Security review session: scheduling

Hello Euan, Thank you for your time on the call. To be precise about where we left it: you have a set of open findings from the architecture walkthrough, and I owe you written answers on a few of them before we sit down properly. I would like to book the Enterprise security review session for sometime next week. The short answer on the architecture is that BB-Demo runs inside your own Snowflake account, so the question of where the data is stored and who can see it is largely governed by your existing controls. The longer answer is that I would rather walk you through the access model with a diagram than have you take that on trust, and I will put the detail in writing afterwards. Could you tell me which days suit you, and who from your side should be in the room? I would suggest someone who can speak to the Snowflake roles and network configuration, as that is where most of the useful questions tend to land. Thanks, Hannah

Hannah, Thank you. Tuesday morning would suit me, ideally from 10:00. Our platform owner should attend, as he owns the Snowflake side and can answer for the roles and network rules. I would also like our risk analyst to listen in, as she will be drafting the paper for the board's risk committee. So that the session is not wasted, I would ask that you send the following beforehand: First, please evidence how access to the brain is controlled: who has standing access, and how that access is reviewed. Second, what is the incident history for the service? A statement that there have been none is not sufficient on its own; please say what records you hold. Third, please set out where each connector's data is processed and whether anything leaves the Snowflake account at any point. I will not be able to close any of my open findings on the basis of a reference to another customer's review, so please send documents rather than assurances. Euan Rattray

Euan, Tuesday at 10:00 is fine and I have held the time. I will send a calendar invitation shortly, addressed to you; please forward it to your platform owner and your risk analyst, or give me their addresses and I will add them. On your three questions: First, I will send the access model with a diagram, showing the roles BB-Demo needs inside your Snowflake account and who can use them. I will put that in writing so that you have something to test. Second, the incident history. I want to check exactly what we can share before I send it, and I will confirm with Ewan on our side first. I would rather give you a correct answer a day later than a quick one I cannot stand behind. Third, the processing locations per connector. I will give you a table so you can see each source and where it is handled. If anything else is on your list of open findings that you would like covered on Tuesday, send it over and I will add it to the agenda. Thanks, Hannah On 18 Aug 2026, at 15:09, Euan Rattray wrote: > Tuesday morning would suit me, ideally from 10:00.