B-Brain
Hannah Lowe

Corstorphine Building Society / BB-Demo – Security Review

Callcompleted

Corstorphine Building Society logo Corstorphine Building Society · 2026-08-20 14:15

Second security review with procurement joining. Euan Rattray had closed everything except the July outage actions and standing access for BB-Demo engineers. Evidence for both is owed, and Tom Ashdown owes written contract answers.

made from

What was said

What this says

Current to 13 Oct 26

Second security review with procurement joining. Euan Rattray had closed everything except the July outage actions and standing access for BB-Demo engineers. Evidence for both is owed, and Tom Ashdown owes written contract answers.

What happened: On 20 Aug 2026 Euan reported two findings open from the first session: whether the July outage actions are complete, and standing access. Everything else he had closed with evidence recorded.

Customer view: Hannah Lowe conceded that three outage actions were only marked complete, not verified. Euan said he does not close on assurance and wants proof that the access control operates.

Commercial: Catriona Muir wants the access model and exit plan confirmed as contract terms, in writing, before committee papers are drawn up. Tom is aiming at 30 Sep 2026 for the order form.

Watch: Tom quoted the proposal as one hundred and fifty-five thousand, implementation included, from memory, to be confirmed in writing. The call does not show whether the order form was signed.

AI · claude-sonnet-5-5 · 13 Oct 2026

AImade from

Themes

Current to 9 Oct 26
Theme
Outage and access evidence
Importance
neutral
Sentiment
mixed
Voice
decision-maker
AImade from

Who was there

BB-Demo

CRMmade from

Them

CRMmade from

Follow-up

Next steps

Current to 9 Oct 26
  • Hannah to supply the record, verifier and date for the alerting change, runbook update and refresh check next week, with the incident log attached.
  • Tom to confirm in writing early next week the contract mechanism and the commercial position.
  • Tom to send three options for the third session for the week after next.
AImade from

Risks

Current to 9 Oct 26
  • Three outage actions lack verification evidence, and Euan will not close the finding without it.
  • The standing access control is not yet evidenced, and the emergency wording is unconfirmed internally.
  • The contract mechanism for the access model is unconfirmed, and committee dates squeeze before 30 Sep 2026.
AImade from

Opportunities

Current to 9 Oct 26
  • Euan has closed every other finding, so two pieces of legible evidence could clear the security gate.
  • Attaching the access model and exit plan as schedules gives procurement a contractual answer to its concern.
AImade from

Transcript

  1. Tom Ashdown
    Tom Ashdown None
    Afternoon all. Can you hear me alright? I've got a bit of an echo on my side.
  2. Catriona Muir
    Catriona Muir None
    Afternoon, Tom. Yes, you're fine, nice and clear.
  3. Euan Rattray
    Euan Rattray None
    Afternoon. I'm here. Camera's off for a minute, the room I'm in is booked back to back and I'd rather not be thrown out.
  4. Hannah Lowe
    Hannah Lowe None
    Afternoon, both. Hannah here. Give me a second, I'm just getting the shared folder open so we can look at things together.
  5. Tom Ashdown
    Tom Ashdown None
    No drama, take your time. How's your week been, Catriona? Is it as mad as mine?
  6. Catriona Muir
    Catriona Muir None
    Busy. I've got a couple of other supplier files that all want finishing at once, and a board pack that's looking at me. But it's fine. It's a good kind of busy, mostly.
  7. Tom Ashdown
    Tom Ashdown None
    Right, that sounds familiar. It's been grey and miserable down here all week, so I'm not sorry to be indoors.
  8. Euan Rattray
    Euan Rattray None
    It's much the same in Edinburgh. Shall we make a start? I know we've only got the hour, near enough.
  9. Catriona Muir
    Catriona Muir None
    Yes, if I can go first, just briefly, for the file. I've got three things outstanding from your side. The post-incident report for the outage in July, the extract from your access policy, and the exit plan. Is that your understanding too, Hannah?
  10. Hannah Lowe
    Hannah Lowe None
    To be precise, yes, that matches my list. The exit plan is drafted but I'm not happy sending it until the access question is settled, because one section refers to it. The other two we can talk through now and I'll put them in writing afterwards.
  11. Catriona Muir
    Catriona Muir None
    Fine. Is the exit plan going to be in the contract, or is it a side document? I'll need to know, because the file treats those differently.
  12. Tom Ashdown
    Tom Ashdown None
    Leave that one with me, Catriona. My understanding is it can sit as a schedule to the order form, but I don't want to promise that from memory. I'll check with our contracts side and confirm it in an email.
  13. Catriona Muir
    Catriona Muir None
    Thank you. In writing, please. I'll need that for the file.
  14. Euan Rattray
    Euan Rattray None
    Right. From my side, two findings are open from the first session. I'll go through them so we're all looking at the same thing. The first is the outage in July and whether the actions that came out of the review are actually complete. The second is standing access for your engineers. Everything else I had on the list I've closed, and I've recorded the evidence for each.
  15. Hannah Lowe
    Hannah Lowe None
    That's how I have it as well. Two open, everything else closed. Shall we take the outage first? I think it's the easier one to evidence, and it gives us context for the access conversation.
  16. Euan Rattray
    Euan Rattray None
    Please do. And just so we're clear on how I'm going to work: I'm not looking for a narrative. I'm looking for evidence that each action was done, by whom, and when.
  17. Hannah Lowe
    Hannah Lowe None
    Understood. So the short answer is that the actions are done. The longer answer is that I want to show you that rather than say it. I've got the post-incident report open. It has the timeline, the cause as we understood it, and then an action table with an owner against each line and a status.
  18. Euan Rattray
    Euan Rattray None
    Can you share that? I'd rather read it than hear it summarised.
  19. Hannah Lowe
    Hannah Lowe None
    Sharing now. Can you see it?
  20. Euan Rattray
    Euan Rattray None
    Not yet. There. Yes, I can see it. It's a bit small. Can you make it bigger?
  21. Hannah Lowe
    Hannah Lowe None
    Is that better?
  22. Euan Rattray
    Euan Rattray None
    That's fine. Give me a moment to read the top.
  23. Euan Rattray
    Euan Rattray None
    Right. A few questions. First, the report says the nightly refresh was affected. What's the incident history? Has there been anything like this before in the account you run for others, or is July the first of its kind?
  24. Hannah Lowe
    Hannah Lowe None
    I can answer for what's in the report, and I don't want to go beyond it. The report treats July as a single incident with one root cause. I'm not going to characterise other customers' environments on a call. What I can do is give you the incident log as it applies to the service you'd be using, in writing.
  25. Euan Rattray
    Euan Rattray None
    That's a reasonable boundary. Please do put it in the log and please evidence it. A reference to a log is not the log.
  26. Hannah Lowe
    Hannah Lowe None
    Agreed. I'll attach it, not point at it.
  27. Catriona Muir
    Catriona Muir None
    Sorry to jump in. Euan, is that something that goes in the supplier file as well as your findings log? I want to be sure it's in both places.
  28. Euan Rattray
    Euan Rattray None
    Both, yes. I'll forward it to you once I've signed it off. Not before.
  29. Catriona Muir
    Catriona Muir None
    Good. Thanks.
  30. Euan Rattray
    Euan Rattray None
    Second question on the report. The action table. Some lines say complete and some say complete and verified. What's the difference?
  31. Hannah Lowe
    Hannah Lowe None
    Good catch, and it's a fair thing to ask. Complete means the change was made. Verified means someone other than the person who made it has checked it worked. Let me scroll down. Three of the lines are only marked complete, and honestly, I'd not want you to close a finding on those.
  32. Euan Rattray
    Euan Rattray None
    Thank you. That's the answer I was hoping for, rather than the one I was bracing for. Which three?
  33. Hannah Lowe
    Hannah Lowe None
    The alerting change, the runbook update, and the check on the refresh job before it reports success. Those are the ones where the verification is missing from the table. I think it was done, to be precise, but the table doesn't show it, so I'd rather get the evidence than argue.
  34. Euan Rattray
    Euan Rattray None
    Then that's what I'll ask for. For each of the three, the ticket or change record, the name of the verifier, and the date. Screenshots are acceptable if they're legible and carry timestamps.
  35. Hannah Lowe
    Hannah Lowe None
    Understood. I'll collect them from the team that made the changes, and I'll check each one myself before it goes to you, so you're not getting a pile of attachments I haven't read.
  36. Tom Ashdown
    Tom Ashdown None
    If it helps, I can chase internally on timing. I don't want this sitting on Hannah's desk while she's got her day job as well.
  37. Hannah Lowe
    Hannah Lowe None
    That's kind, Tom, but I'd rather own it. It'll be quicker. I'll say next week for the evidence pack, and if that moves I'll tell you before the day, not after.
  38. Catriona Muir
    Catriona Muir None
    Can I hold you to next week? I don't like deadlines that slide quietly. I'll note it.
  39. Hannah Lowe
    Hannah Lowe None
    Please do. Note it.
  40. Euan Rattray
    Euan Rattray None
    Last thing on the outage. The customers affected. How were they told, and how quickly after you knew?
  41. Hannah Lowe
    Hannah Lowe None
    The report has a communications section, which I'd point you to. It lists when the status notice went out and to whom. I'd prefer you read the times there than hear me paraphrase them, because I'd be reciting from memory and I'm not going to do that on a security call.
  42. Euan Rattray
    Euan Rattray None
    Fine. I'll read it. Then I may come back with questions in writing.
  43. Hannah Lowe
    Hannah Lowe None
    Of course.
  44. Euan Rattray
    Euan Rattray None
    Right, I've read that section. It's adequate. It isn't brilliant, and I'll say why in the findings note, but it's adequate. Let's move on to access. Who has standing access?
  45. Hannah Lowe
    Hannah Lowe None
    So, this is the one I want to be careful with. The architecture is that the brain runs inside your Snowflake account, not ours. That matters, because it means the society's own administrators control the roles. Our engineers don't have an account of their own sitting in there with a password.
  46. Euan Rattray
    Euan Rattray None
    That's the architecture. I'm asking about practice. Is there any engineer at BB-Demo who can, today, log in to the society's environment without anyone at the society approving it first?
  47. Hannah Lowe
    Hannah Lowe None
    The way it's designed, no. Access is granted by the customer, for a defined purpose, for a defined period, and it expires. That's the design. What I can't do on this call is tell you that no exception has ever been made in the history of the service, and I'm not going to say it.
  48. Euan Rattray
    Euan Rattray None
    I appreciate the candour. But the finding is about exactly that. A design is not a control. Please evidence that the control operates.
  49. Hannah Lowe
    Hannah Lowe None
    Agreed. So here's what I'd propose. One, a written statement of the access model, signed off by someone accountable on our side, not by me. Two, the access log for the support role over the period you choose, so you can see grants and expiries. Three, a clear statement of what we do in an emergency, because that's where exceptions tend to live.
  50. Euan Rattray
    Euan Rattray None
    The emergency route is the interesting part. What happens at, say, a weekend, if the nightly job fails and the customer's administrators aren't reachable?
  51. Hannah Lowe
    Hannah Lowe None
    The short answer is that we wait, or we escalate to a named contact you give us. The longer answer is that I think that's the right answer for a regulated customer, and I'd want it written into the access statement as a commitment rather than a habit. I need to confirm the exact wording with a colleague who owns our security policy before I put it down. I won't improvise it.
  52. Euan Rattray
    Euan Rattray None
    Good. Don't improvise it. Who is accountable at your end? I want a name or a role on the statement.
  53. Hannah Lowe
    Hannah Lowe None
    It'll be the person who owns our security policy. I'll give you the role and the name in the document. I'd rather not name someone for them on a call.
  54. Euan Rattray
    Euan Rattray None
    Fair enough.
  55. Catriona Muir
    Catriona Muir None
    Can I come in on that? Is the access model going to be in the contract, or only in a security schedule? Because if it's only a document you can update, that's a problem for us.
  56. Tom Ashdown
    Tom Ashdown None
    That's a fair challenge. I think the honest answer is it depends how we attach it. I'd want it as a schedule so a change needs both sides to agree. But again, I'm not going to say yes from memory. Can I come back to you in writing on the mechanism?
  57. Catriona Muir
    Catriona Muir None
    Yes. And I'd like the answer before the committee papers are drawn up, not after.
  58. Tom Ashdown
    Tom Ashdown None
    Understood. We're aiming at 30 Sep 2026 for the order form, as we discussed, so I'll keep that in front of me. I'll get you the answer early next week.
  59. Catriona Muir
    Catriona Muir None
    Thank you. And to be clear, Tom, I'm not negotiating anything on this call. Any commercial position needs to come to me in writing.
  60. Tom Ashdown
    Tom Ashdown None
    No, absolutely. The proposal stands as the one hundred and fifty-five thousand, implementation included, but I'll confirm that from the document and not from my head. It'll be in the email.
  61. Euan Rattray
    Euan Rattray None
    I'll leave the commercial side to you both. It isn't mine to discuss.
  62. Catriona Muir
    Catriona Muir None
    Quite right, Euan.
  63. Euan Rattray
    Euan Rattray None
    Back to access, Hannah. Does the society's own team see the log, or only BB-Demo?
  64. Hannah Lowe
    Hannah Lowe None
    It's in your account, so your administrators can see it natively. That's one of the reasons I like the architecture. You don't need us to tell you who had access, you can look. What I'd add is a periodic summary from our side so you aren't relying on someone remembering to check.
  65. Euan Rattray
    Euan Rattray None
    A summary from you is useful, but it doesn't replace my team looking. I'd want that in our own review routine. Who has standing access to the log itself, on the society's side?
  66. Hannah Lowe
    Hannah Lowe None
    That's your decision, and I'd recommend keeping it narrow. I can describe how other regulated customers tend to split the roles, but I think it's better you decide against your own policy and tell us.
  67. Euan Rattray
    Euan Rattray None
    Yes. I'd prefer to define it. I'll put a line in the findings note.
  68. Tom Ashdown
    Tom Ashdown None
    Sorry, can I ask a daft question? If we get you the evidence on both, is that enough to close, or is there another round after?
  69. Euan Rattray
    Euan Rattray None
    It's not a daft question. If the evidence is complete and legible, I close both. If it isn't, I say so, and I say what's missing. I don't close on assurance. That's the whole point of the exercise.
  70. Tom Ashdown
    Tom Ashdown None
    Good, that's clear. That's all I needed.
  71. Euan Rattray
    Euan Rattray None
    One more on the outage, before we lose the thread. The action on the refresh job. It reports success only after a check. What does the check actually look at?
  72. Hannah Lowe
    Hannah Lowe None
    That's one of the three I flagged. As I understand it, it compares what was loaded against what the source reported, and fails loudly if they don't agree. But I'd like to see the change record in front of me before I describe it in detail, because I don't want to overstate what it covers.
  73. Euan Rattray
    Euan Rattray None
    Good. Then the answer is in the evidence pack, not on this call.
  74. Hannah Lowe
    Hannah Lowe None
    Yes. I'll make sure the description in the pack says what it does and what it doesn't.
  75. Catriona Muir
    Catriona Muir None
    Can I just check my list while we're here? Post-incident report, with the three verifications. Access policy extract, plus the access log and the emergency wording. Exit plan. Is there anything I've missed?
  76. Hannah Lowe
    Hannah Lowe None
    I'd add the incident log for the service, which Euan asked for earlier. Otherwise that's the full list.
  77. Catriona Muir
    Catriona Muir None
    Incident log. Yes, got it. Thank you.
  78. Euan Rattray
    Euan Rattray None
    May I ask something slightly wider? When the next outage happens, and there will be one, because there always is, what would I see that I can't see today?
  79. Hannah Lowe
    Hannah Lowe None
    Honestly, the difference would be how fast you'd know and how much you'd be able to check for yourselves. You'd get the notice, and because it's your account you'd have your own view of the job history. After the incident you'd get a report in the same format as this one. And I think the verification column is now the thing I'd hold us to.
  80. Euan Rattray
    Euan Rattray None
    Then I'll hold you to it.
  81. Hannah Lowe
    Hannah Lowe None
    Please do.
  82. Tom Ashdown
    Tom Ashdown None
    Can I suggest we get something in the diary now for the third session, so it doesn't drift? Even if we end up not needing it, I'd sooner cancel a slot than chase one.
  83. Euan Rattray
    Euan Rattray None
    That's sensible. Make it after the evidence has arrived and I've had time to read it. I'd say not this coming week.
  84. Catriona Muir
    Catriona Muir None
    And early enough that it leaves room before the 30 Sep 2026 target. Otherwise my committee dates start to squeeze.
  85. Tom Ashdown
    Tom Ashdown None
    Right. I'll send three options for the week after next and you can pick. No drama if none of them work.
  86. Euan Rattray
    Euan Rattray None
    That's fine.
  87. Hannah Lowe
    Hannah Lowe None
    Before we finish, can I read back what I think I'm taking away, so there's no argument later? Because I've said a lot of things in the last twenty minutes or so and I'd hate to get one wrong.
  88. Euan Rattray
    Euan Rattray None
    Please.
  89. Hannah Lowe
    Hannah Lowe None
    One. For the July outage, verification evidence for the three actions: the alerting change, the runbook update and the refresh check. Each with the record, the verifier and the date. Two. The incident log for the service, attached and not referenced. Three. A written access statement with a named accountable owner, the access log for the period you choose, and the emergency wording, which I'll confirm internally first. Four. The exit plan, once the access statement is final.
  90. Euan Rattray
    Euan Rattray None
    That's accurate. I'd add that the access log should cover the whole period since the environment was first provisioned for the evaluation, not a sample I haven't chosen.
  91. Hannah Lowe
    Hannah Lowe None
    Understood. The whole period, not a sample. I'll note that.
  92. Catriona Muir
    Catriona Muir None
    And from Tom, the mechanism for attaching the access model and the exit plan to the contract, confirmed in writing.
  93. Tom Ashdown
    Tom Ashdown None
    Yes. That and the commercial position confirmed in the same email, early next week. Leave that with me.
  94. Catriona Muir
    Catriona Muir None
    Thank you, Tom.
  95. Euan Rattray
    Euan Rattray None
    Is there anything else either of you wants to raise? I've got nothing further on the findings.
  96. Hannah Lowe
    Hannah Lowe None
    Only that if anything in the pack looks thin when you read it, tell me straight away and don't wait for the next session. I'd rather fix it in a day than find out in a fortnight.
  97. Euan Rattray
    Euan Rattray None
    I will. I tend to write it all down in one go, but I'll try not to sit on it.
  98. Catriona Muir
    Catriona Muir None
    Nothing from me. Thanks, everyone. This was more useful than I expected.
  99. Tom Ashdown
    Tom Ashdown None
    Cheers all. Speak soon.
  100. Hannah Lowe
    Hannah Lowe None
    Thanks, everyone. Goodbye.
Callsmade from

BB-Demo is a fictional company; every organisation and person here is invented. B-Brain is the tool. Built by site/build_site.py from the site tree, data as of Fri 9 Oct 2026. Help & Support

Help & Support

Open as a page

Help & Support

B-Brain is one place to read everything the company knows about its customers: the CRM, calls, emails, support tickets, product usage, invoices, documents, news and HR. Every page is built from those systems and the data is current to Fri 9 Oct 2026.

How to use the site

How to ask

Press Ask Brain in the header. Type a question, or pick one of the examples.

The site itself does not call an AI model; answers in Claude come from the same figures you see here.

What the data covers

DataRecords
Organisations225
People at customers862
BB-Demo staff58
Calls1,995
Email threads3,013
Support tickets1,159
Documents1,218
Deals315
Invoices285
Events49
News items119

Data as of Fri 9 Oct 2026. Text marked AI was written by the brain from the records listed in its made-from link; an AI output that cannot cite its evidence is refused and the previous text kept. Where two systems disagree (for example a contract and the CRM), the key facts show both values and mark the difference.

BB-Demo is a fictional company: every organisation, person and figure here is invented for this demonstration. B-Brain is the tool that reads its data.

Who to contact

Email support@b-brain.example or talk to your B-Brain account team. Tell us the page address and what looked wrong; a screenshot helps.
Help

Ask B

B-Brain · read-only