Ardcarne Life Assurance / B-Brain – Security Review
Callcompleted
Ardcarne Life Assurance: documents · 2026-05-19 15:45
Declan Furlong, Chief Information Security Officer at Ardcarne Life Assurance, held the first of four review sessions on 19 May 2026. Eight findings were open at the close, all owned by Theo Gallagher, and nothing is to be signed on a promise to close later.
What was said
What this says
Current to 11 Oct 26Declan Furlong, Chief Information Security Officer at Ardcarne Life Assurance, held the first of four review sessions on 19 May 2026. Eight findings were open at the close, all owned by Theo Gallagher, and nothing is to be signed on a promise to close later.
What happened: the session covered architecture, residency and subcontractors. Declan found gaps in the draft diagram, the subcontractor list, logging retention and the model call data flow.
Customer view: he wants dated written commitments and was clear that security findings run independently of commercial terms. He accepts the 30 Jun 2026 target only as conditional on evidence.
Commercial: his account is in an EU region and he wants the contract to say it stays there, with a notice period for change. Theo raised the dedicated EU data residency add-on and said he would confirm what it adds before calling it required.
Watch: Theo could not yet evidence model provider terms on retention and training. The evidence does not show how the later sessions went.
Themes
Current to 9 Oct 26Who was there
B-Brain
Them
Follow-up
Next steps
Current to 9 Oct 26- Theo Gallagher to send the findings list with committed dates within the hour of the call.
- Theo Gallagher to send the draft NDA to Declan by the end of that week.
- Theo Gallagher to send the invitation and agenda for the access and identity session.
Risks
Current to 9 Oct 26- Eight findings are open, so the 30 Jun 2026 target depends on evidence not yet delivered.
- Model provider terms on retention, training and region of processing are unconfirmed and could block approval.
- A delayed penetration test summary or NDA would add friction to the review.
Opportunities
Current to 9 Oct 26- The dedicated EU data residency add-on may fit if it adds anything beyond the customer's own EU region configuration.
- Clear, dated evidence builds trust with a security officer who values honest gaps over tidy answers.