Raw

**Answer:** A security review is mandatory, Aldergate has an internal hardening framework and an open‑source policy, but we still need the approved‑package list, the architecture diagram (to resolve storage/encryption questions), and a clear turnaround time for dependency approvals.  

**What’s already answered**  
- **Security review requirement:** Yes – a review must be done before production (Q1).  
- **Security standard/checklist:** An internal hardening framework exists; review still required (Q2).  
- **Open‑source policy:** A policy is in place and the approved‑package list will be sent (Q3).  
- **Critical dependency approval:** Assessed during the security review (Q4).  
- **Work location for Fernway staff:** Working from Ireland is acceptable (Q6).  

**What still needs to be obtained**  
- **Approved‑package list:** Still pending; promised 12 May (Mercer) and again 9 July (Whitcombe).  
- **Architecture diagram & design walkthrough:** Required to answer where customer data may be stored and the associated encryption/logging requirements (Q7).  
- **Turnaround time for dependency approval:** No standard timeline; case‑by‑case (Q5) – a concrete estimate is needed.  
- **Confirmation of any additional permissible work locations:** Only Ireland mentioned; clarification if other countries are allowed.