Reference Architecture

A condensed reference architecture for vendor-risk reviewers. The full data-flow diagrams and trust-boundary maps are available under NDA.

Component overview

   ┌─────────────────────────────────────────────────────────────────┐
   │                       PARTNER (bank / ISO)                       │
   │  ┌────────────────┐   ┌──────────────────┐   ┌──────────────┐    │
   │  │  Bank CRM      │   │  Bank merchant   │   │ Bank support │    │
   │  │  (server-side  │   │  portal embeds   │   │  AI agent    │    │
   │  │   REST calls)  │   │  our iframe      │   │  uses MCP    │    │
   │  └───────┬────────┘   └────────┬─────────┘   └──────┬───────┘    │
   └──────────┼─────────────────────┼────────────────────┼────────────┘
              │ X-API-Key           │ X-API-Key          │ X-API-Key
              ▼                     ▼                    ▼
   ┌─────────────────────────────────────────────────────────────────┐
   │              API Gateway (api.complianceassessmenttool.com)      │
   │                  +  Lambda Function URLs (long-running)          │
   └──────────────────────────────┬──────────────────────────────────┘
                                  │
              ┌───────────────────┼───────────────────────┐
              ▼                   ▼                       ▼
   ┌────────────────┐  ┌────────────────────┐  ┌────────────────────┐
   │ cat-api-server │  │ cat-mcp-whitelabel │  │  Fill_SAQ_PDF +    │
   │    (Lambda)    │  │      (Lambda)      │  │  prefill durable   │
   └────────┬───────┘  └─────────┬──────────┘  │  step-fn (Lambda)  │
            │                    │             └──────────┬─────────┘
            │                    │                        │
            ▼                    ▼                        ▼
   ┌─────────────────────────────────────────────────────────────────┐
   │                  DynamoDB (us-east-1, KMS-encrypted)             │
   │   CATPartner   CATPartnerMerchant   CATPaymentMethod              │
   │   CATSAQAttempt   CATSAQResponse   CATAuditEvent                  │
   │   CATApiUsage   CATComplianceSession                              │
   └─────────────────────────────────────────────────────────────────┘
                                  │
                                  ▼
   ┌─────────────────────────────────────────────────────────────────┐
   │                  S3 (us-east-1, SSE-S3 + KMS)                    │
   │     saq-pdfs (field mappings)      saq-pdfs-final (sealed)       │
   └─────────────────────────────────────────────────────────────────┘
                                  │
                                  ▼ (HTTPS API call, no-training)
   ┌─────────────────────────────────────────────────────────────────┐
   │   OpenAI Responses API  (gpt-5-nano + assistant for prefill)     │
   │   DPA in force; org-JZrfeV5ZWRQ4S6T7MfWaO4pC                     │
   └─────────────────────────────────────────────────────────────────┘

Trust boundaries

1. Partner → CAT: HTTPS with TLS 1.2+, partner API key in X-API-Key header (or short-lived deep-link URL).
2. CAT ↔ OpenAI: HTTPS, bearer token; API data not used for training, retained ≤30 days by OpenAI. Payload limited to PCI control text + the merchant's natural-language answers — never CHD.
3. CAT ↔ AWS services: IAM role-based, least privilege, scoped per Lambda. No long-lived static credentials.
4. CAT → Partner webhook URL: HTTPS, HMAC-SHA256 signed, partner-supplied secret.

Data flow — typical merchant flow (chat / iframe / REST)

1. Partner authenticates the merchant on the partner's portal.
2. Partner embeds our iframe (or 302-redirects to it) with ?apiKey=…&merchantId=….
3. Merchant completes onboarding → payment method → SAQ determination → section answers → AoC review → signature → finalize.
4. On finalize, we mirror responses into the existing SaaS pipeline, run the durable prefill (one OpenAI call per PDF page), promote winning rows to pdf-final, and invoke Fill_SAQ_PDF to stamp the official PCI templates into S3.
5. Permanent auth-gated download URLs (under /v1/merchants/…/documents/saq.pdf and …/documents/aoc.pdf) are returned in the API response and the same documents are emailed to the merchant.
6. The partner receives webhooks for saq.submitted and, if applicable, merchant.compliant.

What never crosses the wire

• Cardholder data (PAN, CVV, track, PIN) — our schema does not accept it and our system prompts refuse it.
• End-merchant credentials to the partner — we never see how the merchant authenticated to the bank.
• Partner's bank-side production systems — we only receive webhook receipts when a partner is configured.

Resiliency

Stateless Lambda + DynamoDB design tolerates instance-level failure transparently. DynamoDB point-in-time recovery enabled (35-day window). S3 versioning enabled. RTO target 4 hours, RPO target 1 hour. We do not currently run multi-region active-active; cross-region recovery uses the documented procedure in our BCP/DR plan.