Ardcarne Life Assurance / BB-Demo – Security Review
Callcompleted
Ardcarne Life Assurance · 2026-05-19 15:45
Session one of four with the CISO at Ardcarne Life Assurance. Six findings are open, all owned by BB-Demo, none closed. He will accept only written, dated answers, and says the 30 Jun 2026 date moves if the evidence is missing.
What was said
What this says
Current to 13 Oct 26Session one of four with the CISO at Ardcarne Life Assurance. Six findings are open, all owned by BB-Demo, none closed. He will accept only written, dated answers, and says the 30 Jun 2026 date moves if the evidence is missing.
What happened: Theo Gallagher ran session one of four of the security review with Declan Furlong, the CISO, covering architecture, residency and subcontractors. Declan recorded six open findings, all owned by Theo, none closed.
Customer view: Declan will not accept verbal assurances and wants dated written answers he can show the Central Bank under DORA. Several questions sit with the platform team, whom Theo will bring to session two.
Commercial: The proposal value is £155k including the one-off implementation, so it is not an annual figure. Whether the dedicated EU data residency add-on is inside it is for Matteo, and the call did not settle it.
Watch: The commercial plan points at 30 Jun 2026, but Declan said the date moves if the evidence is not there.
Themes
Current to 9 Oct 26Theme
DORA security review
Importance
neutral
Sentiment
mixed
Voice
decision-maker
Who was there
BB-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Theo Gallagher to send the architecture description, roles and data flow to Declan Furlong by Friday.
- Theo to bring written answers on findings one to four and a platform team colleague to session two.
- Matteo to be asked by Declan whether the EU residency add-on sits inside the proposal.
Risks
Current to 9 Oct 26- Six findings are open and none closed, so the 30 Jun 2026 target may slip.
- Key answers on the model, logging, subcontractors and credentials depend on the platform team.
- Whether the EU data residency add-on is in the proposal is unconfirmed.
Opportunities
Current to 9 Oct 26- The dedicated EU data residency add-on could be sold alongside the proposal.
- Clear written answers could make BB-Demo a trusted supplier to a regulated insurer.
Transcript
Theo Gallagher NoneAfternoon, Declan. Can you hear me all right?
Declan Furlong NoneGood afternoon, Theo. Yes, clearly. Give me a moment, I am just closing another meeting.- Theo Gallagher NoneNo rush at all. Is it still raining in Dublin? It has only just stopped here, which feels like a minor miracle for May.
- Declan Furlong NoneIt has not stopped, no. But I am indoors until the evening, so I am quite unaffected. Right, I have the questionnaire open and the screen sorted. Shall we begin?
- Theo Gallagher NonePlease. As I said in my note, this is session one of four. Today I would like to cover three areas: the architecture, residency, and subcontractors. The open items against those are the architecture description, the residency statement and the subcontractor register. All three are mine, with input from our platform team on the second. The rest of your questionnaire I have parked for the later sessions.
- Declan Furlong NoneThank you. Let me list what I have on my side, so that we are working from the same register. Under DORA we need three things from this session. First, a clear description of where the data sits and who can reach it. Second, a statement of residency that I can use for the register of information. Third, the identity of every subcontractor that supports the service, and what each one does. Is that consistent with your understanding?
- Theo Gallagher NoneIt is. Shall I start with the architecture and you stop me whenever something is unclear?
- Declan Furlong NonePlease. And I will say now, so that there is no misunderstanding: I will note what you tell me, but I will not close anything on a verbal assurance. I need it written and dated.
- Theo Gallagher NoneUnderstood, and that is how I would rather work. Where I say we can evidence something, I will attach the evidence. Where I cannot yet, I will say so.
- Declan Furlong NoneGood. Then proceed.
- Theo Gallagher NoneSo, the starting point. The brain is built and run inside your own Snowflake account. It is not a BB-Demo hosted service that you send data to. The connectors read from your source systems, the data lands in your account, and the indexing and the question answering happen there. I understand the first scope is broker distribution and customer service, so I would expect the CRM and the helpdesk first, but that is a decision for your project team, not something I want to pin down today.
- Declan Furlong NoneLet me take that apart. Question one: when you say inside the account, do you mean that BB-Demo holds no copy of our data anywhere else?
- Theo Gallagher NoneThat is my understanding of the design, yes. What I do not want to do is hand you the sentence nothing ever leaves as a blanket statement, because you will ask me about support tooling and about telemetry, and I would be answering for the platform team. I will ask them and give you a written answer.
- Declan Furlong NoneNoted. That is finding one, then. Owner Theo, evidence required: written confirmation of what, if anything, leaves the account, including logs and telemetry.
- Theo Gallagher NoneAgreed, I have it as the first item. Shall I carry on with the architecture while you write that down?
- Declan Furlong NoneYes, I can type and listen.
- Theo Gallagher NoneGood. Access, then. Because it is your account, access is through roles that you grant and can revoke. Our people do not hold standing rights of their own that you cannot see. For Enterprise there is also SSO and SCIM, so your own staff come in through your identity provider rather than through separate accounts. I would like to take the detail of that later, with the authentication section in front of us.
- Declan Furlong NoneQuestion two. Who administers those roles on your side during implementation? A named person, or a team?
- Theo Gallagher NoneDuring implementation it would be named people, and you would see the list before anything is granted. I do not have the names to hand and I would rather not guess. I will put the proposed roles and the principle of least access in the architecture description.
- Declan Furlong NoneThe principle of least access is a phrase. I need the actual roles. Please include them.
- Theo Gallagher NoneFair. I will list each role, what it can read and what it can change.
- Declan Furlong NoneAnd logging. If I want to see who queried what, and when, is that held in my account or yours?
- Theo Gallagher NoneIn yours, as I understand it. The query history sits in the Snowflake account, so you hold it. Whether the brain keeps its own question log in addition, and for how long, I want to confirm with the platform team before I say a retention period out loud.
- Declan Furlong NoneMake that a separate finding. I prefer them separate for the register.
- Theo Gallagher NoneSeparate. Finding two: question logging, where it sits and how long it is kept.
- Declan Furlong NoneGive me a minute, I am updating the tracker.
- Theo Gallagher NoneTake your time.
- Declan Furlong NoneSorry, that took longer than I meant. Right, residency. The Central Bank expects me to say where the data is processed, not where the supplier is based. So: where is it processed?
- Theo Gallagher NoneIn the region of your Snowflake account. If your account sits in an EU region, then the stored data and the processing are resident there, because that is where the brain runs. It is why I would rather start from your account's region than from a statement of ours.
- Declan Furlong NoneOur account is in an EU region, Ireland, for the record. So that part is simple. What is not simple is your side: your staff in London, and any support that touches the account from outside the EU.
- Theo Gallagher NoneRight, and that is the honest part of the answer. Our people are in London, and support access would come from there. There is also a dedicated EU data residency add-on, and I want to be exact about what it covers on our side, so I will send you the wording rather than paraphrase it from memory.
- Declan Furlong NoneIs that add-on part of what is being proposed to us?
- Theo Gallagher NoneI do not know, and that is a commercial question for Matteo, who owns the terms. What I can say is that the deal value on the proposal is £155,000, and that includes the one-off implementation, so please do not read it as an annual figure. Whether the add-on sits inside it, I will not guess.
- Declan Furlong NoneI will raise it with Matteo separately. For the avoidance of doubt, I need the residency position regardless of price. A control is not conditional on whether it was purchased.
- Theo Gallagher NoneThat is a fair distinction, and I will write it that way: what is true by design, and what is true only if the add-on is taken.
- Declan Furlong NoneGood, that is exactly what I need. And the timetable, while we are here. The commercial plan I have seen points at 30 Jun 2026. I will not let that date shorten the review. If the evidence is not there, the date moves.
- Theo Gallagher NoneUnderstood. That is also my reading of four sessions. I would rather we finish properly than finish on a date.
- Declan Furlong NoneGood. Then subcontractors.
- Theo Gallagher NoneRight. What I will give you is a register: the name of each subcontractor, the service it provides, what data it can touch, in which location, and the date the entry was last reviewed. I will not recite names from memory, because you would rightly ask me for the evidence behind each one.
- Declan Furlong NoneQuite. But one direct question, which I would like answered in writing. Is there any subcontractor, of any kind, that can access content from the brain? By content I mean the records and the answers, not billing or email.
- Theo Gallagher NoneI cannot answer that from memory with the precision you need, and I am not going to answer for the platform team without asking them. I will put it to them today, and the answer will go into the register with a date.
- Declan Furlong NoneFinding three. Do you notice the pattern? Each of my questions has landed on the platform team.
- Theo Gallagher NoneI do, and I think it is the right pattern, because those are exactly the questions where the answer lives with them. It tells me I should bring them to session two rather than relay.
- Declan Furlong NoneI would welcome that. A direct explanation from the person who runs it is worth more than a paraphrase.
- Declan Furlong NoneRelated to that, the AI component. Where does the model run, and does any of our data go to a model hosted outside the account?
- Theo Gallagher NoneThat is the question I most want to treat with care. My understanding is that the intent is for the processing to stay within the account. But that is exactly the sort of sentence you told me not to rely on, so I will not call it settled until the platform team has confirmed it in writing, with the control reference.
- Declan Furlong NoneIts own finding, then. Finding four.
- Theo Gallagher NoneFour. All mine, none closed.
- Declan Furlong NoneLet me read back what I have so far, and you tell me if I have misrecorded anything.
- Theo Gallagher NonePlease.
- Declan Furlong NoneRight. One, what leaves the account. Two, question logging and retention. Three, subcontractor access to content. Four, where the model runs. Is that fair? Then a fifth, which is about the content itself. We are an insurer. The records you will index will include personal data of policyholders and pension members, held alongside broker firm details. Can we restrict which fields come in?
- Theo Gallagher NoneThat is fair, and the list is accurate. On the fifth, scoping is done at the connector, so you choose what is brought in. I would rather show you how that looks than describe it. Let me find out what I can show you without using live data, and I will come back with that rather than promise it now.
- Declan Furlong NoneAnd the purpose. I need to be able to say to the supervisor that this data is used for broker distribution and customer service, and for nothing else.
- Theo Gallagher NoneThe purpose is set by what you connect and who you let ask questions, so in practice it is your configuration. The contractual wording on purpose and processing is for the agreement, and I will make sure the right person on our side addresses it, so that you are not left with my interpretation.
- Declan Furlong NoneThen connectors. Where are the credentials for the source systems held, and who can see them?
- Theo Gallagher NoneI do not want to guess at the mechanism. What I can tell you is the shape of the answer you will get: where each credential is stored, who can read it, how it is rotated, and the date that was last evidenced. I will ask the platform team for that and add it to the architecture description as its own section.
- Declan Furlong NoneFinding five and finding six, then. Fields and credentials.
- Theo Gallagher NoneFive and six. I have them. I will say plainly that this is a longer list than I expected to leave with today, but I would rather have it long and honest.
- Declan Furlong NoneSo would I. A short list that is wrong is of no use to me.
- Declan Furlong NoneI will say one thing for the later session now, so that you can prepare. Under DORA we need incident notification times in hours, in writing. And I expect to hear about any incident from you first, not from my own monitoring or from someone else. I have a long memory for who told me first.
- Theo Gallagher NoneNoted, and I will put it at the top of that section. I will also bring the incident history, so that you are not asking for it twice.
- Declan Furlong NoneAnd exit. If we leave, what happens to the brain and what happens to our data? I need an exit plan that works, not one that is described.
- Theo Gallagher NoneAgreed, and I would like to take that in session three. The starting point is that the data is already in your account, so the exit question is mostly about what you keep and what is switched off. But I would rather walk you through it with the steps and the owners than assert it today.
- Declan Furlong NoneThen assurance. Do you hold any independent reports on your controls? I will want to see them, with dates.
- Theo Gallagher NoneI will send whatever is in date, with the date on it. If something is a draft I will label it as a draft, and I will not call it final. If there is a gap I will tell you where the gap is rather than leave you to find it.
- Declan Furlong NoneThat is more useful than most suppliers manage. Very well.
- Theo Gallagher NoneCan I check one thing on your side? For the register of information, is there a format you need the subcontractor entries in, so that I can match it and you do not have to retype?
- Declan Furlong NoneGood question. I will send you the template after this call. Match it exactly, please, including the column order.
- Theo Gallagher NoneWill do. I will not reformat it.
- Declan Furlong NoneLet me summarise for the record. Six open findings, all owned by you, none closed. Architecture description with data flow and roles. Residency statement distinguishing design from add-on. Subcontractor register. Written answers on the model, the logging, the credentials and the fields. I would like dates against each, please. Under DORA we need dated commitments I can show the Central Bank.
- Theo Gallagher NoneHere is the dated commitment. The architecture description, the roles and the data flow go to you by Friday. The written answers on findings one to four, once I have them from the platform team, will follow before session two, and I will tell you on Friday which ones I cannot yet give you. The residency wording and the subcontractor register also go before session two, and I will send the date of that session by email today.
- Declan Furlong NoneAcceptable. I will hold you to Friday. If something slips, I would rather hear it on the day than afterwards.
- Theo Gallagher NoneUnderstood. And I will bring someone from the platform team to session two, so that the questions land with the right person.
- Declan Furlong NoneGood. Thank you, Theo. I will send the register template this evening.
- Theo Gallagher NoneThanks, Declan. Speak soon.
Callsmade from