Security review outcome and conditions

Jordan, I have now been through your written responses and the notes from the review sessions. I am able to clear the security review, subject to the two conditions below. I have no other findings open. First, the two post-incident actions your team described to us are to be completed by the end of December, and that commitment is to be written into the contract itself, not left in correspondence or a side letter. Second, the contract is to require that you give us notice within twenty-four hours of any failed refresh of our data. Please define "failed refresh" in the wording, and say who at your end is responsible for sending the notice. Please evidence both when you send the draft terms. I would also ask that the wording is reviewed by your CTO before it reaches us, so that what is written matches what is actually built. Megan is copied and will now start the procurement process. Megan, these two conditions should be carried into the commercial and contract workstream. I will not be involved in any discussion of price. Ravi Subramanian

Ravi, Megan, Thanks for the clear note, Ravi. Here's where we are. On 22 Sep 2026, at 14:22, Ravi Subramanian wrote: > the two post-incident actions your team described to us are to be completed by the end of December, and that commitment is to be written into the contract itself Understood, and we are fine with that going into the contract. I have copied Tobias, who leads engineering, so that he can confirm the definition of a failed refresh and the notice wording before anything goes to you. To be transparent, I would rather you see language that Tobias has checked than a first draft from me that needs correcting. On the notice, we will write it as notice within twenty-four hours, with a named owner on our side, as you asked. Megan, thanks for picking this up. What would make this a yes from your side is a list of the documents you need and the order you want them in. If you send me that, I will get everything to you in one pack rather than piecemeal. Same set of documents, same timing, whatever you need for the comparison. Tobias, please reply all if you want to add anything on the wording. Thanks, Jordan