Security review: finding a time
Email thread Fenmoor Specialty Underwriting · sales
Hannah Lowe set up a security review working session. Nadia Osei accepted Wednesday morning, listed three written-evidence requests, and said she cannot set a sign-off date until the capacity providers have seen the documentation.
What was said
What this says
As at Fri 9 Oct 2026Hannah Lowe set up a security review working session. Nadia Osei accepted Wednesday morning, listed three written-evidence requests, and said she cannot set a sign-off date until the capacity providers have seen the documentation.
Ask: Nadia wants three points answered in the questionnaire itself, not only discussed. They are where data is held and who at BG-Demo can reach it, data residency for connected systems, and access control for Fenmoor users including leavers.
Customer view: She will not name a sign-off date until the capacity providers have seen the documentation, which she will share after the session.
Next: Hannah is checking the exact access wording with Ewan and will send the architecture diagram with the answers before the 10:00 session.
The thread
Updated 9 Oct 26Messages
Hannah Lowe 21 Nov 2025 11:18Hello Nadia, Following our call, I would like to get the security review into the diary. To be precise about what I have in mind: a working session of about an hour, where we go through the questionnaire together and I answer what I can on the spot. Before then, could you tell me what you most need to see? The short answer on architecture is that the brain is built and run inside Fenmoor's own Snowflake account, so your data does not leave your environment. The longer answer is that I would rather show you the diagram and the access model than describe them, and I will put that in writing so you have it for your audit trail. Would Tuesday or Wednesday next week suit you? Mornings are easiest for me. Thanks, Hannah
Nadia Osei 25 Nov 2025 09:55Dear Hannah, Thank you for this. Wednesday morning would work for me. So that the session is useful, I have a few open items I would like covered, and I will need each of them in the questionnaire rather than only discussed: First: can you evidence where the data is held and who at BG-Demo can reach it, and how that access is granted and removed? Second: what is the position on data residency for the connected systems, in writing? Third: how is access control handled for Fenmoor's own users, including leavers? Please also note that I cannot set a sign-off date until our capacity providers have seen the pack. I will share it with them after the session, so for now this is about completing the evidence. Kind regards, Nadia- Hannah Lowe 26 Nov 2025 10:09Hello Nadia, Wednesday morning is fine, so let us say 10:00 and I will send the invitation today. Thank you for the list. I will take each point in order and answer in the questionnaire, with the architecture diagram attached for the first one. On the access question, I want to check the exact wording with Ewan before I commit it to paper, because I would rather give you a precise answer than a quick one. You will have it before we meet. Understood on the sign-off. I will not suggest a date, and I will make sure the pack is in a state you can pass straight to the capacity providers. Thanks, Hannah