Security review: arranging a session

Hello Nadia, Thank you for your time on the last call. To be precise about where we left it: you asked for evidence on access control, on where the data sits, and on how the connectors authenticate to the systems Fenmoor already runs. I'll put the answers in writing rather than leave them as things I said out loud. The short answer is that the brain runs inside Fenmoor's own Snowflake account, so the data does not leave your environment. The longer answer is that I want to walk you through the architecture diagram and the access model together, so you can test it against your questionnaire as we go. Could we book a working session of about an hour next week? If you can send the questionnaire beforehand, or tell me which sections your capacity providers will look at most closely, I'll prepare the matching evidence so we do not have to come back to it. What would you most like to have in front of you for the session? Thanks, Hannah

Dear Hannah, Thank you, and apologies for the delay in replying. A working session suits me. Wednesday or Thursday next week would be best, in the afternoon. Before then, I have a few points I'll need answered in the questionnaire, for the audit trail: One: can you evidence how access to the brain is restricted to named users, and how that is reviewed? Two: can you evidence the data residency position for the Snowflake account, in a form I can pass to the capacity providers? Three: what is the process for revoking a connector's credentials if one of our systems is retired? I will send the questionnaire over separately. Please note I cannot sign anything off on a verbal answer, and I won't set a sign-off date until the capacity providers have seen the pack. Kind regards, Nadia