Arranging the security review session
Email thread Corstorphine Building Society: documents · sales
Hannah Lowe offered a security review session. Euan Rattray, Head of Information Security, accepted a Thursday call at 10:30 and asked for four items in writing first: standing access, incident history, logging and any data leaving the account.
What was said
What this says
Current to 11 Oct 26Hannah Lowe offered a security review session. Euan Rattray, Head of Information Security, accepted a Thursday call at 10:30 and asked for four items in writing first: standing access, incident history, logging and any data leaving the account.
Ask: Euan wants written evidence before the call on who has standing access, BB-Demo's incident history, what is logged and for how long, and whether any data leaves the customer's account.
Customer view: He says a reference to another organisation will not stand in for a control and that he will close findings only on evidence. He will decide after the first call whether an in-person session is needed.
Next: Hannah needs to send the invitation and answer all four points in writing, with evidence rather than description.
The thread
Updated 9 Oct 26Messages
Hannah Lowe 18 Jun 2026 14:39Dear Euan, Thanks for your time on the call. I am writing to arrange the security review session properly, so that we use it well. To be precise about what I propose to cover: how the brain is deployed inside your Snowflake account, which connectors would be configured and what each one reads, how access is controlled and logged, and how updates and support access work. The short answer on data location is that it stays in your account. The longer answer involves the specific components that BB-Demo operates and the permissions they hold, and I would rather walk you through that with a diagram than describe it in an email. Could you tell me: - which of your open findings you want to start with; - who from your team should join; - whether you would prefer a call or an in-person session at your offices. I can make most of next week work, with a slight preference for a Tuesday or a Thursday. Please tell me what suits and I will put the agenda in writing beforehand. Thanks, Hannah Hannah Lowe Solutions Engineer, BB-Demo
Euan Rattray 22 Jun 2026 12:12Hannah, Thank you. Thursday would work for us, mid-morning. Please send a calendar invitation for 10:30 and I will confirm attendees from my side. A call is fine for the first session. I will decide afterwards whether we need to be in the room. So that the session is not wasted, I would like the following in writing beforehand. First, who has standing access to our environment, from BB-Demo or from any third party, and how is that access granted, reviewed and removed? Please evidence that rather than describe it. Second, what is your incident history? I am looking for what has happened, how it was handled and what changed afterwards. Third, a description of what is logged and for how long, and whether we can see those logs ourselves. Fourth, where any data leaves our account, even in metadata or diagnostics, I would like it stated explicitly, including if the answer is that nothing does. I should say that a reference to another organisation will not stand in for a control. I will close findings only on evidence. Euan Rattray