Security shared-responsibility matrix

This matrix assigns ownership for each control. It does not report whether the control is currently available. Availability and evidence gaps are recorded in the applicable-item remediation register.

Legend

Symbol	Meaning	Decision or activity owned by that party
A	Accountable	Approves the control outcome, accepts residual risk, and confirms completion
R	Responsible	Performs the operational or technical work and produces the evidence
C	Consulted	Supplies information, platform capability, specialist input, or business confirmation before the decision
I	Informed	Receives the outcome, change, incident, or status; no approval or execution duty is assigned
A/R	Accountable and responsible	The same party approves the outcome and performs the work
—	No assigned responsibility in this matrix	The control does not rely on that party for approval, operation, consultation, or notification

Text after a symbol narrows its scope. For example, A for configuration means FinTrack approves the selected configuration, while R for service means the provider operates the managed service that implements it. A row can therefore assign FinTrack accountability and provider responsibility without making FinTrack the operator of provider infrastructure.

Provider contracts remain the authoritative source where a signed term assigns responsibility differently from this public operating summary.

Control area	FinTrack	Cloudflare	Supabase	Customer / authorised user
Application requirements, design, and code	A/R	I	I	C
Static hosting and edge platform operation	A for configuration	R	—	I
Backend platform and operating-system security	A for provider selection	—	R	I
Schema, grants, row-level policies, and trusted operations	A/R	—	C	I
User identity data and application roles	A/R	—	C for identity platform	C for authorised-user lifecycle
Provider-account access and MFA	A/R	C for platform controls	C for platform controls	—
Customer-user access requests and timely deprovisioning	C	—	—	A/R
Data classification, purpose, minimisation, and retention	A/R	C	C	C
TLS and platform encryption	A for configuration/use	R for edge	R for backend	R for endpoint security
WAF, rate limits, and edge rules	A/R for configuration	R for service	—	I
Database backups	A for requirements and restore decisions	—	R for provider backups	C
Storage-object protection and recovery	A/R	—	C for platform capability	C
Application monitoring and incident triage	A/R	C	C	I/reporting
Provider incidents and service status	A for customer response	R for Cloudflare platform	R for Supabase platform	I
Vulnerability remediation in application configuration	A/R	C	C	I
Endpoint, browser, and credential protection	C	—	—	A/R
Compliance determination and customer-specific obligations	A/R	C for provider evidence	C for provider evidence	A/R for customer obligations

Boundary statements

• Provider security does not compensate for unsafe application design, excessive access, or exposed secrets.
• FinTrack configuration responsibility does not transfer operation of provider infrastructure to FinTrack.
• Customer administrators remain responsible for authorised-user requests, endpoint security, credential protection, and prompt notification of personnel or access changes.
• Recovery, incident, and compliance outcomes require coordination across the affected boundaries.

Operational handoff points

Event	FinTrack action	Provider or customer action	Completion condition
New customer user	Configure the approved tenant and role after an authorised request	Customer confirms identity, duties, and permitted scope	User authenticates and negative access checks remain denied
Customer personnel change	Disable or change application access and reassign controlled work	Customer notifies FinTrack promptly and confirms successor or removal scope	Old access fails and business ownership is reconciled
Provider security incident	Assess application and customer impact, preserve evidence, contain configuration risk, and communicate	Provider supplies verified status, scope, actions, and recovery evidence	FinTrack validates service and data integrity; residual risk is accepted or remediated
Application vulnerability	Validate, prioritize, remediate, deploy, and retest application responsibility	Provider supplies platform fixes or evidence where the condition is provider-owned	Exact attack path and regression scope pass; risk owner closes the finding
Recovery event	Select the authorised recovery point, coordinate dependencies, validate security and business state, and reconcile transactions	Provider executes managed restore; customer validates critical business outcomes where required	Approved validation and objective measurement are recorded
Contract or processing change	Update data flow, register, security review, notices, and configuration	Provider or customer confirms changed terms and obligations	Approval precedes production processing under the new arrangement

Responsibility evidence

Accountability is supported by named internal owners, current provider contracts, customer administration terms, access records, change approvals, incident contacts, and recovery decisions. Provider documentation proves the managed-service capability; it does not prove FinTrack enabled the optional feature or configured it correctly. FinTrack configuration proves application use; it does not transfer operation of provider infrastructure to FinTrack. Customer confirmation proves the requested user and business scope; it does not authorize FinTrack to weaken backend enforcement.

When responsibility is shared, the incident commander records one accountable coordinator and the separate action owner at each boundary. Closure requires both the provider or customer deliverable and FinTrack validation. A provider ticket marked resolved is not sufficient when application integrity, customer impact, or transaction reconciliation remains unverified.

Evidence limitation

This matrix is a public operating summary, not a contract amendment. Named owners, escalation contacts, support levels, audit rights, and notification deadlines require contract and internal confirmation.

• Supabase shared-responsibility model