Shared responsibility

Who owns what — written down, before there is an incident

A finance-grade platform should never be unclear about responsibility. This matrix is the same one we sign into MSAs, walk through with auditors, and reference in incident reviews.

Matrix items

Across nine domains

ADmetric-owned

Engineered, cannot be opted out

Customer-owned

With templates & playbooks

Versioned

Quarterly

Changes published on /change-notice-policy

Responsibility matrix

Area	Control	Owner	Notes
Identity	SSO / IdP integration (SAML, OIDC)	Customer	Customer owns IdP. We accept any compliant provider; no SSO tax.
Identity	WebAuthn enforcement for privileged paths	ADmetric	Enforced by platform; cannot be disabled by tenants.
Identity	Role assignment inside workspace	Customer	Customer admins manage roles; we provide RBAC + access reviews.
Data	Encryption in transit / at rest	ADmetric	TLS 1.3, AES-256-GCM, per-tenant data keys, HSM-backed.
Data	Classification of customer-provided PII	Customer	Customer flags PII fields; we apply masking + retention policy.
Data	Cross-region replication	ADmetric	Per residency choice on /residency.
Controls	Guardrails-as-code (caps, kill switches)	ADmetric	Built-in. Customer authors policies in /policies.
Controls	Policy authoring & review	Customer	Customer CAB approves bundle promotions to production.
Payouts	Treasury queue + 2-of-3 approval	ADmetric	Engineered; cannot be downgraded.
Payouts	Bank account ownership & FX corridor selection	Customer	Customer holds funds; we orchestrate, never custody.
Payouts	Platform-side spend reconciliation	Shared	We reconcile; platforms emit the source-of-truth invoices.
Reliability	RTO/RPO per service tier	ADmetric	Public commitments on /resilience.
Reliability	Customer DR drills (tabletops)	Customer	Customer runs annual tabletop using our /tabletops kit.
Audit	Immutable audit log (Merkle ledger)	ADmetric	Roots published to /trust-ledger.
Audit	Auditor walk-through and evidence access	Shared	We host the walk-through; customer brings the auditor.
Ad platforms	Platform terms compliance	Customer	Customer is the principal under platform TOS; we are a partner.
Ad platforms	API rate limit management	ADmetric	We absorb 429s and back off across tenants.
Privacy	DPA, sub-processors register	ADmetric	Maintained on /sub-processors with 30-day notice.
Privacy	Data subject requests (DSR) intake	Customer	Customer is the controller; we are processor and respond within 72h.
Incident response	Detection & containment of our infrastructure	ADmetric	On-call 24/7; runbooks on /runbooks.
Incident response	Customer-side coordination & comms	Customer	Customer DRI named in /tabletops; we provide the bridge.

How we keep this honest

Every line maps to a control in /controls, an owner in /access-paths, and a runbook in /runbooks.
Material changes require CAB approval and a 90-day notice on /change-notice-policy.
We bind this matrix into the MSA; ambiguity is treated as our failure during incidents.
Auditor walk-through uses this page as the index.