Raw

**Answer:** The compliance track is partially answered – we know the security review is required, an internal hardening framework exists, an open‑source policy is in place, dependency approval will be assessed during the review, and Fernway staff can work from Ireland – but we still need the approved‑package list, the architecture diagram (to resolve data‑storage, encryption and logging questions), and a defined turnaround time for dependency approvals.

**What is already answered**

- **Security review** – required before production (Q1).  
- **Hardening framework** – internal standard exists; review still required (Q2).  
- **Open‑source policy** – policy exists; approved‑package list will be sent (Q3).  
- **Critical dependency approval** – assessed during the security review (Q4).  
- **Staff location** – work from Ireland is acceptable (Q6).  

**What still needs to be obtained from Aldergate**

- **Approved‑package list** – promised (12 May, 9 July) but not yet received (R‑11).  
- **Architecture diagram** – required to answer where customer data may be stored and the associated encryption/logging requirements (Q7, R‑14).  
- **Turnaround time for dependency approval** – no standard defined; case‑by‑case (Q5).  

**Immediate actions for today**

1. Follow up with S. Okafor (information security owner) to request the approved‑package list.  
2. Send the draft architecture diagram to Aldergate (as agreed in the 9 July sync).  
3. Clarify with Aldergate whether any expected SLA exists for dependency‑approval decisions.