Etowah Lane security review: open items and one disclosure

Jordan, I have gone through the architecture summary you sent. Before I can move this review forward, I need the following, please evidence each item rather than describe it: 1. Who has standing access to the Snowflake account where the brain runs, on your side, and how is that access approved and reviewed? 2. Where is our data stored and processed, and can you confirm in writing that nothing leaves our environment? 3. How are connector credentials held, and who can read them? 4. What is your process for notifying us of a security or availability event? I would like these answered by Theo or whoever owns the control, not summarised by sales. Ravi Subramanian

Ravi, Thanks for the detailed list. Theo is copied and will own the evidence for all four items. He will send the control references separately so you can check each one against what we claim. Before you get to your fourth question, here's where we are on something I want you to hear from me first. To be transparent: in July we had an outage of the nightly refresh on our EU cluster. Your environment is not on that cluster. The US cluster was not affected, and nothing in the evidence for your review comes from the EU side. We have completed a post-incident review. It lists two actions, both due by the end of the year. I would rather you read the review than take my summary of it. Theo will send it to you tomorrow morning along with the answers to your numbered questions. If anything in it changes how you see the review, tell me and we will deal with it directly. Thanks, Jordan

Jordan, Thank you for raising it before I did. I note that it is the EU cluster and that you say ours is separate. I will want that separation evidenced, not asserted. I am pausing my review until I have read the post-incident review in full. Please do not treat the open findings as closed in the meantime. I will come back to you once I have read it and checked it against the other answers. Ravi Subramanian