Brenneck Pay / BG-Demo – Security Review
Callcompleted
Brenneck Pay · 28 Jul 2026 11:00
Sabine Kranz is blocking the Enterprise upgrade until call audio is no longer processed outside the EU. Access log and exit plan findings are also open, and the third session will follow the evidence.
What was said
What this says
As at Fri 9 Oct 2026Sabine Kranz is blocking the Enterprise upgrade until call audio is no longer processed outside the EU. Access log and exit plan findings are also open, and the third session will follow the evidence.
What happened: This was the second of three security review sessions on the proposed move from Growth to Enterprise, with Matteo Ricci and Theo Gallagher. Sabine Kranz named audio processing by the call-transcription provider outside the EU as a blocking finding.
Customer view: She said EU data residency was a condition of signature and that she would rather lose a feature than lose the residency. She treats the current Growth tenant as a separate matter.
Status: Theo saw the transcription step listed as available but not enabled, but cannot yet prove what was sent before. The access log export lacks network source detail, and the exit plan annex is a draft that needs a signed deletion certification.
Commercial: Matteo said the upgrade is paused pending her sign-off. The 28 Aug 2026 signature target was conditional on a clean review, and the call does not show whether it held.
Themes
As at Fri 9 Oct 2026Theme
Security review, EU residency
Importance
upsell
Sentiment
mixed
Voice
decision-maker
Who was there
BG-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
As at Fri 9 Oct 2026- Theo Gallagher to send the configuration evidence, connector state and five provider questions on the day of the call, then the processing history with the platform team's date.
- Sabine Kranz to send her exact log field list and her written blocking position.
- Matteo Ricci to send the written confirmation, the notice commitment and exit plan wording once legal has reviewed it, and book the third session after the evidence.
Risks
As at Fri 9 Oct 2026- The Enterprise upgrade is blocked until call audio is no longer processed outside the EU.
- Theo cannot yet evidence what audio, if any, went to the provider before the transcription step was in its current state.
- The access log export and the exit plan certification are still open and could delay sign-off further.
Opportunities
As at Fri 9 Oct 2026- An EU endpoint at the transcription provider, or switching transcription off, could clear the block and keep the Enterprise path open.
- The merchant risk team uses the brain daily, which gives a value case for the upgrade once the review closes.
Transcript
Matteo RicciGood morning, Sabine, good morning Theo. Can you both hear me all right?
Sabine KranzGood morning. Yes, I can hear you. Your picture is a little behind, but the audio is fine.
Theo GallagherMorning both. I'm on the laptop speakers today, so say if I break up. Thanks for making the time, Sabine.- Sabine KranzOf course. It is very warm in Frankfurt this week, so forgive me if I sound tired. The air conditioning in our building has decided to take a holiday.
- Matteo RicciAh, I would not wish that on anyone. London is grey and sticky, the worst of both. Before we start, may I restate the timeline, so we are all looking at the same picture?
- Sabine KranzPlease.
- Matteo RicciThank you. Brenneck Pay is on Growth today, with forty licensed users, at £50k a year, and the order form runs to 2 Feb 2027. The proposal on the table is the move to Enterprise, and the date I am working towards for signature is Friday 28 August 2026. I would rather say plainly that the date only holds if this security review closes cleanly. This is the second of three sessions, and I do not want anyone to feel the calendar is leaning on the findings.
- Sabine KranzThank you, Matteo. I appreciate that. I will say at once that I do not discuss commercial terms, that is for you and your colleagues in procurement. My concern is only whether the requirements are met, on paper and in practice.
- Matteo RicciUnderstood, and that is exactly how it should be. I will keep my commercial remarks to the start and the end.
- Sabine KranzGood. Then I will begin with my open questions, because there are three. First, where exactly is the data processed, for every sub-processor, not only for the storage layer? Second, I need the access log export for the privileged accounts, and I need to see it for a full period, not a sample. Third, the exit plan. I need to understand what happens to our data and to the derived indexes if we leave.
- Theo GallagherThat maps well onto my list, so let me give you the open findings and the owners, and then we can take them in your order. Finding one is the sub-processor processing locations. The owner is our platform team, and I am coordinating. Finding two is the access log export. The owner is me, and the first extract went to you last week. Finding three is the exit plan wording, which I own for the technical annex, and Matteo owns for the contract side.
- Sabine KranzThat matches my own tracker. Good. And finding one is the serious one, as you know.
- Theo GallagherIt is, and I would like to be direct about it, so let me share the sub-processor register. Give me a second. Can you see it?
- Sabine KranzYes. The columns are small, but I can read them.
- Theo GallagherI'll make it larger. Right. So there are the storage and compute entries. Those run inside your Snowflake account, in the EU region you chose, and I can evidence that with the account configuration. Then there is this row, the call-transcription provider. When a recording is passed for transcription, the audio is processed on that provider's infrastructure, and for that step the processing location is outside the EU. The text that comes back is written into your EU region, but the audio step is outside it.
- Sabine KranzSo the audio itself leaves the European Union.
- Theo GallagherFor the duration of the transcription step, yes. I won't dress that up.
- Sabine KranzThen I have to be equally direct. This is a requirement, not a preference. EU data residency was a condition of our signature in the first place. Customer calls with merchants can contain payment details and complaints, and under the outsourcing requirements I have to be able to say where it is processed. Audio outside the EU is not acceptable to us.
- Matteo RicciSabine, I would rather you heard it from me as well: I am not going to ask you to accept it. If the audio leaves the EU, the upgrade does not proceed as far as I am concerned, whatever the calendar says.
- Sabine KranzI am glad to hear that. Then to be clear, I am blocking the upgrade until the audio is no longer processed outside the EU. Not mitigated, not described. Not processed.
- Theo GallagherUnderstood, and I think that's the right position to take. Can I ask one clarifying question? When you say blocking the upgrade, do you mean the current Growth tenant stays as it is?
- Sabine KranzThe current tenant is a separate matter. I need you to tell me whether the transcription feature is touching our data today. If it is not, then the current arrangement stands, and the block applies to the expanded scope.
- Theo GallagherRight. I can't answer that from memory and I won't guess at it. What I can do is pull the tenant's feature configuration and the processing records, and send them to you with the dates. If nothing has been passed to that provider for Brenneck Pay, the records will show it, and if something has, I will tell you that too.
- Sabine KranzPlease provide that evidence in writing. I do not close a finding on a verbal assurance.
- Theo GallagherOf course. We can evidence that, and it will be a document, not a conversation.
- Matteo RicciLet me confirm that in writing too, so there is a single trail. I will note that the second session raised the transcription location as a blocking finding, and that the upgrade is paused pending your sign-off.
- Sabine KranzThank you. Now, what are the options? I would like to understand what is technically possible before I take this to our risk committee.
- Theo GallagherThere are three, and I'll number them. One, the transcription provider offers processing in an EU region, and we move your tenant to that endpoint. Two, we switch off audio transcription for Brenneck Pay, so no audio is sent anywhere, and calls are not ingested as transcripts. Three, a different provider with EU processing, which is a bigger change and not mine to decide.
- Sabine KranzWhich of those is the most realistic?
- Theo GallagherHonestly, I think option one, if the provider's EU endpoint is available to us under our current agreement. But I have to ask our platform team before I say so. I never answer for them, because I would be overstating the control. What I can say is that option two is entirely in our hands and could be done quickly, as a configuration change.
- Sabine KranzOption two would satisfy me for the time being, provided it is evidenced. But then the feature is absent. What does your solution look like without call transcription? Matteo?
- Matteo RicciA fair question, and an honest answer. The brain still sits across your CRM, tickets, email and the finance data. What you would not have is the spoken content of calls. For merchant risk work, I suspect most of the value is in the other sources, but I would not want to presume. Your merchant account managers will have a view, and so will Elena Novak, who looks after the account.
- Sabine KranzElena has been helpful. I know the account managers use the merchant view a great deal. I would prefer to lose a feature than lose the residency.
- Matteo RicciWhich is a very clear steer. Thank you.
- Sabine KranzLet us move on to the second finding while Theo collects what he needs. The access logs. I received the extract. Thank you.
- Theo GallagherGood. So that was the privileged accounts, covering the period you asked for. Did it have the fields you need? Timestamp, account, action and source location?
- Sabine KranzMostly. The timestamp and account are there. The action is there. The source location is missing for some rows, and where it is there, it is an internal address range only. I need to know from which networks your engineers reach the environment.
- Theo GallagherThat's a fair gap, and I'd rather you spotted it than I explained it away. The export I sent is the platform view. The network detail sits in a different log, and I need to check whether that can be joined for the full period. Control reference wise, it's the access monitoring control, and I won't say it's complete until I have seen the joined output myself.
- Sabine KranzThen I will keep the finding open, and I will write the exact fields I need so there is no further misunderstanding.
- Theo GallagherPlease do. If the field is not there, I'll tell you it is not there, and we agree what is acceptable in its place.
- Sabine KranzAgreed. Third finding. The exit plan. I read the draft annex.
- Theo GallagherAnd before you go on, I should say it is a draft, so please don't treat it as final. It's not final.
- Sabine KranzUnderstood. My concern is the derived indexes. The raw tables are ours, in our account. But the brain builds structures on top, and I need to know they are returned or deleted, and by when, and who certifies it.
- Theo GallagherYes. So the design helps you here. Because BG-Demo runs inside your own Snowflake account, the indexes are objects in your account. On exit, access is revoked and the objects are either handed to you or dropped, at your choice. What the draft doesn't say clearly enough is the certification step. That's the gap, and I agree with you on it.
- Sabine KranzA certification, signed, with the date of deletion.
- Theo GallagherSigned and dated. I'll put it into the annex, and Matteo will take the contract language.
- Matteo RicciYes. I will bring the wording to our legal team and send you the language in writing. I will not commit to when it can be signed until they have seen it.
- Sabine KranzThat is acceptable. Now, you mentioned access to the tenant configuration. Are you able to look at it now?
- Theo GallagherI can look at what I can see from my side, yes. Give me a minute. I'll stop sharing the register and open the tenant settings.
- Theo GallagherRight. So what I can see is that the call-recorder connector is configured for Brenneck Pay, and the transcription step is listed as available but not enabled. That is the setting. I can't yet tell you from this screen whether any audio went through before it was in this state, which is why I want the processing records, and I want our platform team to confirm.
- Sabine KranzSo as it stands, nothing is being sent, but you cannot prove the history.
- Theo GallagherCorrect. That's exactly the distinction. The present state is a setting I can see. The history needs evidence, and I don't have it yet.
- Sabine KranzThat is a very precise answer, thank you. I will note it that way. It is much better than a general reassurance.
- Matteo RicciSabine, if I may, what does your regulator need to see here? I ask because I would like us to produce exactly that, and not a pile of documents.
- Sabine KranzA fair and useful question. Three things. The register of sub-processors with the processing location for each. A statement that no personal data is processed outside the EU, supported by the configuration. And the incident and change notification path, so that if a location changes, we are told before it happens, not after.
- Theo GallagherThe third one is important. I'd like to write that down as a commitment: advance notice of any change to a processing location. I can propose the wording, and here is the dated commitment I would like to attach to it once our platform team have agreed the notice period. I don't want to name a number of days that engineering has not seen.
- Sabine KranzAgreed. I would also like the notice to come to my team directly, not only to the commercial contact.
- Matteo RicciThat is reasonable, and it makes sense to me for it to go to the security contact. I will include it in the written confirmation.
- Sabine KranzGood. Let us return to option one. If the provider has an EU endpoint, what is required to prove it is the only path? I would not want a fallback to the other region if the EU one is busy.
- Theo GallagherThat's exactly the right worry, and I don't know the answer yet. A fallback is a common design in some services. So that goes onto my list as a question for the platform team and for the provider: is there any failover to another region, and can it be disabled? If it can't be disabled, option one fails your test and we go to option two.
- Sabine KranzExactly. Please ask that question in those words.
- Theo GallagherI will quote it from you. Noted.
- Sabine KranzI would also like to know whether the audio is retained by the provider after transcription, and for how long.
- Theo GallagherYes. Retention, deletion and whether it is used for any training, which I assume is a no, but I want that in writing from the provider, not my assumption. I'll add it as a fourth question to your three.
- Sabine KranzFive, if you count the failover. But yes.
- Theo GallagherFive, then. Processing region, failover, retention, training use, and the history of what was sent for your tenant.
- Matteo RicciWhile we are on the subject of the history, may I ask something that is slightly outside the review? Elena mentioned that the number of people using the brain at Brenneck Pay has gone up by roughly half on the previous quarter. Is that something your team is feeling?
- Sabine KranzI am not the right person for usage, but I hear from the merchant risk team that they use it daily now. It has been good for them. That is partly why I want this resolved properly and not simply refused.
- Matteo RicciThat is helpful to hear, and I will not push it further. I only wanted you to know that we take it seriously.
- Sabine KranzGood. Then the pace is up to the evidence. When can I expect the written statement on the processing history?
- Theo GallagherI'll send you what I have from my side as soon as this call ends, and that is the configuration and the connector state. The processing records depend on the platform team, and I'll ask them today. I'll tell you by email when they have answered, with the date they give me, rather than promising one now.
- Sabine KranzThat is acceptable. I would rather have a real date later than an invented one now.
- Theo GallagherQuite. It's the same principle, really.
- Sabine KranzLet me use the time to ask about something different. The other sub-processors on the register. I would like to go through them one at a time, so I can close what is clean and not hold everything for one item.
- Theo GallagherGood idea. That actually helps both sides. Let me share again. Right, the first is the cloud platform that Snowflake runs on, in your chosen EU region. Processing and storage are both there, and the evidence is the account's region setting, which I can screenshot with the date.
- Sabine KranzYes. And administrative access to that account? Who at BG-Demo can reach it?
- Theo GallagherNamed engineers only, through your own role grants, and you can revoke them at any time because it's your account. The grants list is part of the extract I sent for finding two, which is why the network source matters, and why I'm not calling that one closed.
- Sabine KranzUnderstood. So that line is clean pending the same log gap.
- Theo GallagherRight, pending the log gap. The next entries are the email delivery service and the error monitoring tool. Both process metadata only, and the register says so, but I'd like to give you the configuration that shows the payload is excluded, rather than ask you to take the register's word.
- Sabine KranzYes. Please provide evidence for both. Where are they hosted?
- Theo GallagherBoth in the EU according to the register. I'll attach the provider's own statements. If either turns out to be outside, I'll tell you in the same email, whichever way it falls.
- Sabine KranzThank you. That leaves the transcription provider as the only item I consider blocking, and the logs as the item I consider incomplete.
- Matteo RicciThat is a helpful summary, and I think it is quite a positive position to be in, if I may say so. One blocking item with a clear owner is a manageable thing.
- Sabine KranzIt is manageable, provided it is resolved by the facts and not by optimism. I have seen reviews where the last item takes longer than all the others.
- Matteo RicciYes. And that is why I have told Theo to take the time he needs. A date I cannot defend is worth less than a later one I can.
- Sabine KranzI appreciate that. Let me ask one more thing about the exit plan, since we are still here. If we exit mid-term, who bears the cost of the handover work?
- Matteo RicciThat is a commercial point, and I know you prefer not to take it, so let me answer it simply and put it in the written note for your procurement colleagues. I do not want to improvise it on this call.
- Sabine KranzThank you. That is the correct division of labour.
- Theo GallagherFrom the technical side, I can say that handing over the derived objects is a short piece of work, because they are in your account already. The longer part is the certification and the verification that nothing remains on our side, and that is what the annex should describe.
- Sabine KranzGood. Then I have one remaining question for today. Regarding the sandbox environment that comes with the larger tier. Is it a copy of production data?
- Theo GallagherNot by default, and I'm glad you asked it early. The sandbox is populated by whatever you choose to load. If you load production data into it, then it falls under the same residency rules, and it would sit in your EU region, in your account. I can document that as part of the Enterprise scope, so it is not left to interpretation.
- Sabine KranzPlease do. And the same applies to dashboards. If they are built on data that has crossed a border, I need to know.
- Theo GallagherYes. Dashboards are computed inside your account from your tables, so they inherit the region of the data. I'll write that down as a control reference with the evidence next to it, and not leave it as a statement.
- Sabine KranzGood. That is all I have for today on content. Shall we agree what is sent, and by whom?
- Matteo RicciPlease. Let me propose it, and then you can correct me. Theo sends today the configuration evidence and the connector state, the register extracts for the lines we reviewed, and the five questions on the transcription provider, in your words.
- Theo GallagherYes, and the updated access log request with the fields you will specify. I'll also ask the platform team for the processing history and for the answer on failover, and I'll tell you the date they give me.
- Sabine KranzAnd I will send my exact field list for the logs by the end of the day, and my written position that the upgrade remains blocked until the audio is not processed outside the EU. I will refer to it as a blocking finding in our tracker.
- Matteo RicciWhich is entirely fair. I will send the written confirmation of today's session, the notice commitment going to your security contact, and the exit plan wording once our legal team has reviewed it, without a signing date until I have one.
- Sabine KranzAnd the third session?
- Matteo RicciI would suggest we book it only once the evidence has arrived, so it is not an empty meeting. Would that suit you?
- Sabine KranzIt would. I prefer a meeting with something to review. Let it follow the evidence.
- Theo GallagherAgreed. One last thing from me. If option one works, there will be a configuration change on your tenant. I would want you to see the before and after, with dates, as part of the closing evidence for that finding. Not only a statement that it has been changed.
- Sabine KranzYes. Before and after, with dates. Thank you, Theo. That is the kind of answer that makes this process easier.
- Matteo RicciThen thank you, Sabine. I would just say that we are glad to be treated to a very exact review. It makes us better.
- Sabine KranzThat is kind. I hope the weather improves in London. Goodbye, both.
- Theo GallagherCheers, Sabine. Speak soon.
- Matteo RicciArrivederci, Sabine. Best regards, and speak soon.
Callsmade from