Security review session: time and agenda

Hi Megan, Jordan asked me to pick up the scheduling for the follow-up security session, so I'm writing directly. Before I propose a time, can I ask what you most need to know? The short answer on our design is that the brain is built and run inside the customer's own Snowflake account, so BG-Demo does not hold your data in a separate store. The longer answer depends on which of your open findings you want covered first, and I'd rather spend the session on those than on a general tour. To be precise about what I can commit to: I'll answer what I can confirm from our documentation and architecture, and where I'm not certain I'll check with a colleague and put the answer in writing afterwards. I won't give you an answer I can't stand behind. Could you tell me: - which findings you want to take first - whether you'd like the incident history covered in the same session or separately I can offer Thursday or Friday this week, at any time that suits you. Thanks, Hannah

Hannah, Thank you. Friday is preferable. Please propose 15:00 Eastern and I will hold it. To answer your two questions: 1. Findings, in order: access control and administrative privileges; the connector credentials and where they are stored; then logging and retention. 2. Incident history: please cover it in the same session, so that it is on the record alongside the control descriptions. For the record, I would like the written confirmations within a few business days of the session, since our risk posture requires documented evidence for each item. I will review the answers against the questionnaire you already returned. Megan Alvarez, CISO