TPSP responsibility matrix
Who is responsible for each payment-security requirement: AGORA, the business, or its PSP.
- Format
- agora.tpsp-matrix/v1
- Standard
- PCI DSS v4.0 (responsibility split, DEMO)
- Generated at
- 2026-10-27T15:02:22.150Z
- Psps in use
- adyen, checkout_com, stripe
- Protocol checkout in use
- yes
Rows
| Requirement | Title | Agora | Psp | Merchant |
|---|---|---|---|---|
| 1 | Network security controls | responsible for AGORA systems (payment-adjacent data only) | responsible for the payment environment (adyen, checkout_com, stripe) | responsible for its own website and PSP integration (merchant of record) |
| 2 | Secure configurations | responsible for AGORA systems (payment-adjacent data only) | responsible for the payment environment (adyen, checkout_com, stripe) | responsible for its own website and PSP integration (merchant of record) |
| 3 | Protect stored account data | not applicable: AGORA stores and transmits no account data | responsible for the payment environment (adyen, checkout_com, stripe) | responsible for its own website and PSP integration (merchant of record) |
| 4 | Protect cardholder data in transmission | not applicable: AGORA stores and transmits no account data | responsible for the payment environment (adyen, checkout_com, stripe) | responsible for its own website and PSP integration (merchant of record) |
| 5 | Protect against malicious software | responsible for AGORA systems (payment-adjacent data only) | responsible for the payment environment (adyen, checkout_com, stripe) | responsible for its own website and PSP integration (merchant of record) |
| 6 | Secure systems and software | responsible for the site SDK and handoff page served onto merchant pages (SRI-pinned, no payment fields) | responsible for the payment environment (adyen, checkout_com, stripe) | responsible for its own website and PSP integration (merchant of record) |
| 7 | Restrict access by business need to know | responsible for AGORA systems (payment-adjacent data only) | responsible for the payment environment (adyen, checkout_com, stripe) | responsible for its own website and PSP integration (merchant of record) |
| 8 | Identify users and authenticate access | responsible for AGORA systems (payment-adjacent data only) | responsible for the payment environment (adyen, checkout_com, stripe) | responsible for its own website and PSP integration (merchant of record) |
| 9 | Restrict physical access to cardholder data | not applicable: AGORA stores and transmits no account data | responsible for the payment environment (adyen, checkout_com, stripe) | responsible for its own website and PSP integration (merchant of record) |
| 10 | Log and monitor access | responsible for AGORA systems (payment-adjacent data only) | responsible for the payment environment (adyen, checkout_com, stripe) | responsible for its own website and PSP integration (merchant of record) |
| 11 | Test security regularly | responsible for AGORA systems (payment-adjacent data only) | responsible for the payment environment (adyen, checkout_com, stripe) | responsible for its own website and PSP integration (merchant of record) |
| 12 | Information security policies and programmes | shared: AGORA's security programme for its services; TPSP list and this matrix published | responsible for the payment environment (adyen, checkout_com, stripe) | maintains its TPSP list including AGORA and its PSP |
Source: compliance/api.ts tpspMatrix()