Kielderside Growth Agency / BG-Demo – Security Review
Callcompleted
Kielderside Growth Agency · 4 Aug 2026 09:00
Security review on 4 Aug 2026 with Anil Bhatt. Four findings stay open, with evidence to follow from BG-Demo. Two post-incident actions are due by the end of the year. Anil closed nothing on the call.
What was said
What this says
As at Fri 9 Oct 2026Security review on 4 Aug 2026 with Anil Bhatt. Four findings stay open, with evidence to follow from BG-Demo. Two post-incident actions are due by the end of the year. Anil closed nothing on the call.
What happened: Theo Gallagher and Tobias Renwick took Anil through architecture and residency, SSO, access logs and the post-incident actions. Emma Kirkup raised permissions and user trust.
Customer view: Anil said "I will not close any of them on the strength of a verbal answer." He asked for evidence, a UK residency clause in the contract and a tested exit plan.
Commercial: Enterprise SSO and SCIM were explained, and the residency add-on was mentioned. Anil asked for the UK requirement to be passed to Tom Ashdown as a security requirement.
Watch: Both post-incident actions are open, owned by Tobias and due by the end of the year. Emma noted the grants system may be hard to connect, and Snowflake roles need tidying first.
Themes
As at Fri 9 Oct 2026Theme
Security review open findings
Importance
neutral
Sentiment
mixed
Voice
decision-maker
Who was there
BG-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
As at Fri 9 Oct 2026- Theo Gallagher sends the assurance pack and third-party register this week.
- Tobias Renwick sends the interim statement on compensating measures before the panel meets.
- Emma Kirkup finds out what the grants system can export.
Risks
As at Fri 9 Oct 2026- Both post-incident actions are open until the end of the year and the panel may see residual risk.
- The grants system may not be connectable, which could limit the connector scope.
- Evidence must arrive before the panel meets, or the findings stay open.
Opportunities
As at Fri 9 Oct 2026- Enterprise SSO and SCIM answer the leaver-access concern.
- The residency add-on could be written into the order form.
Transcript
Theo GallagherMorning, Anil. Can you hear me all right? I've got you on the recording banner but no sound from your side yet.
Anil BhattGood morning. Yes, I can hear you. I had the wrong headset selected. Is that better?- Theo GallagherMuch better, thanks. Tobias is just joining as well, I can see him in the lobby.
Tobias RenwickMorning all. Apologies, my previous call ran over by a couple of minutes. Am I audible?- Theo GallagherLoud and clear. Emma, are you with us?
Emma KirkupI am, morning everyone. Sorry, I'm in the office and the building wifi is being temperamental, so if I freeze just carry on and I'll catch up on the recording.- Tobias RenwickNot a problem. Has the weather turned up there? It's grey and drizzly here, which is very August.
- Emma KirkupSame. Newcastle's been doing that thing where it's bright for ten minutes and then it pours. We've all given up on the summer.
- Anil BhattIf we could make a start. I have a list of open findings from the tender assessment and I would like to work through them in order, if that suits everyone.
- Theo GallagherThat suits us. I've got the same list on my side, so let me read it back and you tell me if I've got it wrong. As I have it, there are four open findings. The architecture and data residency question, which is Tobias's. Single sign-on and how access is provisioned, which is mine with Tobias behind me. The access logs and who can see them, which is Tobias's. And the two actions coming out of the post-incident review, which are also Tobias's, with a dated commitment for the end of the year. Is that your understanding, Anil?
- Anil BhattThat is my understanding, yes. Findings one to four. I would add that I will not close any of them on the strength of a verbal answer. For each one I need evidence I can attach to the assessment file. Please evidence that wherever you can.
- Theo GallagherUnderstood, and that's how we'd rather do it. Where we can evidence something we will, and where we can't yet, I'll say so plainly and we'll put a date against it rather than describe it nicely.
- Tobias RenwickBefore I go into the architecture, can I ask what your security team will actually need to see? Because I can talk for twenty minutes about the design, but the honest answer is that it's more useful if I aim at the questions your assessors have to score.
- Anil BhattThree things. Where the data lives. Who has standing access to it, including your staff. And what is logged, for how long, and who can read the logs. Those are the questions the tender panel will ask me, and I need to be able to answer them without caveats.
- Tobias RenwickGood, that maps neatly onto what I was going to say. So, to be precise about the architecture: B-Viz is built and run inside the customer's own Snowflake account. Kielderside would have its own Snowflake account, and the data model, the indexes and the question history sit in there. They are not copied out to a BG-Demo environment that we then manage on your behalf.
- Anil BhattSo there is no BG-Demo-hosted copy of our data at all.
- Tobias RenwickThat is the design. The trade-off is that you carry the warehouse and we carry the application layer. The advantage for you is that your existing controls, your network policies, your roles, your audit trail, continue to apply because it is your account. I'd rather you hold the keys than take our word for it.
- Anil BhattUnderstood. Now, the connectors. The agency uses a CRM, a call recorder, a mailbox and a grants system. When a connector pulls from those, where does the data travel?
- Tobias RenwickFrom the source system into your Snowflake account. Nothing is staged elsewhere. The connector runs with a credential that you issue, scoped to the source, and you can revoke it at any time. I'll be careful here: for the grants system, whether it can be connected depends on what interface it offers, and I wouldn't want to promise that from this call.
- Emma KirkupThat's actually one for me. The grants system is the awkward one. It's an older platform and the export options are limited. I can find out exactly what it offers and send it over.
- Theo GallagherThat would help, Emma. I'll note it as an action on your side, and then we can say honestly what's possible rather than guess. Anil, does that go in the file as a dependency rather than a finding?
- Anil BhattA dependency is acceptable. It does not close the finding, but I will record it separately.
- Anil BhattBack to the first finding. Which certifications do you hold? The tender requires me to confirm independent assurance, and a statement that you follow good practice is not sufficient.
- Theo GallagherLet me answer that carefully, because I don't want to overstate anything. I'm not going to recite certification names from memory on a recorded call and risk getting a scope wrong. What I will do is send you the assurance pack with the certificates, the scope statements and the dates, so you can check them yourself. Anything that isn't in the pack, I'll tell you is not held.
- Anil BhattThat is acceptable provided the pack arrives with the scope statements. A certificate without a scope is of little use to me.
- Theo GallagherAgreed. Control reference against each statement, so you can map it to your questionnaire. I'll send it this week.
- Tobias RenwickMay I add a point on residency, since it's the other half of the first finding? Because it runs in your Snowflake account, the region is the one you chose for that account. If the tender requires the data to stay in the United Kingdom, that is a decision about where your account sits, and we follow it. There is also a dedicated residency add-on for customers who want it specified in the order form.
- Anil BhattOur account is in a UK region. I would want that written into the contract rather than assumed.
- Tobias RenwickFair. That's a contract matter for Tom Ashdown, and I'd not want to draft the wording myself. But from the technical side, I can confirm the design supports it.
- Anil BhattI do not discuss commercial terms. I raise it only so that the security requirement is carried through to whoever does.
- Theo GallagherUnderstood, and I'll pass it to Tom as a security requirement, not a commercial one. Shall we move to single sign-on?
- Anil BhattPlease. Finding two. We use our identity provider for everything, and joiners and leavers are handled centrally. I need to know that a leaver cannot retain access to B-Viz.
- Theo GallagherRight. So on the Enterprise tier, single sign-on and SCIM are included. SSO means people authenticate through your identity provider, so B-Viz doesn't hold its own passwords for them. SCIM means that when someone is created, changed or disabled in your directory, that change is pushed through to B-Viz. A leaver is disabled at source and the account is disabled with them.
- Anil BhattHow quickly does a disablement take effect? And what about sessions that are already open?
- Theo GallagherThat's a fair question and I want to answer it with evidence rather than from memory. The provisioning change depends on how your identity provider sends it. For open sessions, I'd like Tobias to confirm the session behaviour before I say anything I'd have to retract.
- Tobias RenwickThank you, Theo. The honest answer is that session lifetime is configurable and the default is deliberately short, but I'd rather give you the exact setting in writing alongside a test result than quote it. We can run a disable-and-retry test in a sandbox with your identity provider's test tenant and give you the timestamps.
- Anil BhattA test with timestamps would close that finding. Please include the identity provider configuration, with secrets removed.
- Theo GallagherNoted. I'll take that one. We'd need your team to give us a test tenant, or you run the test while we watch. Emma, which would be easier on your side?
- Emma KirkupProbably us running it, honestly. Our IT team are protective of the tenant. If you send me the steps I can get someone to do it and screenshot the results.
- Theo GallagherThat works. I'll write the steps as a numbered list so whoever runs it can tick them off and nothing's missed.
- Anil BhattWho has standing access on your side? To the application, I mean, and to anything that touches our account.
- Tobias RenwickLet me separate two things. Inside your Snowflake account, BG-Demo staff have no standing access. If we need to look at something to help you, you grant access, for a purpose, and you revoke it afterwards. Anything we do is then visible in your own account history, which you control.
- Anil BhattAnd is that a documented process, or an understanding?
- Tobias RenwickIt is a documented support procedure. I'll include it in the pack. I would add that I'm describing the standard design, and if there is anything in the order form that departs from it, the order form wins.
- Anil BhattGood. I will want to see the procedure itself, not a summary of it.
- Theo GallagherThe procedure itself, yes. That goes on my list.
- Emma KirkupSorry, can I ask something from the user side? When the account managers ask a question in B-Viz, does it only show them records they're already allowed to see? Because the grants team and the enquiries line see different things in our CRM.
- Tobias RenwickIt's an important question, Emma, and it's one where precision matters. B-Viz respects the permissions set in your warehouse roles. So the design intent is that a person only gets answers drawn from data their role can read. That means the quality of the answer on this point depends on how the roles are set up in Snowflake, and we'd work through that with you in implementation.
- Emma KirkupRight. So we'd need to get our roles tidy first. They're a bit organic at the moment.
- Tobias RenwickMost people's are. It's not a criticism, it's a step in the plan. I'd rather you found that out now.
- Anil BhattI will record that as a prerequisite for the security approach. Emma, I would like your team to review the roles regardless of this tender.
- Emma KirkupYes, it's on the list. Mm. I'll bring it forward.
- Theo GallagherShall we do finding three, the access logs? Anil, tell me where you'd like to start.
- Anil BhattThree questions, numbered. One: what is logged when a person asks a question? Two: how long is it retained? Three: who can read the logs, and can they be altered?
- Tobias RenwickI'll take them in that order. One: every question asked, the identity of the person who asked it, and the sources the answer was drawn from are recorded. Two: because these records live in your account, retention is set by you, not by us. We can recommend a period but the decision sits with your records policy. Three: access to them is governed by your roles, and as the account owner you control who can read or change them.
- Anil BhattCan BG-Demo staff alter them?
- Tobias RenwickNot without access you have granted, and any such action would itself appear in your account history. I want to be careful not to claim immutability that the platform doesn't provide. If you need tamper-evidence beyond that, the route is to export the logs to a store with write-once controls that you own, and we can design for that.
- Anil BhattThat is a clear answer. I would still like a sample. A redacted extract of the log format, so I can show the panel what is recorded.
- Theo GallagherWe can evidence that. I'll generate an extract from a demonstration environment, with nothing real in it, and mark it clearly as a sample so nobody mistakes it for your data.
- Anil BhattThank you. Please state the environment it came from.
- Theo GallagherWill do. Environment, date generated, and the control reference it supports.
- Emma KirkupJust on the logs, would the enquiries line staff be able to see other people's questions? That would worry me.
- Tobias RenwickNot by default. Question history is visible to the person who asked and to administrators you designate. If you wanted a wider audit view, that would be a deliberate choice. And I'd say you'd probably want one or two named administrators rather than many.
- Emma KirkupThat's me and probably one person from IT. Okay.
- Anil BhattThen to finding four. The post-incident actions. I have the incident summary you shared previously and I would like to be clear about what has been done and what has not.
- Theo GallagherYes. Let me set it out, and Tobias, stop me if I stray into your territory. There were two actions arising from the review. Neither is closed. Both have an owner, who is Tobias, and both have a dated commitment, which is the end of the year. I'd rather say that plainly than suggest they're complete.
- Anil BhattNeither is closed. Thank you for saying so directly.
- Tobias RenwickI'll add something on the process, because I think it's what you're really assessing. We ran the review blamelessly. The point of it was to find out what in the system allowed the problem, not who to point at. The actions came from that. I won't describe them as done, because they're not, and I won't promise anything earlier than the commitment we've made.
- Anil BhattI understand. My difficulty is that the tender panel will want to know whether outstanding actions create a risk during the contract period.
- Tobias RenwickA reasonable concern. The trade-off is this. Until the actions are complete, there are compensating measures in place, and I can set those out in writing against each action, with what they do and what they don't cover. What I can't do is tell you the residual risk is zero. If I did, you'd be right not to believe me.
- Anil BhattA written statement of the compensating measures, per action, and the date for each, would be acceptable. I will need it before the panel meets.
- Theo GallagherThen here is the dated commitment as I'd write it down. Two actions, owner Tobias, both due by the end of the year. Interim position in writing from us before your panel meets. And we'll send evidence of completion as each one is done, rather than waiting until both are finished. Does that match your expectation?
- Anil BhattIt does. I would add that if either action slips, I expect to be told before the date and not after it.
- Tobias RenwickAgreed. You'd hear it from me directly.
- Emma KirkupCan I ask a slightly daft question? When you say incident, was any of our sort of data involved? I realise we're not a customer yet, but I'd want to explain it properly if someone on our board asks.
- Tobias RenwickNot a daft question at all. We aren't holding any Kielderside data, as you're not a customer, so there's nothing of yours involved. For existing customers the review summary says what was affected, and I'd point your board to that document rather than paraphrase it. I'll make sure it's in the pack.
- Emma KirkupPerfect, thanks. That's the answer I needed.
- Anil BhattI have a further question on subprocessors. Which third parties handle any of the data, and in which countries?
- Theo GallagherGood one. Since the data stays in your Snowflake account, the main party is the warehouse provider, which you contract with directly. Beyond that, I want to give you the register rather than a list from memory, because it may include services around support and communication that don't touch your data but that you'd want to see. I'll attach the register with locations.
- Anil BhattPlease do. And please state whether any of those parties can see content as opposed to metadata.
- Theo GallagherContent versus metadata, per party. Noted. If the register doesn't say that clearly, I'll add a column.
- Tobias RenwickOne thing worth saying, since we are on the subject. The model that answers questions runs against data in your account, and the trade-off for keeping everything inside your boundary is that we choose the components carefully. I'd rather you ask about the model arrangements in writing so I can answer in writing, with the exact configuration, than give you a loose description now.
- Anil BhattI will send a written question. Does the model retain or learn from our data?
- Tobias RenwickPut it in the written question and I'll answer it with the configuration attached. I won't answer a data retention question off the cuff on a call. I would only say that the design principle is that your data stays under your controls.
- Anil BhattThat is acceptable. Please evidence that principle when you reply, rather than restating it.
- Tobias RenwickUnderstood. Evidence, not assertion.
- Theo GallagherCan I check one more thing we haven't touched? Anil, the exit position. If Kielderside ended the contract, what do you need to see about getting your data and the indexes out and the access removed?
- Anil BhattA documented exit plan. Public bodies need to demonstrate they can leave a supplier. I need to know what happens to the data, to the credentials and to the connectors on the last day.
- Theo GallagherBecause everything sits in your account, exit is simpler than for a hosted service. On the last day, the connector credentials are revoked, our access is removed, and the objects we created in your account are either retained by you or dropped, as you decide. I'll write it as a numbered plan with who does each step, and we can say which steps take a person on your side.
- Anil BhattGood. I would like the exit plan to be tested, at least on paper, before signature.
- Theo GallagherA walkthrough is reasonable. I'll offer it as a short session with you and Emma once the document's with you.
- Emma KirkupFine by me. Early in the day works best.
- Anil BhattNow let me revisit the architecture. You described the application layer running in our account. Who patches it? Who is responsible if a vulnerability is found?
- Tobias RenwickWe are. The application components that BG-Demo ships are our responsibility to patch and to release. The warehouse and its configuration are yours. For a vulnerability in our components, we notify you, tell you what is affected and what the fix is, and the update is applied through the deployment process that you've approved.
- Anil BhattWhat are your commitments on notification? A timeframe.
- Tobias RenwickThe support levels in the Enterprise tier set response times for serious issues, and the order form can state them. For vulnerability notification specifically, I'd want to confirm the wording with Theo before giving you a number, and I'd rather not say one now that you then hold us to if it isn't what we've written down.
- Theo GallagherAgreed. I'll check what we have in writing and bring you exactly that, with the control reference. If it's thinner than you need, I'll say so.
- Anil BhattThank you. That is the sort of answer I can use.
- Emma KirkupWhile we're on updates, would our people notice if something was deployed? Like, would it interrupt them at nine in the morning?
- Tobias RenwickThe nightly refresh completes before the working day, and releases are scheduled so they don't land in the middle of it. If you needed a change window agreed, that's something we'd put into the onboarding plan.
- Emma KirkupGood. That's what I wanted to hear, ta.
- Anil BhattA further point on the tender. The panel scores supplier resilience. If your own staff were unavailable, who could support us?
- Theo GallagherOn the Enterprise tier there's an executive sponsor, and the support arrangements are named in the order form. I won't claim a team size I can't evidence. For the tender response, I'd give you the support model document, which sets out roles and escalation, and you can see the structure for yourselves.
- Anil BhattPlease include it. I would also like to know who, on your side, owns security decisions.
- Tobias RenwickArchitecture and security decisions sit with me. Theo runs the questionnaires and the evidence with me behind him. If Theo needs an answer from the platform team, he asks, and I'd expect him to, rather than guessing.
- Theo GallagherWhich I do. I won't answer for the platform team without checking with Ewan first, so you may see a day's delay on some of these, and that's deliberate.
- Anil BhattA day's delay for a correct answer is preferable to a prompt answer that has to be withdrawn.
- Emma KirkupHear hear. We've had suppliers answer instantly and then spend a month retracting.
- Anil BhattI would like to summarise where I think we are, so that the record is accurate. Finding one, architecture and residency: design explained, evidence pending, namely the assurance pack with scope statements and the register of third parties. Finding two, single sign-on: explained, with a test to be run by Emma's colleague and a configuration extract to follow. Is that correct?
- Theo GallagherYes. And the session behaviour, in writing, with the exact setting. I'll add it to finding two so it doesn't get lost.
- Anil BhattAdded. Finding three, access logs: explained, with a redacted sample extract to follow, and your statement on tamper-evidence. Finding four, the post-incident actions: both open, owner Tobias, both due by the end of the year, with an interim statement of compensating measures before the panel meets.
- Tobias RenwickThat's accurate. One refinement: I'll say in the interim statement what each compensating measure does not cover, as well as what it does. It's more useful to you that way.
- Anil BhattI agree. Please do.
- Anil BhattBeyond the four findings, I have the additional items we discussed: the exit plan, the support procedure for access, the model question in writing, and the notification commitments. I will record all four as new open items, owned by your side.
- Theo GallagherThat's fine. I'd like the list to be complete rather than flattering, so thank you for adding them. Let me read out what I'm taking, with owners. I send the assurance pack and the third-party register this week. I send the single sign-on test steps to Emma. I send the log sample, the support procedure, the exit plan and the support model document. Tobias sends the interim statement on the two actions, and answers your written model question once you've sent it. Emma finds out what the grants system can export.
- Emma KirkupYes. I'll chase the supplier of the grants system today, while it's in my head.
- Anil BhattAnd I send the written question on the model, and the tender timetable so that you know when the panel meets.
- Tobias RenwickThank you, that helps us plan the interim statement. I'd rather deliver it a few days early than on the day.
- Anil BhattEarly would be welcome. I should say that nothing today closes a finding. I will review the evidence when it arrives.
- Theo GallagherUnderstood, and that's the right way round. For what it's worth, I think the session was useful because the gaps are now written down with names against them.
- Anil BhattI agree that it was a productive session. Tobias, one last matter. Will you attend the follow-up, when the evidence has been reviewed?
- Tobias RenwickYes. If the interim statement raises questions, I'd rather answer them live with you than through a long email thread. Theo can set the time.
- Theo GallagherI'll send a couple of options once the evidence has gone across. Anil, would the same slot work, first thing?
- Anil BhattFirst thing is convenient. Please propose a date after I have had time to read what you send.
- Emma KirkupSame for me. Mornings are better, afternoons get eaten by the grants team.
- Theo GallagherMornings it is. Anything else anyone wants to raise while we've got the time? We've got a bit left.
- Emma KirkupOne thing, more for later, I suppose. When the account managers first use it, is there something they can look at to see what it's pulled in and from where? So they trust it.
- Tobias RenwickYes. Answers show the sources they were drawn from, so a person can click through and check. It's a deliberate choice. I'd rather people verify early on and trust it because it's earned, not because we said so.
- Emma KirkupThat would go down well with my lot. They're sceptical about anything with AI in the name.
- Anil BhattAs they should be. Scepticism is a control.
- Tobias RenwickI might borrow that, Anil.
- Anil BhattYou may, provided you evidence it.
- Theo GallagherRight, I think that's us. Let me just confirm the one date that matters. The two actions, the end of the year, and I'll hold that line in everything I send. If I see any movement, I'll flag it to you the same day, Anil.
- Anil BhattThank you. Then I will conclude. I will await the documents and I will respond with any follow-up questions as promptly as I can.
- Tobias RenwickThanks, Anil, and thanks, Emma. Useful questions, and the right ones. Best of luck with the rest of the assessment.
- Emma KirkupCheers both. I'll get the grants system answer to you quickly and the test steps over to IT as soon as I get them.
- Theo GallagherBrilliant. I'll get the first batch to you by the end of the week. Speak soon, everyone.
- Anil BhattGoodbye.
- Emma KirkupBye all.
- Tobias RenwickBye for now.
Callsmade from