Security review session: open findings and timing
Email thread Kielderside Growth Agency · sales
Anil Bhatt lists four open security findings and demands evidence, not description. Theo Gallagher commits to an evidence pack by end of day Wednesday ahead of a Thursday 15:30 session.
What was said
What this says
As at Fri 9 Oct 2026Anil Bhatt lists four open security findings and demands evidence, not description. Theo Gallagher commits to an evidence pack by end of day Wednesday ahead of a Thursday 15:30 session.
Ask: Anil wants evidence of the data location statement, the standing access control, certifications stated as held, and exit arrangements. He will not close any finding on the day without evidence.
Customer view: Anil is strict and precise. He wants documents a day before the session and rejects policy references in place of the control.
Next: Theo accepted the four points, will answer in order with control references, and will mark the exit arrangements as a draft. The thread does not show whether the evidence pack was delivered.
The thread
Updated 9 Oct 26Messages
Theo Gallagher 27 Jul 2026 10:10Hello Anil, I'm picking up the security review for Kielderside on our side. Before we fix a session, here are the open items as I understand them, with owners: First, data location and access: B-Viz is built and run inside the customer's own Snowflake account, and I will set out in writing what that means for where the data sits. Owner: me. Second, standing access: I will confirm with our platform team exactly who at BG-Demo has any access and under what conditions, and attach the evidence. Owner: me, with the platform team. Third, certifications: I will list what we can evidence, with the control reference for each, and say plainly where we cannot. Could we hold a walk-through on Wednesday or Thursday this week? I can do 14:00 or 15:30 on either day. If the open findings list on your side differs from mine, please send it and I'll work from yours. Thanks, Theo Theo Gallagher Solutions Engineer, BG-Demo
Anil Bhatt 27 Jul 2026 11:06Theo, Thank you. My open findings are as follows. First, please evidence the data location statement. A description is not sufficient for our assessment. Second, who has standing access, and how is it reviewed? A reference to a policy will not close this finding. I need the control itself. Third, which certifications do you hold? Please state them as held, not in progress, and provide the supporting documents. Fourth, I need your exit arrangements if we were to leave the service. I can attend on Thursday at 15:30. Wednesday is not possible. Please send the documents at least a day beforehand so that I can read them first. I will not close any finding on the day without evidence. Anil Bhatt- Theo Gallagher 27 Jul 2026 12:24Anil, Thursday at 15:30 is fine, and I'll send the invitation shortly. Here is the dated commitment: the evidence pack will reach you by end of day Wednesday. I will answer your four points in the same order, with a control reference against each and the documents attached where we have them. Where an answer depends on our platform team, I will check with them before I write it, rather than assume. On certifications, I will only list what we can evidence. If something is not held, the pack will say so. The exit arrangements will be included in the pack as a draft for discussion, and I'll mark it as a draft so there is no ambiguity. If you want any finding added or reworded before then, tell me and I'll update my list. Thanks, Theo