How an ETL review runs

Transparent stages so your security team knows when access is needed and your engineers know when to expect the readout.

Intake brief

You describe pipeline purpose, languages in use, and the release or audit date driving the review. We reply with a draft scope boundary and fixed quote.
Access & NDA

We sign your mutual NDA or use ours. Access is read-only: Git branch, CI artefact export, or air-gapped zip — your policy leads.
Static analysis pass

We map job dependencies, entry points, and test files. No production credentials required at this stage.
Deep read

Reviewers work in parallel on transformation logic and orchestration. Questions go through a single Slack or email thread to avoid ping-pong.
Findings draft

Internal QA on our side checks that every blocker links to evidence. You receive the PDF and markdown export simultaneously.
Readout & optional retest

Live call to walk through disagreements. If you book a retest, we verify fixes against the original findings list only.