Fenmoor Specialty Underwriting / B-Brain – Security Review
Callcompleted
Fenmoor Specialty Underwriting: documents · 2025-11-21 09:00
Nadia Osei, Fenmoor's IT Security Lead, took Hannah Lowe through incident response, subprocessors and staff access on 21 Nov 2025. Hannah owes eleven written items. Nadia called it the first session with answers precise enough for a provider.
What was said
What this says
Current to 10 Oct 26Nadia Osei, Fenmoor's IT Security Lead, took Hannah Lowe through incident response, subprocessors and staff access on 21 Nov 2025. Hannah owes eleven written items. Nadia called it the first session with answers precise enough for a provider.
What happened: Hannah Lowe walked Nadia Osei through incident response, the subprocessor list and staff access to the Fenmoor environment. Several answers were deferred to written documents, and both sides counted eleven items owed by B-Brain.
Customer view: Nadia wants exact text for the questionnaire her capacity providers will read. She welcomed Hannah's stated limits and said it was the first time the answers were precise enough to put in front of a provider.
Commercial: Nadia asked whether dedicated residency commitments would sit in the Enterprise paperwork. Hannah said that was for Priya to confirm and that nothing in the architecture stops it.
Watch: The retention position with the model provider must be shown as contractual, not just a setting. The last session remains to close out open items.
Themes
Current to 9 Oct 26Theme
Security review open items
Importance
upsell
Sentiment
positive
Voice
decision-maker
Who was there
B-Brain
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Hannah Lowe to send one written note covering all eleven items, including the revised data flow diagram.
- Priya to confirm with Nadia Osei whether a residency commitment sits in the Enterprise paperwork.
- Nadia Osei to circulate the open items list ahead of the final session.
Risks
Current to 9 Oct 26- Eleven written answers are owed, and any that are vague or late could stall the security pack.
- The model provider retention position may turn out to be a configuration rather than a contract term.
Opportunities
Current to 9 Oct 26- Dedicated data residency as an add-on could be written into the Enterprise order form.
- Clear written security answers move the Enterprise deal forward.
Transcript
Hannah Lowe NoneMorning, Nadia. Can you hear me all right? I've had the headset misbehave this week so I'm checking before I say anything useful.
Nadia Osei NoneMorning, Hannah. Yes, loud and clear. Give me a second, I'm just closing the questionnaire tracker so I can share it if we need to.- Hannah Lowe NoneNo rush. How's your Friday going? Anything dreadful on the calendar after this?
- Nadia Osei NoneOnly a supplier audit call this afternoon, which is the usual. Our capacity providers have been very busy this month, so everything lands at once.
- Hannah Lowe NoneMm, I can imagine. Right, well, before we start, what do you most need to know from today? I'd rather spend the time on what moves your pack forward than walk through slides you've already seen.
- Nadia Osei NoneThat's helpful, thank you. Let me list the open items from last time first, for the audit trail. One, the data flow diagram needed to show where the model provider sits relative to Fenmoor's Snowflake account. Two, you were going to evidence the access review process for your own staff. Three, the subprocessor list, which we said we'd cover today along with incident response.
- Hannah Lowe NoneYes, that matches my notes. The diagram I did send over on Wednesday, so that one should be closed, but tell me if it isn't clear enough. The access review one, to be precise, I have a draft extract and I want one more person to look at it before it goes to you.
- Nadia Osei NoneUnderstood. I'd rather have it checked than quick. Shall we start with incident response, then? Because my capacity providers will ask about that first.
- Hannah Lowe NonePlease. The short answer is that we have a written incident response procedure, it has named roles, and it is exercised. The longer answer is that I think you want the actual shape of it, so let me walk it through and you stop me where it's thin.
- Nadia Osei NonePlease do. And I'll say now that I'll need that in the questionnaire in writing, so if you describe something verbally I'll ask for the document reference.
- Hannah Lowe NoneOf course, and that's how I'd want it. So, the procedure has four phases. Detection and triage, containment, communication, and review afterwards. Detection comes from monitoring and from customers raising something with us. Triage decides severity, and severity decides who is pulled in and how fast the customer hears.
- Nadia Osei NoneCan I stop you there? Who decides severity? Is that a named individual, or a role, or whoever happens to be on shift?
- Hannah Lowe NoneA role. There's an incident lead who is assigned per incident, and the procedure says which function they come from. I don't want to give you the exact rota from memory, so I'll put the role definitions in writing. That's one of the things I'll send after this.
- Nadia Osei NoneGood. Number two, then. Customer notification. What's the commitment on timing, and is it contractual or is it a internal target?
- Hannah Lowe NoneRight. That's the one I want to be careful about. There is a notification commitment for incidents that affect customer data, but I'm not going to quote you a number off the top of my head and have it wrong in front of an auditor. Let me confirm the exact wording against the procedure and the order form language and I'll put it in the written answer.
- Nadia Osei NoneI appreciate that. For the record, I'd far rather you said that than guessed.
- Hannah Lowe NoneYes. And one thing worth saying, because it's an architectural point rather than a procedural one. B-Brain runs inside Fenmoor's own Snowflake account. So for a lot of scenarios, the data never leaves your boundary in the first place, and your own logging in Snowflake is available to you independently of anything we tell you.
- Nadia Osei NoneYes, that's one of the reasons the review got this far. But it doesn't remove your side of the stack, does it? There are components that you operate and that sit outside our account, even if they don't hold the data.
- Hannah Lowe NoneCorrect. Good, that's exactly the distinction. There's the data plane, which is in your account, and there's the service side, which is things like the application layer, the orchestration and the model calls. Incident response covers both, but evidence differs. For the data plane, your logs are the evidence. For the service side, ours are, and we can export an extract.
- Nadia Osei NoneAn extract of what, precisely? Can you evidence that it's complete, rather than selective?
- Hannah Lowe NoneFair challenge. What I can offer is the incident register for the relevant period, with the fields shown, and a statement from us on how entries get into it. I can't promise it proves completeness in a mathematical sense. It shows the process and the record, and your auditors can sample it.
- Nadia Osei NoneThat's reasonable. I'll note that as an evidence item rather than an assurance. Could you also say whether the exercise you mentioned has actually happened recently? I'll need a date for the audit trail.
- Hannah Lowe NoneThe procedure is exercised on a schedule, and I'd like to give you the date of the last exercise from the record rather than from my head. I'll include it. If it turns out the date is awkward I'll tell you plainly.
- Nadia Osei NoneThank you. Let me move to communication then. During an incident, who speaks to us? Is it the account team, or is it your security function directly?
- Hannah Lowe NoneBoth, but with a clear lead. The incident lead owns the facts. The account owner or the customer success manager is the relationship contact so you're not chasing three people. For Fenmoor that would be Priya and Daniel on the relationship side, with me on the technical side for anything touching your connectors.
- Nadia Osei NoneAnd would you give us a written post-incident report?
- Hannah Lowe NoneYes. The review phase produces one, with cause, impact, what was done and what changes as a result. Whether a customer sees the full document or a summary depends on what's in it, and I'll be honest that where it touches other customers it would be redacted. For an incident that affected Fenmoor, you'd see everything relevant to Fenmoor.
- Nadia Osei NoneThat is acceptable. Our capacity providers will want to know that the report reaches us without us having to ask. Is that in the procedure or is it a courtesy?
- Hannah Lowe NoneI believe it's in the procedure, but I'm going to check before I tell you that as a fact. Add it to my list, please. Report delivery to the customer, procedure reference.
- Nadia Osei NoneAdded. That's four items from you on incident response so far. Role definitions, notification wording, last exercise date, and report delivery.
- Hannah Lowe NonePlus the register extract. So five. I'll write them out in one note so you're not assembling it from the transcript.
- Nadia Osei NonePlease. Right. Subprocessors. I have your list from the pack, and I have questions. Shall I go through them in order?
- Hannah Lowe NoneGo ahead. I have the list open as well.
- Nadia Osei NoneFirst, is the list complete as of today, and how will we be told if it changes? Second, for each one, what category of Fenmoor data can it touch, if any? Third, where is each one located, because data residency is something my providers raise every single time.
- Hannah Lowe NoneGood, that's the right way to cut it. Let me take them in turn. On completeness, the list in the pack is the current one and I'm happy to state that in writing. On change, we give customers notice before adding or replacing a subprocessor that would touch their data, and there's a route to object. Again, the exact period I'll quote from the document rather than from memory.
- Nadia Osei NoneThat's the pattern I'm noticing, Hannah. Several things you will quote from the document. That's fine, but please be aware the questionnaire will need them as actual text.
- Hannah Lowe NoneUnderstood, and that's the point of doing it in writing. I'd rather it all be exact. Moving on. For the second question, what data each one can touch, I should split them into groups, because it's not a uniform answer.
- Nadia Osei NonePlease.
- Hannah Lowe NoneThe infrastructure that hosts the service side touches operational metadata and configuration. The model provider is the one you've been most interested in, and the short answer is that prompts and retrieved context can pass through it when someone asks a question. The longer answer is about what's retained, and that is a contractual position with them which I'll set out for you rather than paraphrase.
- Nadia Osei NoneRight, and that is the one that matters. Can you evidence that the retention position is contractual and not merely a setting that could change?
- Hannah Lowe NoneThat's what I'll aim to do. If it turns out to be a configuration and not a contract term, I'll tell you that straight, and then it's a different conversation about whether it's acceptable. I'm not going to describe it as stronger than it is.
- Nadia Osei NoneThank you. That's the answer I was hoping for, frankly. Residency, then. Where is each located?
- Hannah Lowe NoneThe list has the location against each entry. For the UK deployment, Fenmoor's data sits in your Snowflake account in the region you chose. For the service side, the locations are as stated in the list. If you need dedicated residency commitments, that's an add-on on the commercial side and it would be written into the order form, not left as a statement on a call.
- Nadia Osei NoneI'm conscious the Enterprise discussion is running in parallel. Would that residency commitment be part of the Enterprise paperwork?
- Hannah Lowe NoneThat's for Priya to confirm, so I won't pretend I own it. What I can say from the technical side is that nothing in the architecture stops it. The commercial wording sits with her.
- Nadia Osei NoneFine. I'll raise it with her separately so it isn't lost between us. Now, access to the Fenmoor environment by your staff. Last time we parked it. Where have we got to?
- Hannah Lowe NoneParked is right. As I said at the start, I have a draft extract of the access review and I want it checked before it reaches you. In terms of principle, staff access to a customer environment is by request, time-limited and logged, and you can see that log in your own account. That last part is the one I'd stress.
- Nadia Osei NoneBecause it's in our account, we can see it without relying on your word.
- Hannah Lowe NoneExactly. That's the whole value of the architecture for a review like yours. Where you'd otherwise be asking me for evidence, you can produce it yourself.
- Nadia Osei NoneI would still want a sample from your side to compare against ours. An auditor likes two sources that agree.
- Hannah Lowe NoneReasonable. I'll add a matching sample of our own record for a short period. If the two agree, that's your paper trail. If they don't, we want to know before your providers do.
- Nadia Osei NoneQuite. Let me turn to something I flagged as a numbered question in the email. The provider side. If one of Fenmoor's capacity providers asks to see your incident procedure directly, would you share it under confidentiality?
- Hannah Lowe NoneI think so, but that's not mine to promise. It would go through our legal side. I'll ask the question and put the answer in writing. Can I say that I expect yes, but I'm not committing us on a call?
- Nadia Osei NoneYes, that's exactly the right level. I'd rather know it's being asked.
- Hannah Lowe NoneGood. Anything else on subprocessors before I summarise the list of things I owe you?
- Nadia Osei NoneOne more. If a subprocessor has its own incident, how do you hear about it, and how do we hear about it from you? It's the second link in the chain and my providers always go there.
- Hannah Lowe NoneThat's a good one, and it's the one most vendors answer vaguely. We depend on the notification terms we have with them, and we pass relevant information on under our own procedure. The honest limit is that we can only pass on what we're told. I'll set out what the terms with each one say.
- Nadia Osei NoneThank you. I'd put that in the questionnaire as it is, including the limit. Auditors tend to trust a stated limit more than a claim of completeness.
- Hannah Lowe NoneAgreed. Right, let me read back what I owe you, and correct me. Incident roles. Notification wording. Last exercise date. Report delivery reference. Register extract with fields. Subprocessor change notice period. Retention position with the model provider, contract or setting. Access review extract with matching sample. Whether the procedure can be shared with your providers. And the subprocessor incident chain.
- Nadia Osei NoneThat's ten. I have the same ten. Can I add that the data flow diagram needs a small revision? The labels on the service side are ambiguous to someone who hasn't sat through these calls.
- Hannah Lowe NoneOf course. Send me which labels and I'll fix them, version it, and send it with the note. Eleven, then.
- Nadia Osei NoneGood. And I'll say, for the sake of the audit trail, that today's session was productive. It's the first time I've felt the answers were precise enough to put in front of a provider.
- Hannah Lowe NoneThat's kind, thank you. The next session is the last one, if I have the numbering right, and that's where we close out whatever is still open.
- Nadia Osei NoneYes, one more after this. I'll circulate the open items list on my side so we're working from one document. Kind regards for now, Hannah, and thank you.
- Hannah Lowe NoneThanks, Nadia. I'll get the note to you today or first thing on Monday. Speak soon.
Callsmade from