Raw

We have confirmation that a security review is mandatory and that an internal hardening framework applies, but we still need the approved‑package list, the architecture diagram (to answer data‑storage and encryption questions), and clarification on overseas work locations before we can fix the build‑phase price.

**What is already answered**  
- A security review is required before production. *(Source 1, Q1)*  
- An internal hardening framework exists, though a review is still required. *(Source 1, Q2)*  
- A policy on open‑source dependencies exists and an approved‑package list will be provided. *(Source 1, Q3; reiterated in Source 2)*  

**What is still missing from Aldergate**  
- The approved‑package list (promised 12 May by D. Mercer and again 9 July by R. Whitcombe, not yet received). *(Source 1, Q3; Source 2; Source 3, R‑11)*  
- The architecture diagram and design walkthrough needed to answer where customer data may be stored and the required encryption/logging. *(Source 1, Q7; Source 2 – Fernway will send draft; Source 3, R‑14)*  
- Full clarification of permissible work locations outside the UK (only Ireland mentioned so far). *(Source 1, Q6)*  

**Open internal risks**  
- Build‑phase price cannot be fixed until security requirements are confirmed. *(Source 3, R‑07)*  
- The pending approved‑package list and architecture diagram block pricing. *(Source 3, R‑11; R‑14)*