Quillmark Health / BG-Demo – Security Review
Callcompleted
Quillmark Health · 1 Jun 2026 17:15
First of three Enterprise security review sessions with Quillmark Health's CISO on 1 Jun 2026. Megan Alvarez gave no verbal view, and BG-Demo took away written actions on boundary, access, US support, incidents and the BAA.
What was said
What this says
As at Fri 9 Oct 2026First of three Enterprise security review sessions with Quillmark Health's CISO on 1 Jun 2026. Megan Alvarez gave no verbal view, and BG-Demo took away written actions on boundary, access, US support, incidents and the BAA.
What happened: Session one of three on 1 Jun 2026 covered the data boundary, staff access, residency, incidents and sub-processors. Megan Alvarez would give no verbal view, so most answers were deferred to writing.
Customer view: Megan said nothing is approved until the written review is complete. Her concern is finding later something she should have been told earlier.
Commercial: Jordan Pike put the proposal at £155k in total with implementation included, close pencilled for 30 Jun 2026. Megan said timing will not shorten the review and asked that it not be framed as a deadline.
Watch: The business associate agreement status is unknown, and Megan said review does not move to the next stage without it. Jordan could not commit on the call to restricting support to US-based staff.
Themes
As at Fri 9 Oct 2026Theme
Enterprise security review, session one
Importance
neutral
Sentiment
neutral
Voice
decision-maker
Who was there
BG-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
As at Fri 9 Oct 2026- Hannah Lowe to send the architecture diagram first, then written answers numbered to match Megan's questions.
- Jordan Pike to confirm the business associate agreement status and the US-only support answer.
- BG-Demo to send the written incident disclosure, including near misses, before session two.
Risks
As at Fri 9 Oct 2026- The business associate agreement status is unverified and Megan said the review cannot advance without it.
- BG-Demo could not yet commit to restricting support to US-based staff, which matters for the hospital groups' residency terms.
- Megan will judge completeness across sessions, so any inconsistent or late written answer could damage the deal.
Opportunities
As at Fri 9 Oct 2026- Dedicated US data residency can be scoped as an add-on in the order form, as a contract term.
- Enterprise SSO and SCIM answer her staff authentication and leaver questions if the deprovisioning behaviour is confirmed in writing.
- Premium support could be offered, though Hannah Lowe flagged it changes who responds, not where they sit.
Transcript
Jordan PikeHi Megan, hi Hannah. Can you both hear me okay?
Hannah LoweLoud and clear. Hello, both.
Megan AlvarezI can hear you. Give me one moment, I'm closing another meeting window.- Jordan PikeNo problem at all. Thanks for making the time at the end of the day, Megan. Here's where we are: this is session one of three, and we have the full hour minus a few minutes, so I'll give us a time check at the half hour. Agenda is scope, then architecture, then your incident question. Does that work?
- Megan AlvarezIt does. I'll restate scope first, for the record. Today is Monday 1 June 2026, and this is the first of three review sessions. The scope is BG-Demo's Enterprise offering as proposed to Quillmark Health, used over client-services data that will include protected health information belonging to our hospital group clients.
- Megan AlvarezThe open findings from your questionnaire are three. Where the data is held and who can reach it. How your own staff access customer data. And incident history. Our risk posture is that nothing is approved until the written review is complete, so I will not be giving a verbal view today, at any point.
- Jordan PikeUnderstood, and that's fair. To be transparent, we'd rather you push hard now than find something later.
- Hannah LoweCan I start by asking what you most need to know today? I'd rather spend the time on your priorities than walk through slides you don't need.
- Megan AlvarezIn order of priority. First, where data physically sits, and whether any of it leaves our control. Second, standing access by your personnel. Third, the incident disclosure. I have numbered questions for each.
- Hannah LoweGood. Then let me take the first one. The short answer is that the brain is built and run inside the customer's own Snowflake account. The longer answer is that BG-Demo does not copy your records into a store that we own and operate. The indexes, the pages, the question history, all of that lives in your Snowflake account, under your account controls.
- Megan AlvarezQuestion one, then. If the brain runs in our account, which parts of the system are not in our account? Please be exact. I need the boundary.
- Hannah LoweTo be precise, there are two things on our side of the boundary. The software we deploy and update, and the support channel we use when you raise a ticket. Anything in the data layer stays on your side. I'll draw this as a diagram and put it in writing, because it's easier to hold us to a picture.
- Megan AlvarezPlease do. And I want the update path described, not just the data path. How does your software get into our account, and who approves a change?
- Hannah LoweRight. That's a fair distinction. Give me a second, I'm going to share my screen so you can see the deployment view rather than me describing it.
- Hannah LoweOkay, can you see it? This is the account layout for an Enterprise customer. On the left, the source systems, so in your case the CRM, the helpdesk, the call recorder. In the middle, the loading jobs that run in your Snowflake account. On the right, the layer that answers questions.
- Megan AlvarezI can see it. Where is the line for the update path?
- Hannah LoweHere, this dotted line. A release is packaged by us, but it is applied inside your account, and your administrators can see what is being applied. What I want to confirm before I overstate it is whether an Enterprise customer can hold a release until their own change window. I believe so, but I am not going to say it as fact until I have checked it with the colleague who owns our security programme.
- Megan AlvarezThank you for saying so. For the record, I will not accept a best effort answer on change control. Either a customer can hold a release or it cannot.
- Hannah LoweUnderstood, and I wouldn't offer you best effort. You'll get a yes or a no, in writing, with the control described.
- Jordan PikeLet me note that down as an action, so it doesn't get lost. Hannah, written answer on release holds, with the diagram. Megan, tell me if I've got that wrong.
- Megan AlvarezThat's correct. Continue, Hannah. Question two. Standing access by your personnel.
- Hannah LoweYes. So, in the usual setup, BG-Demo staff do not have standing access to your data. When we need to look at something, say to debug a connector that has stopped loading, access is granted by your administrator and it is time-bound.
- Megan AlvarezWho logs that access? Is the log held by you or by us?
- Hannah LoweBecause it's your Snowflake account, the access history is in your account. You hold it. We can also keep our own record of what we did, but yours is the one that matters.
- Megan AlvarezAnd for our own staff? Our client-services teams would use the brain daily. How are they authenticated, and how are leavers removed?
- Hannah LoweThat's where Enterprise adds single sign-on and SCIM. Sign-in goes through your identity provider, so your own policies on authentication apply. SCIM means that when someone is removed in your directory, they are removed from the brain without anyone remembering to do it by hand.
- Megan AlvarezIs deprovisioning immediate or on a schedule?
- Hannah LoweI don't want to guess at the timing. It depends on how your directory pushes changes. I'll put that in writing with the exact behaviour.
- Megan AlvarezNoted. I will log it as an open item. Next, residency. Our contracts with several hospital groups require that protected data stay in the United States.
- Jordan PikeYeah, and I'll jump in on that one. Dedicated US data residency is an add-on we offer, and we would scope it explicitly in the order form so it's a contract term, not a verbal promise. But Hannah, I'll let you cover the technical side.
- Hannah LoweThe technical point is simple. The region is the region your Snowflake account is deployed in. We don't move it. So the question is really about your account configuration and about the support channel, where a ticket might carry some detail. I'll describe what we put in tickets and what we ask customers not to.
- Megan AlvarezPlease also describe what happens if a support engineer in London needs to see something. Is that a transfer out of the United States?
- Hannah LoweThat's a real question and I think the honest answer depends on how the access is granted. If an engineer in London views data in your account through a session you approve, the data stays where it is, but it is still being viewed from outside the country. Whether your contracts treat that as a transfer is for you and counsel. What I can do is tell you exactly what is technically possible.
- Megan AlvarezThat is a straightforward answer. I'll take it. I'd like the technical description in the written response, and I'd like it to state whether support can be restricted to United States based staff.
- Jordan PikeOkay. To be transparent, I don't know if we can commit to that today, and I don't want to say yes and walk it back. I'll find out and come back with a straight answer.
- Megan AlvarezAppreciated.
- Hannah LoweCan I add one more thing on that? Premium support is a separate add-on with a named engineer. I'd be careful about assuming it solves the location question. It changes who responds, not where they sit. I'll cover it in the written answer so there's no confusion.
- Megan AlvarezGood. Let us move on to encryption and key management. Question four, in my list. Who holds the keys?
- Hannah LoweWithin your account, encryption is handled by Snowflake and its key arrangements, which you control. We don't hold your keys. Where I'd want to be careful is anything that sits outside the account, like our own ticketing system. I'll separate those clearly so you can see which control applies where.
- Megan AlvarezPlease do. I want each control mapped to a component. Not a general statement that data is encrypted.
- Hannah LoweUnderstood. A table, component by component. I'll put that in writing.
- Jordan PikeQuick time check, we're about twenty minutes in, so we're roughly where I hoped. Megan, do you want to go to incidents now, or finish the architecture items first?
- Megan AlvarezIncidents now. My question, as it was in the questionnaire: please describe any incidents in the last ninety days. I mean security incidents, availability incidents and any event involving customer data, whether or not it was reportable.
- Hannah LoweI want to be careful here. I'm not going to answer that from memory, because it's your incident question and it deserves a record, not my recollection of the last quarter. The register is held by the colleague who owns our security programme. I'll ask for the complete answer and put it in writing.
- Megan AlvarezI understand that you cannot answer it verbally. But I will say for the record that I prefer to hear about anything from you before I find it elsewhere. If there is something, the disclosure should come with your assessment and what changed afterwards.
- Jordan PikeYeah, and that's the way we want to handle it. Nothing hidden from your security team, ever. Here's where we are: the written incident disclosure comes to you before session two, and it covers security and availability, and anything touching customer data.
- Megan AlvarezInclude near misses. If a control stopped something, I want to know that it was tested.
- Hannah LoweNear misses, yes. I'll ask that they're included and I'll tell you if the register doesn't capture them in that form.
- Megan AlvarezFine. Next. Sub-processors. Please list every third party that can touch data from our account, or metadata about it.
- Hannah LoweThe short answer is that the list is short, because the data layer is in your account. The longer answer is that I won't recite it, because I'd rather you got the complete and current list in a document than my version of it. I'll attach it.
- Megan AlvarezAgreed. Business associate agreement. Where is it in your process?
- Jordan PikeThat's with our contracts team, and it's tied to the order form. I'd rather not describe a status I can't verify. I'll get you where it stands, and I'll say it plainly even if the answer is that it isn't started.
- Megan AlvarezI'd prefer that. I should say that our review does not move to the next stage without it.
- Jordan PikeUnderstood. And on the commercial side, since you'll ask: the deal amount we've proposed is £155,000 in total, with implementation included, and we've pencilled the close for 30 Jun 2026. But that date is a plan, not a pressure. If the review needs longer, it needs longer.
- Megan AlvarezCommercial timing is not part of my review and it will not shorten it. I'd ask that your team does not frame it as a deadline in correspondence with my colleagues.
- Jordan PikeFair point. Noted, and I'll make sure that's how we handle it.
- Jordan PikeWhile we have a minute, Megan, what would make this a yes? Not asking for a verdict, just what a clean path looks like from your side.
- Megan AlvarezI'm not going to answer that, Jordan. How the review is scored is internal, and I don't share it with a vendor. What I can tell you is what I need to see: complete written answers, consistent across sessions, and nothing that changes between one session and the next.
- Jordan PikeOkay. That's clear. Consistent and complete. We'll hold ourselves to that.
- Hannah LoweCan I ask one question back, Megan, so that the written response lands properly? Is the question about logs only about access logs, or also about the query history, meaning what questions your staff ask the brain?
- Megan AlvarezBoth. Question history may contain patient identifiers if a user types one. I need to know who can see it, how long it is kept and whether it can be exported.
- Hannah LoweGood, that's the right worry. It sits in your account, so the retention is configurable on your side. What I'd like to confirm is what we recommend by default. I'll check, and I'll state the default and the options.
- Megan AlvarezPlease. Moving on. Penetration testing and independent assurance. What do you have, and when was it last done?
- Hannah LoweThis is one where I need to be careful not to overstate. I know we have an assurance programme and that Enterprise reviews are supported with documentation. I do not have the dates in front of me and I'm not going to approximate them. I'll send the evidence with its dates, and I'll say clearly if something is not independently verified.
- Megan AlvarezThat is acceptable. For the record, a summary is not evidence. I'll want the documents or the attestations themselves.
- Hannah LoweUnderstood. Documents, not a summary.
- Megan AlvarezBusiness continuity. If the brain is unavailable, what is the effect on our client services? And what is the commitment?
- Jordan PikeI can take the service level piece. Enterprise carries the higher availability commitment, and a thirty minute first response on a priority one incident. Service credits on Enterprise cover availability and also data freshness. An executed order form can change any of those, so if you need something stronger, we'd put it in the order form.
- Megan AlvarezYour thirty minutes is a first response. That is not a restoration time. I want that distinction understood.
- Hannah LoweYou're right, and I'd rather say it than have you find it. First response is the commitment. Restoration depends on the cause, and I won't promise a restoration time that isn't in the contract.
- Megan AlvarezGood. Then I will put a restoration question in my follow-up.
- Jordan PikeSure. Send it over and we'll take it seriously.
- Megan AlvarezOne more topic for today, and it concerns the data refresh. Your nightly refresh is completed by early morning local time on business days. If it fails, does the brain say so, or does it answer on stale data without notice?
- Hannah LoweThat's a good question, and a distinction I like to make. Availability and freshness are different. A brain can be available and answering on yesterday's data. What I need to confirm is exactly how the freshness state is shown to a user. I believe there is an indicator, but I'd like to show it to you rather than describe it from memory.
- Megan AlvarezIn a patient context, a silent stale answer is a risk in itself. I would like that demonstrated in a later session.
- Hannah LoweI can do that in session two. I'll set it up on a sample environment so nothing real is on screen.
- Megan AlvarezAgreed. Is there anything on my list I've skipped?
- Jordan PikeI think you've covered it. Let me play it back so we're all aligned. Hannah sends the architecture diagram with the update path and the boundary. A written answer on holding a release. Access, logging and deprovisioning behaviour with SCIM. The US support question. The component by component encryption table. The sub-processor list. The assurance documents with dates.
- Jordan PikeOn my side, the business associate agreement status and the answer on restricting support to staff in the United States. And the incident disclosure, which covers the last ninety days and goes out before session two. Did I miss anything?
- Megan AlvarezThe query history question. Retention, visibility and export. And the restoration question will come from me.
- Hannah LoweYes, query history. Adding it. Thank you, Megan.
- Megan AlvarezLet me also say what I'll do. I will send my numbered follow-up questions in writing after this call. Please respond in writing and refer to my numbering, so that I can compare your answers across the three sessions.
- Jordan PikeWill do. We'll mirror your numbering exactly.
- Hannah LoweAnd if one of my answers changes after I've checked it, I'll say so explicitly in the response, rather than quietly replacing it.
- Megan AlvarezThat is how I would want it handled.
- Jordan PikeOkay. Since we have a few minutes left, anything you want to raise that isn't on the list? Any concern you'd like us to know about before session two?
- Megan AlvarezOne. I report to our board risk committee, and they will ask whether I was given complete information. My concern is not any single answer. It is whether I will find, later, something I should have been told earlier. That is what I will be judging across the sessions.
- Jordan PikeThat's a clear message, and I appreciate you being direct. You'll get everything we know, including the awkward parts.
- Hannah LoweAgreed. And if I find I've been imprecise today, I'd rather correct it myself than have you catch it.
- Megan AlvarezThank you. Then I have nothing further for this session.
- Jordan PikeGreat. I'll send a short note this evening with the action list as I've read it back, so you can correct it. And I'll propose times for session two.
- Megan AlvarezPlease propose a few options. My calendar is crowded with the board cycle.
- Jordan PikeWill do. A few options, and I'll keep them close enough that the written answers don't go stale.
- Hannah LoweOne practical thing, Megan. If it helps, I can send the diagram a day before the written response, so you have time to look at it on its own.
- Megan AlvarezThat would help. Send the diagram first.
- Hannah LoweDiagram first, then the written answers. Done.
- Jordan PikeAnything else from either of you before we drop off? No? Okay. Thanks, Megan. Thanks, Hannah. Really useful session.
- Megan AlvarezThank you both. I will send my questions shortly. Goodbye.
- Hannah LoweThanks, Megan. Speak soon.
- Jordan PikeHannah, still there? Quick one before you go. Can you get the answer from your security colleague by Wednesday? I'd like to give Megan a clean update first.
- Hannah LoweI'll chase it tonight. Talk tomorrow.
Callsmade from