{
  "version": "1.0",
  "effectiveDate": "2026-08-19",
  "standard": "PCI DSS v4.0.1",
  "legend": [
    { "symbol": "●", "label": "Owner" },
    { "symbol": "◐", "label": "Contributes / provides evidence" },
    { "symbol": "○", "label": "Not applicable" }
  ],
  "source": "Adapted from Flok's internal PCI DSS Shared Responsibility Matrix & Action Plan, v1.0 draft (14 August 2026).",
  "rows": [
    {
      "requirement": "1. Network security controls",
      "provider": "●",
      "flok": "◐",
      "tenant": "○",
      "notes": "Largely inherited from Vercel (static hosting); Flok owns database network configuration."
    },
    {
      "requirement": "2. Secure configuration",
      "provider": "●",
      "flok": "◐",
      "tenant": "◐",
      "notes": "Mostly inherited from Vercel; Flok owns database hardening; tenants configure their own Stripe/Payrexx account settings."
    },
    {
      "requirement": "3. Protect stored account data",
      "provider": "●",
      "flok": "○",
      "tenant": "○",
      "notes": "Flok never stores cardholder data. Neither does the tenant — card data lives only with the payment provider."
    },
    {
      "requirement": "4. Protect cardholder data in transit",
      "provider": "●",
      "flok": "◐",
      "tenant": "○",
      "notes": "Flok enforces TLS on all pages. The redirect to the provider's checkout page happens over TLS; the card entry itself happens entirely on the provider's origin."
    },
    {
      "requirement": "5. Anti-malware",
      "provider": "●",
      "flok": "●",
      "tenant": "○",
      "notes": "Applies to Flok's own build and hosting infrastructure."
    },
    {
      "requirement": "6. Secure development",
      "provider": "●",
      "flok": "●",
      "tenant": "○",
      "notes": "Flok owns its SDLC, dependency updates, and patch management."
    },
    {
      "requirement": "6.4.3 Payment page script management",
      "provider": "●",
      "flok": "◐",
      "tenant": "○",
      "notes": "Not required for SAQ A, but Flok restricts which scripts can run on pages in the checkout path via a Content-Security-Policy script-src allowlist. Automated script-change detection is not yet built."
    },
    {
      "requirement": "7. Restrict access by business need to know",
      "provider": "●",
      "flok": "●",
      "tenant": "◐",
      "notes": "Flok's role-based access control scopes every user to their own tenant; tenants manage which of their own users hold which role."
    },
    {
      "requirement": "8. Identify and authenticate users",
      "provider": "●",
      "flok": "●",
      "tenant": "●",
      "notes": "Flok provides passwordless one-time-code login for the member portal and WebAuthn passkey login for staff/admin accounts; each tenant is responsible for who they grant access to."
    },
    {
      "requirement": "9. Restrict physical access",
      "provider": "●",
      "flok": "○",
      "tenant": "○",
      "notes": "Fully inherited from Vercel (Frankfurt) and Supabase (Zürich) — Flok operates no physical infrastructure of its own."
    },
    {
      "requirement": "10. Log and monitor all access",
      "provider": "●",
      "flok": "◐",
      "tenant": "○",
      "notes": "Flok logs administrative changes across the platform via an audit log. Append-only logging of every read of a stored payment credential is part of ongoing hardening work."
    },
    {
      "requirement": "11. Test security of systems and networks",
      "provider": "●",
      "flok": "◐",
      "tenant": "○",
      "notes": "Automated dependency and secret scanning run in CI today. A recurring third-party penetration test is not yet in place."
    },
    {
      "requirement": "11.6.1 Detect unauthorised page changes",
      "provider": "◐",
      "flok": "◐",
      "tenant": "○",
      "notes": "A restrictive Content-Security-Policy limits what can run on checkout pages. Dedicated tamper-detection tooling is not yet built."
    },
    {
      "requirement": "12.8 Manage third-party service providers",
      "provider": "●",
      "flok": "●",
      "tenant": "●",
      "notes": "Flok maintains this matrix and its subprocessor list; tenants should review both, and their own provider relationship, at least annually."
    },
    {
      "requirement": "12.10 Incident response",
      "provider": "●",
      "flok": "◐",
      "tenant": "◐",
      "notes": "Flok will notify affected tenants of a security incident that concerns their data; tenants remain responsible for notifying their own acquirer/provider per that provider's terms."
    },
    {
      "requirement": "SAQ A eligibility — payment elements from the provider only",
      "provider": "●",
      "flok": "●",
      "tenant": "◐",
      "notes": "Flok-controlled: ticket checkout is a full-page redirect to Stripe or Payrexx. No card field is ever rendered by Flok. Tenants must not take card numbers by phone, email, or chat and enter them anywhere."
    },
    {
      "requirement": "SAQ A eligibility — site not susceptible to script-based attacks",
      "provider": "◐",
      "flok": "●",
      "tenant": "○",
      "notes": "Flok-controlled: the redirect model means this criterion is not reached, since no Flok page renders a payment form."
    },
    {
      "requirement": "Annual SAQ A submission",
      "provider": "○",
      "flok": "○",
      "tenant": "●",
      "notes": "Only the tenant, as the merchant, can complete and sign this. Flok records that a tenant has self-declared completion but does not verify or submit on the tenant's behalf."
    },
    {
      "requirement": "Contract with acquirer / payment provider",
      "provider": "○",
      "flok": "○",
      "tenant": "●",
      "notes": "Each tenant holds its own direct account and contract with Stripe or Payrexx. Flok is never merchant of record."
    }
  ]
}