6MM & Partner Responsibility Matrix

A clear responsibility model reduces operational risk and helps support teams respond faster.

Responsibility split

Area	6MM	Partner
Trading infrastructure	Matching, risk, trading engine, API and SDK capabilities	Correct integration and production monitoring
End-user relationship	No direct customer relationship unless separately agreed	User onboarding, support, disclosures, and account lifecycle
Secrets and credentials	Provides credential model and signing requirements	Stores secrets securely and restricts internal access
Webhooks	Sends signed lifecycle events	Verifies signatures and processes events idempotently
Compliance operations	Provides compliance-oriented technology and support materials	Confirms local obligations and user-facing requirements
Integration releases	Maintains documented platform and integration capabilities	Tests partner code, configuration, and user journeys before release
Incident handling	Investigates relevant 6MM infrastructure and provides partner support channels	Detects user-facing impact, preserves evidence, contains partner systems, and escalates

Stage	Partner action
Design	Define user ownership, asset flow, data flow, support model, and target jurisdictions.
Build	Keep secrets on the backend, implement supported authentication, and preserve business identifiers.
Test	Exercise timeout, retry, duplicate-webhook, expired-token, and failure scenarios.
Launch	Complete readiness review, establish monitoring, and document support escalation.
Operate	Review alerts, reconcile abnormal operations, rotate credentials, and maintain audit evidence.
Incident	Contain partner-controlled systems, protect credentials, preserve UTC timelines, and contact the correct 6MM channel.

Name the owner for integration health, security, compliance, and end-user support.
Document production base URLs, credential owners, and rotation procedures.
Confirm dashboards and alerts for authentication, order, transfer, and webhook failures.
Store request IDs, partner order numbers, and event IDs in searchable logs.
Define which events require immediate escalation.
Keep the Support Request Template available to the operations team.

Design partner-side trust boundaries and controls.

Review compliance preparation and operating boundaries.

Confirm technical and operational readiness before launch.