Quillmark Health / BG-Demo – Security Review
Callcompleted
Quillmark Health · 6 Jul 2026 16:00
Third and final security review session for the Enterprise deployment. Megan Alvarez required a written answer to each finding; breach notification and the business associate agreement stay open with Jordan Pike's contracts side.
What was said
What this says
As at Fri 9 Oct 2026Third and final security review session for the Enterprise deployment. Megan Alvarez required a written answer to each finding; breach notification and the business associate agreement stay open with Jordan Pike's contracts side.
What happened: Megan Alvarez, Chief Information Security Officer, took Hannah Lowe through the findings one by one and required a written answer to each. Hannah committed to a signed incident statement the next day and the remaining responses within the week.
Customer view: Megan said she gives no verbal approvals and that best effort is not an answer she can take to the board. She wants US data residency written into the contract, not left in a deck.
Commercial: Hannah said Jordan Pike holds a total of £155k, implementation included, and is working towards 31 Jul 2026. Megan said her timeline is set by whether the findings are closed.
Watch: The breach notification window and the standing access wording stayed open. This call is dated after the earlier negotiation call in which Quillmark declined, and the record does not reconcile the two.
Themes
As at Fri 9 Oct 2026Theme
Security review open findings
Importance
neutral
Sentiment
mixed
Voice
decision-maker
Who was there
BG-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
As at Fri 9 Oct 2026- Hannah Lowe sends a dated, signed incident statement the day after the call.
- Hannah Lowe sends the remaining written responses together within the week, titled by finding number.
- Jordan Pike's contracts side responds on breach notification wording and the business associate agreement.
Risks
As at Fri 9 Oct 2026- Breach notification and the business associate agreement are contractual commitments still open with Jordan Pike's contracts side.
- Identity timing and standing access wording were not answered on the call, and Megan Alvarez rejects best effort.
- Premium support ends mid-afternoon for Quillmark's Boston teams, which may weigh against the Enterprise offer.
Opportunities
As at Fri 9 Oct 2026- Dedicated US data residency add-on fits Quillmark's stated requirement if written into the order form.
- Megan Alvarez valued Hannah Lowe's direct answers about what she could not confirm.
Transcript
Hannah LoweHello, Megan, can you hear me all right?
Megan AlvarezI can. Good afternoon, Hannah.- Hannah LoweGood afternoon. Sorry, I was fighting the screen share settings. Right. Before we start, what do you most need to come away with today? I'd rather aim at that than walk through everything again.
- Megan AlvarezFor the record, this is the third and final session of the review. Let me restate scope so we are aligned. The scope is the Enterprise deployment for our client-services teams, running inside our Snowflake account, touching data about hospital clients that may include protected health information. There are open findings from sessions one and two. I will take them by number, and I need a written answer to each one.
- Hannah LoweThat's fine. To be precise, I have the list from your last email open in front of me. Shall we go in your order?
- Megan AlvarezYes. Finding one. Please describe any incidents in the last ninety days. I received a written response after the second session. I need to confirm it is current as of today.
- Hannah LoweRight. The short answer is that the statement you have was accurate when we sent it. The longer answer is that I don't want you relying on an old email, so I'll put a refreshed one in writing, dated today. I'd rather not recite it from memory on a call, because you'd rightly want it on paper.
- Megan AlvarezGood. It should be dated, and it should be signed by someone with the authority to attest to it. Not an engineer's email.
- Hannah LoweUnderstood. I'll ask for it to come from a senior person here rather than from me. I can't promise exactly who until I've asked, but it won't be a casual note.
- Megan AlvarezPlease don't say you can't promise on a record that goes to my risk committee. Say what you will do and by when.
- Hannah LoweFair. I will request a dated, signed incident statement from our senior leadership, and I will send it to you tomorrow.
- Megan AlvarezThank you. Finding two. Data location and access. Walk me through where our data sits and who at BG-Demo can see it.
- Hannah LoweSure. The brain is built and run inside your Snowflake account, so the data doesn't leave it for any storage of ours. We don't copy your records into a BG-Demo environment and query them from there. The queries run where the data already is, under roles your administrators create. Whatever access our people have is access your admins grant and can revoke.
- Megan AlvarezAnd does any BG-Demo employee hold standing access to that account?
- Hannah LoweThe short answer is no, not by default, as far as I understand the design. The longer answer is that some support or connector work needs access for a period, and in that case your admins grant it and it's theirs to time-limit. I'd want to confirm the exact wording with a colleague who owns our security policy before you quote me. I'll put that in writing.
- Megan AlvarezPlease do. I am recording that as still open, pending your written wording on standing access and time limits.
- Hannah LoweNoted. Standing access, time limits, who approves. Yes.
- Megan AlvarezRelated to that. Our data residency requirement. All of it stays in the United States. Where does that land in your offering?
- Hannah LoweThere's a dedicated US data residency add-on, and I'd expect it to be relevant for you. What I'd want is for it to be written into the order form explicitly, rather than assumed from the architecture. Your Snowflake account sits where you've put it, so in practice the location is yours to set, but I'd rather the paper said so.
- Megan AlvarezAgreed. For the record, I want it in the contract, not in a deck.
- Hannah LoweYes. Not in a deck. I'll flag that to Jordan as well, since he holds the order form.
- Megan AlvarezFinding three. Identity. Single sign-on, and what happens to access when someone leaves Quillmark.
- Hannah LoweEnterprise includes SSO and SCIM, so users come in through your identity provider, and provisioning and removal follow what you do there. If someone's disabled in your directory, they lose access to the brain through that route.
- Megan AlvarezHow quickly? Please give me a time.
- Hannah LoweHonestly, it depends on how your identity provider syncs, and that's your configuration, not ours. What I can say is that removal there removes access, and I don't want to put a number on a sync interval I don't control. Anything else would be a guess.
- Megan AlvarezThen I will say plainly that best effort is not an answer I can take to the board. I need to know what is guaranteed and what is dependent on us.
- Hannah LoweI'm not offering best effort. I'm splitting it in two. What we control is that a removal in your directory removes access to the brain. What we don't control is the timing of your identity provider's sync. I'll write it exactly like that, as two separate statements, so the dependency is visible.
- Megan AlvarezThat is acceptable as a format. I will assess the content when I see it.
- Hannah LoweOf course.
- Megan AlvarezFinding four. Breach notification. Under HIPAA we require a business associate agreement, and our contract language requires notification within a defined window. I need to know what BG-Demo will commit to.
- Hannah LoweRight. I should be straight with you here. That is a contractual commitment, and it isn't mine to make on a call. Jordan Pike and our contracts side own it. What I can do is take your exact required wording and make sure it reaches them today, rather than it living in my notes.
- Megan AlvarezThen it remains open. And I want to be clear that I will not close it on a verbal indication from a solutions engineer, with respect.
- Hannah LoweNone taken, and that's correct. It should come from the people who can sign it.
- Megan AlvarezCould you also confirm that a business associate agreement is something BG-Demo has signed before with other customers? Or is this new territory?
- Hannah LoweI don't know that offhand, and I'd rather not say yes and be wrong. I'll ask. If the answer is that it's new, you'll hear that from us in the same email, not later.
- Megan AlvarezI appreciate that. Vendors who disclose before I find out are the vendors I can work with.
- Hannah LoweUnderstood. That's how we'd want to do it anyway.
- Megan AlvarezFinding five. Service levels. I have the Enterprise terms from the proposal. Please confirm availability and incident response, and then explain the data freshness commitment, because in our workflow stale data is a patient-data risk, not an inconvenience.
- Hannah LoweYes. On Enterprise, availability is ninety-nine point nine. First response on a priority one incident is thirty minutes. The nightly refresh is complete by 07:00 your local time on business days. And Enterprise is credited for freshness as well as availability, which the lower tiers aren't.
- Megan AlvarezWhat does the credit actually do for me if the refresh is late and a team works from stale figures all morning?
- Hannah LoweCandidly, a credit is a financial remedy, not an operational one. It doesn't un-stale the data. What it does is make the breach a contractual event, so it's measured and visible. For the operational side, the response commitment is what matters, and the connector monitoring. I'd point you at the exact clause in the order form, because I don't want to paraphrase a remedy.
- Megan AlvarezUnderstood. And support hours? Our teams are in Boston.
- Hannah LoweThe Premium support add-on gives you a named engineer from 07:00 to 20:00 UK time. That ends mid-afternoon for you, so I'd flag it as something to weigh, not hide. Outside those hours the standard response commitments still apply.
- Megan AlvarezThank you for saying that unprompted. Noted.
- Megan AlvarezFinding six. Independent testing. Has the platform had a recent third-party penetration test, and can you share a summary under non-disclosure?
- Hannah LoweI'm not going to answer that from memory, because it's exactly the kind of question where I'd rather check than be approximately right. I'll find out what exists, how current it is, and what we're able to share and on what terms. You'll get a straight answer, even if the answer is that a summary isn't available.
- Megan AlvarezPlease include the date of the most recent test. I will not accept an undated reference.
- Hannah LoweDated, yes.
- Megan AlvarezFinding seven. Logging. Can we, as the customer, see an audit trail of who asked the brain what? If a client-services person queries records about a specific hospital group, I need to be able to reconstruct that.
- Hannah LoweBecause it runs inside your Snowflake account, query activity sits in your environment, which is the good news for you: it's your logging, under your retention. What I'd want to be precise about is which of the brain's own events are captured in addition, such as questions asked through chat. I believe the answer is yes, but I'd put it in the written response with the specifics rather than say it loosely.
- Megan AlvarezI believe is not sufficient for a finding of this type.
- Hannah LoweNo, quite right. I'll confirm it and write it down as a statement, or tell you where it falls short.
- Megan AlvarezFinding eight, and this is the last one. Subprocessors. Please provide the list of any third parties that process data on BG-Demo's behalf, and describe whether any of them would touch our data.
- Hannah LoweGiven the architecture, the aim is that your data stays in your account, so the question is really about what sits outside it, such as support tooling and anything that handles metadata. I'll ask for the current subprocessor list and for a plain statement of whether any of them ever see customer data. If the honest answer has caveats, they'll be in the document.
- Megan AlvarezGood. Caveats should be in the document. I would rather read a caveat than discover one.
- Hannah LoweAgreed.
- Megan AlvarezLet me summarize what I have, so that the record is accurate. One, a dated and signed incident statement. Two, wording on standing access and time limits. Three, residency in the contract. Four, identity, written as two statements. Five, breach notification and the agreement, from your contracts side. Six, service level clauses. Seven, the penetration test summary with a date. Eight, audit trail specifics, and nine, the subprocessor list. Is that your list?
- Hannah LoweThat matches mine, yes. I'd only add that the first four and the last two are mine to produce, and the breach notification and the agreement are Jordan's with our contracts side. I'll make that split clear in the email so you know who owes what.
- Megan AlvarezPlease do. When can I expect the written responses?
- Hannah LoweThe incident statement tomorrow, as I said. The rest I'd like to send together, so you have one coherent response rather than pieces. Within the week, and where something needs a colleague's confirmation I'll tell you that before the end of this week rather than leave it silent.
- Megan AlvarezThat is acceptable. I will say that I do not accept an extended silence.
- Hannah LoweYou won't get one.
- Hannah LoweCan I ask something, and you can tell me no? Is there anything you can say about how it's looking from your side? It would help me to know where to put the effort.
- Megan AlvarezI can tell you no. I do not give verbal approvals, and I do not share the scoring of a review with the vendor. That is not a reflection on you. It protects the integrity of the process. The determination goes to our board risk committee, in writing, after I have your written responses and have assessed them against our risk posture.
- Hannah LoweThat's entirely fair, and I'd rather you were consistent than convenient. I'll say for completeness that commercially Jordan is working towards Friday 31 July 2026 on the order form, and the total he has is one hundred and fifty-five thousand pounds, implementation included. But that's his date and his conversation, not a pressure on yours.
- Megan AlvarezIt is not my timeline. My timeline is set by whether the findings are closed. If they close after that date, they close after that date.
- Hannah LoweUnderstood. I'll make sure Jordan hears it in those words.
- Megan AlvarezOne more point for the record. If any of your answers change between now and a decision, whether it is an incident or a change in how data is handled, I expect to be told promptly, without having to ask.
- Hannah LoweYes. That's a fair expectation, and I'll pass it on so it isn't only me who knows it.
- Megan AlvarezThen I think we have covered the findings. Is there anything you believe I have not asked that I should have?
- Hannah LoweThat's a good question. Nothing I'd call a gap. If I were in your seat I'd be most careful about the two things I can't answer today: the breach notification window and the standing access wording. Those are the ones I'd read most closely when they arrive.
- Megan AlvarezI will. Thank you for being direct about what you could and could not answer. That is noted.
- Hannah LoweThank you. I'd rather be useful than smooth. So: signed incident statement tomorrow, the written responses together within the week, and the contractual items travelling through Jordan today.
- Megan AlvarezCorrect. I will wait for your email. Please address it so that it can be filed with the review.
- Hannah LoweI'll title each response with the finding number, so it maps straight onto your list.
- Megan AlvarezGood. Thank you, Hannah. That concludes the session.
- Hannah LoweThanks, Megan. Speak soon, and have a good evening.
- Megan AlvarezGoodbye.
Callsmade from