Scheduling the security review session

Ravi, Thanks for your time on the call. As promised, I would like to book a working session for the security review so we can go through your open findings one by one and agree an owner and a dated commitment for each. To make the session useful, here is what I propose to cover: One: access controls, including who has standing access to anything in the environment and how that access is reviewed. Two: where the data lives and who can see it. The brain is built and run inside the customer's own Snowflake account, so I would like to walk you through exactly what that means for your team's control of the data. Three: incident history and how we would notify you. Could you let me know two or three windows next week that suit you? About an hour should be enough. If anyone from your team should join, please say so and I will send the invitation to them too. Thanks, Theo

Theo, Thank you. The agenda is acceptable, with two additions. First, please evidence the answer on standing access in writing before the session, not during it. I would rather read it in advance. Second, I will want the incident history in a written form that I can take to the audit committee. A verbal summary will not close the finding. I can offer Thursday or Friday afternoon of next week. Thursday is preferable. Ravi Subramanian

Ravi, Thursday it is. I will send an invitation for the afternoon, and I will put a clear start time in it so you can confirm or move it. On your two additions: One: standing access. I will send the written answer with the control reference for each item, so you have it ahead of the session. Where I need confirmation from our platform team before I commit to a statement, I will ask them first and tell you plainly if an answer is still pending. Two: incident history. We can evidence that in writing and I will include it in the same pack. I will not describe anything as final until it has been checked. You will have the pack by the end of tomorrow. Thanks, Theo