not give a date before engineering has agreed it. Two remarks: 1. For the register we need the sub-processor list as a document with a version and an owner, not an email text. Please ask Theo to prepare it in that form. 2. I will not close any finding until I have seen the evidence. A verbal confirmation in a call is not sufficient for us. Please let Theo send his answers directly to me, in the numbered order. I will then review them and tell you what is still open. Sabine Kranz