Security review: finding a time
Email thread Brenneck Pay: documents · sales
Theo Gallagher proposed a security review session with Information Security Officer Sabine Kranz. She set firm conditions: per-component processing answers, access log evidence in advance and a subprocessor list. Tuesday at 10:00 was agreed.
What was said
What this says
Current to 11 Oct 26Theo Gallagher proposed a security review session with Information Security Officer Sabine Kranz. She set firm conditions: per-component processing answers, access log evidence in advance and a subprocessor list. Tuesday at 10:00 was agreed.
Ask: Sabine accepted the agenda but wants evidence, not descriptions. She will close findings only where evidence is attached.
Customer view: Her tone is firm and procedural rather than hostile. She calls the subprocessor list a requirement, not a preference.
Next: Theo committed to per-component answers with control references, an access log extract and the subprocessor list, marking anything unconfirmed as open with a dated commitment. He will check with the platform team first.
The thread
Updated 9 Oct 26Messages
Theo Gallagher 10 Jul 2026 10:37Dear Sabine, I would like to book a working session to go through the open items of the security review with you. I have taken over this area on our side and I now run the EU questionnaires, so I will be your contact for it. The agenda I propose, mirroring your questionnaire: 1. Where the data is processed: the EU region, with the control reference for each statement. 2. Access logs: what is recorded, who can read it and how long it is kept, with an extract we can evidence. 3. DORA and the outsourcing requirements: which answers are complete and which still need a dated commitment from us. Would a session of about an hour early next week suit you? Please send two or three slots and I will fit around them. Thanks, Theo Theo Gallagher Solutions Engineer, BB-Demo
Sabine Kranz 10 Jul 2026 12:03Dear Theo, Thank you for taking this on, and for the agenda. It is welcome. I can offer Tuesday at 10:00 or Wednesday at 14:00. Please note the following before we meet: 1. Where exactly is the data processed? I need the answer per component, not a general statement for the platform. 2. For the access logs, please provide evidence in advance of the session. A description is not sufficient for my file. 3. Please bring the list of subprocessors, if any are involved. This is a requirement, not a preference. I will close findings only where evidence is attached. Sabine Kranz- Theo Gallagher 10 Jul 2026 14:25Sabine, Understood. Tuesday at 10:00 works for me, so let us take that one. On your three points: 1. Processing location: I will answer per component, each with its control reference. 2. Access logs: I will send an extract ahead of the session. If any part needs input from the platform team, I will ask Ewan before I answer you, so that you do not get an assumption from me. 3. Subprocessors: I will confirm the list with the platform team and send it together with the extract. If something is not yet confirmed, I will mark it as open and give you a dated commitment instead of a guess. I will send the calendar invitation shortly. Thanks, Theo