Etowah Lane Equipment Rental / BG-Demo – Security Review
Callcompleted
Etowah Lane Equipment Rental · 7 Jul 2026 17:45
Ravi Subramanian, the CISO, took Theo Gallagher through open security findings for an Enterprise deal. Theo gave dated commitments, not assurance. Carlos Medina wants a decision by 4 Dec 2026, but Ravi will decide on evidence, not the date.
What was said
What this says
As at Fri 9 Oct 2026Ravi Subramanian, the CISO, took Theo Gallagher through open security findings for an Enterprise deal. Theo gave dated commitments, not assurance. Carlos Medina wants a decision by 4 Dec 2026, but Ravi will decide on evidence, not the date.
What happened: Ravi Subramanian, the CISO, went through open findings with Theo Gallagher, and the list reached eight by the end of the call. Theo said "I don't know yet" on several points and promised dated written answers with control references.
Customer view: Ravi said design intent is not evidence and that open items matter more to him than closed ones. He said price plays no part in his view and that a reference customer is no substitute for a control.
Commercial: Carlos Medina is comparing BG-Demo with the group-wide analytics suite already in some departments. He has a decision date of 4 Dec 2026 and gave the all-in figure with implementation as £155k.
Watch: the two-role test, where a branch role asks a question that would be richer for the credit role, is a live session Ravi wants recorded. Vague written answers will cost patience.
Themes
As at Fri 9 Oct 2026Theme
Enterprise security review
Importance
neutral
Sentiment
mixed
Voice
decision-maker
Who was there
BG-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
As at Fri 9 Oct 2026- Theo Gallagher sends written answers on SSO, local login and SCIM evidence before the end of the following week.
- Theo runs the recorded two-role test with exported query history once Carlos Medina creates two test accounts.
- Theo sends the incident register, subcontractor table, connector scopes and exit steps with a control reference against each.
Risks
As at Fri 9 Oct 2026- Eight findings are open and the CISO will close them on evidence only, not on the decision date.
- Written answers that come back vague will lose the CISO's patience.
- The group-wide analytics suite is already in some departments and is the comparison.
Opportunities
As at Fri 9 Oct 2026- Enterprise SSO and SCIM plus the dedicated US data residency add-on answer the identity and region questions raised.
- A recorded two-role test could close the credit-data concern in one session.
Transcript
Theo GallagherHello, can you both hear me alright? Good evening from London, and good afternoon to you.
Carlos MedinaLoud and clear, Theo. Hi. Ravi's still finishing something else, he said to start without him if he's not on by quarter to, but I'd give him a minute.- Theo GallagherNo problem at all. How's the week been in Atlanta? Hot?
- Carlos MedinaHot and wet. We had a storm come through at lunch and a fair chunk of the branch network lost connectivity for a while, so it's been a fun afternoon on my side. Everything's back now, I think. Touch wood.
- Theo GallagherAh, that's never what you want in a week with a security review in it. Here it's grey and it's been drizzling since the morning, so I won't complain.
Ravi SubramanianGood afternoon. Apologies, I'm here. Ravi Subramanian. Can you hear me?- Theo GallagherYes, clearly. Hello Ravi, Theo Gallagher, I'm the solutions engineer on your review. Thanks for making the time, I know it's late for me and I hope not too awkward for you.
- Ravi SubramanianIt's fine. I'd like to go through my open findings first, if I may, so that we both know where we are before you present anything.
- Theo GallagherPlease do. I'll say how I've got them on my side as well, so we can check they match. As I have it there are four open. One, an architecture diagram with the trust boundaries marked: that's mine. Two, where the compute and the storage sit for a US customer: that's mine, with our platform team. Three, evidence for SSO and SCIM behaviour: mine. Four, a list of who at BG-Demo can reach a customer's account and how: also mine. And there's yours, the incident history, which I owe you in writing.
- Ravi SubramanianThat matches my list, with one addition. Five: what is the process for revoking access when one of your people leaves? I asked for it in the questionnaire and the answer was a paragraph of assurance.
- Theo GallagherFair. I'll add it as five and put my name on it. I'd rather give you the control reference and the log than a paragraph, so please hold me to that.
- Ravi SubramanianI will. Please evidence that, whichever way it comes out.
- Carlos MedinaCan I just say where I'm coming from, so the questions make sense? We're comparing you with the group-wide analytics suite that's already in the building in a couple of departments. Branch, national accounts and credit all want one view of a contractor account. Ravi's the reason this is a proper review and not a nod.
- Ravi SubramanianQuite. The audit committee will ask me what we allowed in and why, so I need to be able to answer.
- Theo GallagherUnderstood. Let me share my screen and start with the architecture, because most of the other findings hang off it. Give me a second. Can you see a diagram with three boxes?
- Carlos MedinaYes, I see it.
- Ravi SubramanianYes. The text is small but I can read it.
- Theo GallagherI'll make it bigger in the written version. So the key point is that B-Glass is built and run inside your own Snowflake account. It is not a BG-Demo tenant that your data gets copied into. The box on the left is your sources: whichever of your CRM, helpdesk, accounting system and the rest you choose to connect. The connectors read from those and land the data in the middle box, which is a set of schemas in your Snowflake. The right-hand box is the layer that people actually ask questions of. Everything in the middle and right sits inside your account boundary and under your roles.
- Ravi SubramanianQuestion one. What sits outside that boundary? I don't want the answer 'nothing'.
- Theo GallagherGood, because it isn't nothing. Outside the boundary there's our support access, the way our engineers reach in when you ask us to, and some operational telemetry about the service itself. What I need to be careful about is exactly what that telemetry contains. My understanding is it's job status and counts, not your row-level data, but I want to evidence that from the configuration and not tell you from memory.
- Ravi SubramanianThen it's an open finding until you do. Question two. Where does the language model run when someone asks a question?
- Theo GallagherRight, and that's one I'm going to take to our platform team rather than answer for them. I could give you a confident sentence, but if the platform team's answer differs in a detail you'd be right to be annoyed with me. I'll bring you a dated answer with the control reference.
- Ravi SubramanianThat is the correct answer, thank you. It's better than most vendors manage. Please note it down as finding six.
- Theo GallagherNoted. Six. Done.
- Carlos MedinaSorry, can I jump in on the US side? Our Snowflake account is in a US region already. Does the brain just follow that, or is there something separate you stand up?
- Theo GallagherMm, good question. Because it runs in your account, it lives in the region your account is in. That's the point of the design. Separately, we sell dedicated US data residency as an add-on, and that's about the parts that are ours: what we host, if anything, for operating the service. In your scope that's something to settle with Jordan, but the technical question for today is the same: which of our components, if any, sit outside your region. That's finding two and I'll answer it with the diagram.
- Ravi SubramanianAnd if the answer is that something sits outside the US?
- Theo GallagherThen I'll tell you plainly, name the component, and say what it holds. I'm not going to describe a control we don't have.
- Ravi SubramanianGood. Moving on to access. Who has standing access to a customer's account at BG-Demo?
- Theo GallagherMy understanding is that nobody holds standing access to a customer's account. Support access is requested, approved, time-limited and logged. But I'm going to be careful here: until you've seen the policy and a sample of the log format, treat what I've just said as a statement, not evidence. I'll send the control reference with it.
- Ravi SubramanianAgreed, that is how I'll record it. Who approves a request? The customer or you?
- Theo GallagherIdeally both. On your side an admin approves in your account, since it's your Snowflake, and on ours there's an internal approval. Carlos, I'd guess that's a role that sits with you or your team?
- Carlos MedinaProbably me, to start with, yes, or one of my two admins. But I'd want Ravi's team to have a view of it. We don't let anybody into the credit data without a trail.
- Ravi SubramanianWhich brings me to my main concern. The credit team's data. A branch manager should not be able to see a credit assessment of a contractor, even if the question they type seems innocent. What stops that?
- Theo GallagherThe short version is that the brain doesn't get its own idea of who can see what. It works through the roles and grants in your Snowflake account. If a branch role cannot read a credit table, the brain can't read it on that person's behalf. That is the design intent.
- Ravi SubramanianDesign intent is not evidence. Please evidence that.
- Theo GallagherQuite right. What I can do is set up a test with two roles, one with the credit grant and one without, ask the same question as each, and give you the output and the query history. We can evidence that, and I'd rather do it on a call where you're watching than send you a screenshot.
- Carlos MedinaThat would help me too, actually. The thing I worry about isn't the tables. It's the summaries. If the brain writes a paragraph about a contractor, can that paragraph pull in something the person asking shouldn't see?
- Theo GallagherRight, that's the sharper version, and it's a better test than mine. I'll include it: a question where the answer would be richer for the credit role, asked by the branch role. If the summary leaks, you should see it there and not in production. I'll add that as finding seven, mine, with the platform team.
- Ravi SubramanianSeven. Good. Now SSO. I have three questions on that, numbered.
- Theo GallagherGo ahead, I'll answer in the same order.
- Ravi SubramanianOne: does authentication happen at our identity provider, and do we keep multi-factor enforcement there? Two: how are accounts removed when someone leaves us? Three: is there any local account, any break-glass login, that bypasses single sign-on?
- Theo GallagherOne. In the Enterprise tier, sign-on goes through your identity provider and the multi-factor policy stays with you; we don't hold a second set of credentials for your people. Two. SCIM provisioning is part of Enterprise, so a leaver removed in your directory should be deprovisioned in the brain. I say should, because I haven't got the timing from a log in front of me, and I don't want to promise a figure I can't show. Three. That is the one I'm least sure of, so I'll check whether any local or support login exists and report back.
- Ravi SubramanianThen three is an open finding, with a date.
- Theo GallagherHere is the dated commitment: I'll have written answers on one to three, with evidence for the SCIM behaviour, before the end of next week.
- Ravi SubramanianThank you. Now, your incident history. What's your incident history?
- Theo GallagherI don't want to summarise that from memory, because I'd either undersell it or make it sound tidier than it is. I'll send the incident register for the period you asked about, with what happened, what was affected and what changed afterwards. If there are any that touched customer data you'll see them marked.
- Ravi SubramanianPlease include anything that touched availability, even if no data was exposed. And I should say now, so that it is on the record: I am not interested in a reference customer in place of a control. Another company being comfortable is not a reason for us to be.
- Theo GallagherUnderstood, and I wouldn't offer one in place of a control. If a reference ever helps, it's on top.
- Carlos MedinaCan I ask something slightly practical while you're both looking at notes? On the connectors. If we hook up the CRM and the helpdesk, does each connector get its own credential, and who holds it?
- Theo GallagherYes, each connector has its own credential and I'd want the principle to be least privilege: read-only where the source allows it. The credentials sit in your account, in your secrets handling, not with us. I'll list them against each connector in the pack, with the scope each one requests.
- Ravi SubramanianPlease include which of those scopes are write scopes, if any.
- Theo GallagherWill do. If there's a write scope anywhere I'll flag it and say why it's needed, or whether it can be removed.
- Carlos MedinaAnd the nightly refresh, that's all inside the same boundary?
- Theo GallagherYes. It's a job that runs in your account, and the commitment on our side is that it's complete by seven in the morning your local time on business days. That's a service level, not a security control, but it's useful to know the job is yours to see.
- Ravi SubramanianLet's talk about logs. If I wanted to know, six months from now, who asked what, where do I look?
- Theo GallagherQuery history in your Snowflake is the base record, and it's yours. What I need to confirm is what the brain adds on top: whether the question text and the person are logged together, how long we keep it, and whether you can export it. I'll write that down as finding eight rather than guess.
- Ravi SubramanianEight. And retention. If we end the contract, what happens to what you hold?
- Theo GallagherThat's the exit plan, which I care about quite a lot. Because the data and the layers are in your account, the starting position is that they stay with you. What we'd remove is our access and anything of ours that's outside. I'll set it out as steps, with who does each one, so it's a plan and not a promise.
- Ravi SubramanianGood. I'd like the steps to include confirmation that credentials are revoked, in writing.
- Theo GallagherYes. Added.
- Carlos MedinaWhile you're writing, Theo, can I check how long this review is likely to take? I have a decision date in mind, Friday 4 December 2026, and I'd like the security part not to be the thing that moves it.
- Theo GallagherI'd say we can get through it well before then, provided the findings get closed in the order we've set out. I don't want to promise that every one closes, because that's down to the evidence, and Ravi will decide that. But the pack I'm sending is meant to close most of them in one go.
- Ravi SubramanianI will decide it on evidence, and not on the date. I say that without any unkindness, Carlos.
- Carlos MedinaNo, understood, that's what I'd expect. I'm just saying it out loud so we all know the calendar.
- Ravi SubramanianAnd on price, so there's no confusion: I don't discuss it, and it plays no part in my view.
- Carlos MedinaRight, that's with me and Jordan. For everyone's information the all-in figure with implementation is one hundred and fifty-five thousand, and that's all I'll say about it here.
- Theo GallagherThanks, Carlos. I'll leave that with Jordan too.
- Theo GallagherRavi, one thing from my side, if I may. The questionnaire you sent has a section on subcontractors. Rather than answer in the abstract, can I ask what you'd need to see? I'd rather match your question than guess.
- Ravi SubramanianThe names of anyone who processes our data, what they process, where, and under what terms. Not categories. Names.
- Theo GallagherGood, that's clear. If our list is short that's a short answer, and if it isn't I'll show you the whole thing. I'll put it in the pack as a table.
- Ravi SubramanianFine. Then penetration testing. When was your last independent test, who did it, and can I see the findings summary and the remediation?
- Theo GallagherI'll bring you the report summary and the remediation status as they stand, with dates. I can't state the date from memory and I won't try. What I can say is that I'd want you to see open items as well as closed ones.
- Ravi SubramanianYes. Open items matter more to me than closed ones.
- Carlos MedinaOkay, I've been scribbling. Can I play back what I think we've agreed, because otherwise I'll be chasing myself next week?
- Theo GallagherPlease, that would help.
- Carlos MedinaSo: Theo sends an architecture diagram with the boundary marked, a statement on what's outside the US region if anything, the support access policy and log format, the SCIM evidence, the incident register, the subcontractor table, the connector scopes, and the exit steps. And separately he's checking with the platform team on where the model runs, on telemetry content, on any local login and on what the brain logs. Did I miss any?
- Theo GallagherYou've got the lot, and you've been more orderly than my own notes. The only addition is the two-role test, the one that includes the summary question. That's a live session, not a document.
- Ravi SubramanianI will want that session to be recorded, and I'd like the query history exported afterwards and attached to the finding.
- Theo GallagherYes, I'll set it up that way. Carlos, it'll need two test users in your identity provider, one that holds the credit role and one that doesn't. Is that something you can arrange?
- Carlos MedinaYes. I'd rather not use real people, so I'll make two service-style accounts and tell Ravi's team when they exist.
- Ravi SubramanianPlease do. And tell me who has the credentials for them.
- Carlos MedinaUnderstood. Me, and one admin, and that's all.
- Ravi SubramanianA closing point from me. This session has been useful because you said 'I don't know yet' on several things. I would rather hear that than assurance. I will be less patient if the written answers come back vague.
- Theo GallagherThat's fair, and thank you. They'll come back dated, with a control reference against each. If any of them can't be evidenced, the document will say so.
- Ravi SubramanianThen I'll send my next numbered questions after I've read the pack, not before. Carlos, copy me on the scheduling.
- Carlos MedinaWill do. Theo, can you send over some times for the second session once the pack is with us? Something that's not this late for you.
- Theo GallagherI'd be glad to, though honestly I'm happy to do these in the evening if it suits you better. I'll offer a couple of options. Thanks, both.
- Carlos MedinaBrilliant. Thanks Theo, thanks Ravi. Speak soon.
- Ravi SubramanianThank you. Goodbye.
- Theo GallagherCheers both, speak soon.
Callsmade from