RisiQ Trust Center

graph TB
    V["Visitor"] --> LP["Landing Page
/trust-center"]
    LP --> CF["Contact Form
Request Access"]
    CF -->|"Sales enables TC"| PR["Prospect — Level 1"]
    PR --> DB["Dashboard
/trust-center/home"]
    DB --> SEC["Security Docs"]
    DB --> INF["Infrastructure Docs"]
    PR -->|"NDA signed"| NDA["NDA — Level 2"]
    NDA --> COMP["Compliance & Legal"]
    NDA -->|"Deal Closed Won"| CU["Customer — Level 3"]
    CU --> CERT["Certifications"]
    CU --> VER["Version History"]

    style V fill:#1e3054,stroke:#2a3f6a,color:#f6fbff
    style LP fill:#1e3054,stroke:#2a3f6a,color:#f6fbff
    style CF fill:#1e3054,stroke:#2a3f6a,color:#f6fbff
    style PR fill:#142036,stroke:#2563eb,color:#2563eb
    style DB fill:#142036,stroke:#2a3f6a,color:#f6fbff
    style SEC fill:#142036,stroke:#2a3f6a,color:#a3b8d0
    style INF fill:#142036,stroke:#2a3f6a,color:#a3b8d0
    style NDA fill:#142036,stroke:#a78bfa,color:#a78bfa
    style COMP fill:#142036,stroke:#2a3f6a,color:#a3b8d0
    style CU fill:#142036,stroke:#FFB342,color:#FFB342
    style CERT fill:#142036,stroke:#2a3f6a,color:#a3b8d0
    style VER fill:#142036,stroke:#2a3f6a,color:#a3b8d0
    

graph LR
    subgraph HS["HubSpot Platform"]
        CRM["CRM
Contacts · Companies
Deals · Custom Objects"]
        CMS["CMS Hub
Templates · Modules
Private Content"]
        SF["Serverless Functions
Secure Downloads
Tier Validation"]
        WF["Workflows
Tier Assignment
Deal-to-Access"]
        FM["File Manager
Private PDFs
CloudFront CDN"]
    end
    CRM <-->|"crm_objects()"| CMS
    CRM <-->|"hubspot/api-client"| SF
    FM <-->|"Files API v3"| SF
    WF -->|"Property Update"| CRM
    CMS -->|"context.contact"| SF

    style HS fill:#0e1629,stroke:#2a3f6a,color:#f6fbff
    style CRM fill:#142036,stroke:#FFB342,color:#f6fbff
    style CMS fill:#142036,stroke:#2563eb,color:#f6fbff
    style SF fill:#142036,stroke:#22c55e,color:#f6fbff
    style WF fill:#142036,stroke:#a78bfa,color:#f6fbff
    style FM fill:#142036,stroke:#FFB342,color:#f6fbff
    

graph LR
    A["User visits
/trust-center/*"] --> B{"Layer 1
CMS Private
Content"}
    B -->|"Not logged in"| C["Redirect to
/_hcms/mem/login"]
    B -->|"Logged in"| D{"Layer 2
trust_center
_enabled?"}
    D -->|"false"| E["Access Gate
Contact Sales"]
    D -->|"true"| F{"Layer 3
Tier Check
user >= min"}
    F -->|"Insufficient"| G["Locked Tile"]
    F -->|"Sufficient"| H["Access Granted"]

    style A fill:#1e3054,stroke:#2a3f6a,color:#f6fbff
    style B fill:#142036,stroke:#FFB342,color:#FFB342
    style C fill:#3d1111,stroke:#ef4444,color:#ef4444
    style D fill:#142036,stroke:#FFB342,color:#FFB342
    style E fill:#3d1111,stroke:#ef4444,color:#ef4444
    style F fill:#142036,stroke:#FFB342,color:#FFB342
    style G fill:#3d1111,stroke:#ef4444,color:#ef4444
    style H fill:#0f3d24,stroke:#22c55e,color:#22c55e
    

graph LR
    CO["Contact
trust_center_enabled
access_tier · role"] --- COMP["Company
company_status
nda_signed"]
    CO --- DEAL["Deal
contract_signed
provisioning_approved"]
    CO ---|"Membership"| PAGE["CMS Private Pages
9 Trust Center Pages"]
    DOC["Trust Center Document
doc_bucket · min_tier
secure_file"] ---|"crm_objects()"| PAGE
    DOC ---|"Files API"| FM["File Manager
Private PDFs"]

    style CO fill:#142036,stroke:#FFB342,color:#FFB342
    style COMP fill:#142036,stroke:#2563eb,color:#2563eb
    style DEAL fill:#142036,stroke:#a78bfa,color:#a78bfa
    style DOC fill:#142036,stroke:#22c55e,color:#22c55e
    style PAGE fill:#142036,stroke:#2a3f6a,color:#f6fbff
    style FM fill:#142036,stroke:#2a3f6a,color:#a3b8d0
    

sequenceDiagram
    participant U as User Browser
    participant SF as Serverless Function
    participant CRM as HubSpot CRM
    participant Files as Files API v3
    participant CDN as CloudFront

    U->>SF: GET /_hcms/api/secure-download?doc_id=123
    SF->>SF: Check context.contact.isLoggedIn
    alt Not logged in
        SF-->>U: 401 Unauthorized
    end
    par Parallel CRM Lookup
        SF->>CRM: GET Contact access_tier
        SF->>CRM: GET Document min_tier + file_id
    end
    SF->>SF: tier_order[contact] >= tier_order[doc]
    alt Insufficient tier
        SF-->>U: 403 Forbidden
    end
    SF->>Files: GET /files/v3/files/{id}/signed-url
    Files-->>SF: Signed URL (15min expiry)
    SF-->>U: 302 Redirect
    U->>CDN: GET signed URL
    CDN-->>U: PDF Download
    

graph LR
    A["Deal
Created"] -->|"WF1"| B["TC Enabled
tier = prospect"]
    B --> C["NDA sent via
PandaDoc / DocuSign"]
    C -->|"Client signs"| D["WF4: nda_status
tier = nda"]
    D --> E["Contract sent
after 4-eyes approval"]
    E -->|"Client signs"| F["WF5: Closed Won
tier = customer"]

    style A fill:#1e3054,stroke:#2a3f6a,color:#f6fbff
    style B fill:#142036,stroke:#2563eb,color:#2563eb
    style C fill:#142036,stroke:#a78bfa,color:#a78bfa
    style D fill:#142036,stroke:#a78bfa,color:#a78bfa
    style E fill:#142036,stroke:#FFB342,color:#FFB342
    style F fill:#0f3d24,stroke:#22c55e,color:#22c55e
    

graph LR
    A["TC Disabled
enabled = false"] -->|"WF3 triggers"| B["tier = public"]
    B --> C["All Tiles
Locked"]
    C --> D["Signed URLs
Expire (15min)"]
    D --> E["Full
Revocation"]

    style A fill:#3d1111,stroke:#ef4444,color:#ef4444
    style B fill:#4a3010,stroke:#FFB342,color:#FFB342
    style C fill:#1e3054,stroke:#2a3f6a,color:#f6fbff
    style D fill:#1e3054,stroke:#2a3f6a,color:#f6fbff
    style E fill:#0f3d24,stroke:#22c55e,color:#22c55e
    

graph LR
    A["Prospect
Registered"] -->|"Sales sends"| B["NDA"]
    B -->|"Client signs"| C["tier = nda"]
    C -->|"Sales creates"| D["Offer /
Quote"]
    D -->|"Client accepts"| E["Contract"]
    E -->|"4-Eyes
Approval"| F["Client signs"]
    F -->|"Closed Won"| G["tier = customer"]
    G -->|"Auto-generate"| H["Invoice"]
    H -->|"Export"| I["DATEV"]

    style A fill:#1e3054,stroke:#2a3f6a,color:#f6fbff
    style B fill:#142036,stroke:#FFB342,color:#FFB342
    style C fill:#0f3d24,stroke:#22c55e,color:#22c55e
    style D fill:#142036,stroke:#2563eb,color:#2563eb
    style E fill:#142036,stroke:#a78bfa,color:#a78bfa
    style F fill:#142036,stroke:#FFB342,color:#FFB342
    style G fill:#0f3d24,stroke:#22c55e,color:#22c55e
    style H fill:#142036,stroke:#22d3ee,color:#22d3ee
    style I fill:#4a3010,stroke:#FFB342,color:#FFB342
    

sequenceDiagram
    participant S as Sales Rep
    participant PD as PandaDoc / DocuSign
    participant C as Bank Contact
    participant HS as HubSpot CRM
    participant WF as Workflow

    S->>PD: Create NDA from Deal sidebar
    PD->>PD: Auto-fill Contact + Company data
    S->>PD: Send NDA to contact
    PD->>C: Email with signing link
    C->>PD: Signs NDA digitally
    PD->>HS: Webhook: nda_status = completed
    HS->>WF: Trigger: esign_nda_status changed
    WF->>HS: Set access_tier = nda
    WF->>HS: Set nda_signed = true (Company)
    WF->>S: Notification: NDA signed
    

graph TB
    A["Sales creates contract
in PandaDoc / DocuSign"] --> B["Deal stage:
Contract Ready"]
    B --> C{"4-Eyes Approval
Legal / Finance"}
    C -->|"Rejected"| D["Back to Sales
for revision"]
    C -->|"Approved"| E["approval_status
= approved"]
    E --> F["Sales sends
contract to client"]
    F --> G["Client signs
digitally"]
    G --> H["Webhook:
contract_status
= completed"]
    H --> I["WF: Deal stage
= Closed Won"]
    I --> J["WF: tier
= customer"]
    I --> K["Finance task:
Generate invoice"]

    style A fill:#1e3054,stroke:#2a3f6a,color:#f6fbff
    style B fill:#142036,stroke:#2563eb,color:#2563eb
    style C fill:#142036,stroke:#FFB342,color:#FFB342
    style D fill:#3d1111,stroke:#ef4444,color:#ef4444
    style E fill:#0f3d24,stroke:#22c55e,color:#22c55e
    style F fill:#1e3054,stroke:#2a3f6a,color:#f6fbff
    style G fill:#142036,stroke:#a78bfa,color:#a78bfa
    style H fill:#142036,stroke:#FFB342,color:#FFB342
    style I fill:#0f3d24,stroke:#22c55e,color:#22c55e
    style J fill:#0f3d24,stroke:#22c55e,color:#22c55e
    style K fill:#142036,stroke:#2a3f6a,color:#a3b8d0
    

graph TB
    Q{"How complex is
your pricing?"}
    Q -->|"Fixed prices +
manual discounts"| A["HubSpot Products
+ Line Items"]
    Q -->|"Contract length affects
discount + optional modules"| B["PandaDoc
Pricing Tables"]
    Q -->|"Multi-variable formulas
tiered + volume + currency"| C{"Ops Hub
available?"}
    C -->|"Yes"| D["Ops Hub
Coded Action"]
    C -->|"No"| E["External
Pricing API"]

    style Q fill:#142036,stroke:#FFB342,color:#FFB342
    style A fill:#0f3d24,stroke:#22c55e,color:#f6fbff
    style B fill:#0f3d24,stroke:#22c55e,color:#f6fbff
    style C fill:#142036,stroke:#a78bfa,color:#a78bfa
    style D fill:#142036,stroke:#2563eb,color:#f6fbff
    style E fill:#142036,stroke:#2563eb,color:#f6fbff
    

sequenceDiagram
    participant S as Sales Rep
    participant HS as HubSpot CRM
    participant AP as Approver
(Legal / Finance)
    participant PD as PandaDoc
    participant CL as Client

    S->>HS: Move Deal to "Contract Ready"
    HS->>HS: Set approval_status = pending
    HS->>AP: Task: Review contract (auto-created)
    AP->>HS: Set approval_status = approved
    HS->>S: Notification: Contract approved
    Note over S,PD: Only NOW can Sales send
    S->>PD: Send contract to client
    PD->>CL: Email with signing link
    CL->>PD: Signs contract
    PD->>HS: Webhook: contract_status = completed
    

graph LR
    A["Deal
Closed Won"] -->|"WF trigger"| B["Invoice
generated"]
    B --> C{"Export
Method"}
    C -->|"Option A"| D["sevDesk /
lexoffice"]
    C -->|"Option B"| E["GetMyInvoices"]
    C -->|"Option C"| F["Manual CSV
Export"]
    D --> G["DATEV
Unternehmen Online"]
    E --> G
    F --> G

    style A fill:#0f3d24,stroke:#22c55e,color:#22c55e
    style B fill:#142036,stroke:#22d3ee,color:#22d3ee
    style C fill:#142036,stroke:#FFB342,color:#FFB342
    style D fill:#142036,stroke:#2563eb,color:#2563eb
    style E fill:#142036,stroke:#a78bfa,color:#a78bfa
    style F fill:#142036,stroke:#2a3f6a,color:#a3b8d0
    style G fill:#4a3010,stroke:#FFB342,color:#FFB342
    

graph TB
    START["Contact Property
Changed"] --> CHECK{"Which property
changed?"}
    CHECK -->|"trust_center_enabled
= true"| WF1["WF1: Set tier
= prospect"]
    CHECK -->|"trust_center_enabled
= false"| WF3["WF3: Set tier
= public"]
    CHECK -->|"Deal Stage
changed"| WF2{"WF2: Which
stage?"}
    WF2 -->|"NDA Signed"| NDA["Set tier = nda"]
    WF2 -->|"Closed Won"| CW["Set tier = customer"]
    WF2 -->|"Closed Lost"| CL["Set tier = public
enabled = false"]

    style START fill:#1e3054,stroke:#2a3f6a,color:#f6fbff
    style CHECK fill:#142036,stroke:#FFB342,color:#FFB342
    style WF1 fill:#142036,stroke:#2563eb,color:#2563eb
    style WF3 fill:#3d1111,stroke:#ef4444,color:#ef4444
    style WF2 fill:#142036,stroke:#FFB342,color:#FFB342
    style NDA fill:#142036,stroke:#a78bfa,color:#a78bfa
    style CW fill:#0f3d24,stroke:#22c55e,color:#22c55e
    style CL fill:#3d1111,stroke:#ef4444,color:#ef4444
    

graph TB
    REQ["Download Request"] --> L1{"File Access
PRIVATE?"}
    L1 -->|"CDN URL"| BLOCK1["404 — CDN blocked"]
    L1 -->|"Serverless endpoint"| L2{"Auth Check
isLoggedIn?"}
    L2 -->|"No"| BLOCK2["401 — Unauthorized"]
    L2 -->|"Yes"| L3{"Tier Validation
contact >= doc?"}
    L3 -->|"Insufficient"| BLOCK3["403 — Forbidden"]
    L3 -->|"Sufficient"| L4["Files API v3
Generate Signed URL"]
    L4 --> L5["CloudFront
Signed URL (15min)"]
    L5 --> DL["PDF Download"]
    L5 -->|"After 15min"| BLOCK4["404 — URL Expired"]

    style REQ fill:#1e3054,stroke:#2a3f6a,color:#f6fbff
    style L1 fill:#142036,stroke:#FFB342,color:#FFB342
    style L2 fill:#142036,stroke:#FFB342,color:#FFB342
    style L3 fill:#142036,stroke:#FFB342,color:#FFB342
    style L4 fill:#142036,stroke:#22c55e,color:#22c55e
    style L5 fill:#142036,stroke:#22c55e,color:#22c55e
    style DL fill:#0f3d24,stroke:#22c55e,color:#22c55e
    style BLOCK1 fill:#3d1111,stroke:#ef4444,color:#ef4444
    style BLOCK2 fill:#3d1111,stroke:#ef4444,color:#ef4444
    style BLOCK3 fill:#3d1111,stroke:#ef4444,color:#ef4444
    style BLOCK4 fill:#3d1111,stroke:#ef4444,color:#ef4444
    

graph TB
    subgraph current["Current: CMS Membership"]
        A1["User visits
private page"] --> B1["HubSpot redirects
/_hcms/mem/login"]
        B1 --> C1["Email + Password
Login"]
        C1 --> D1["request.contact
available in HubL"]
    end
    subgraph future["Future: Enterprise SAML SSO"]
        A2["User visits
private page"] --> B2["HubSpot redirects
to RisiQ IdP"]
        B2 --> C2["SSO Login
via Okta / Azure AD"]
        C2 --> D2["SAML Assertion
to HubSpot"]
        D2 --> E2["request.contact
available in HubL"]
    end

    style A1 fill:#1e3054,stroke:#2a3f6a,color:#f6fbff
    style B1 fill:#142036,stroke:#FFB342,color:#FFB342
    style C1 fill:#142036,stroke:#2a3f6a,color:#f6fbff
    style D1 fill:#0f3d24,stroke:#22c55e,color:#22c55e
    style A2 fill:#1e3054,stroke:#2a3f6a,color:#f6fbff
    style B2 fill:#142036,stroke:#2563eb,color:#2563eb
    style C2 fill:#142036,stroke:#2a3f6a,color:#f6fbff
    style D2 fill:#142036,stroke:#2a3f6a,color:#f6fbff
    style E2 fill:#0f3d24,stroke:#22c55e,color:#22c55e
    

graph TB
    subgraph HN["HubSpot Native"]
        direction LR
        H1["Phase 1
CRM + CMS + Serverless
Tier access + Docs"]
        H2["Phase 2
PandaDoc/DocuSign
Quotes + Invoices
DATEV Middleware"]
        H3["Phase 3
HubDB Search
Expanded Tiles
Ops Hub coded actions"]
        H4["Phase 4
Enterprise SSO
Advanced Portal"]
        H1 --> H2
        H2 --> H3
        H3 --> H4
    end
    subgraph HY["Hybrid (Sanity + S3 + Next.js)"]
        direction LR
        Y1["Phase 1
CRM + Next.js Frontend
Sanity Studio
S3 Storage"]
        Y2["Phase 2
PandaDoc/DocuSign
Quotes + Invoices
DATEV Middleware"]
        Y3["Phase 3
Algolia Search
Expanded Content
Custom Webhooks"]
        Y4["Phase 4
Enterprise SSO
Advanced Portal"]
        Y1 --> Y2
        Y2 --> Y3
        Y3 --> Y4
    end

    style HN fill:#0a1628,stroke:#2563eb,color:#2563eb
    style HY fill:#0a1628,stroke:#a78bfa,color:#a78bfa
    style H1 fill:#142036,stroke:#2563eb,color:#f6fbff
    style H2 fill:#142036,stroke:#2563eb,color:#f6fbff
    style H3 fill:#142036,stroke:#2563eb,color:#f6fbff
    style H4 fill:#142036,stroke:#2563eb,color:#f6fbff
    style Y1 fill:#1a1040,stroke:#a78bfa,color:#f6fbff
    style Y2 fill:#1a1040,stroke:#a78bfa,color:#f6fbff
    style Y3 fill:#1a1040,stroke:#a78bfa,color:#f6fbff
    style Y4 fill:#1a1040,stroke:#a78bfa,color:#f6fbff
    

graph TB
    subgraph Core["Core (Keep)"]
        CRM["HubSpot CRM
Contacts, Companies, Deals
Tier Workflows, Custom Objects"]
        PD["PandaDoc / DocuSign
NDA + Quote + Contract"]
    end
    subgraph Frontend["Frontend (Replace HubL)"]
        FE["Next.js / Astro
on Vercel"]
        API["HubSpot API
CRM data"]
        SF["Serverless Functions
Vercel Edge or CF Workers"]
    end
    subgraph Storage["Storage (Move)"]
        S3["S3 / R2
Private Documents"]
        SIGN["Presigned URLs
60s expiry"]
    end
    subgraph Keep["Keep As-Is"]
        DATEV["DATEV Middleware
sevDesk / lexoffice"]
        SSO["Enterprise SAML
Single IdP"]
    end

    CRM --> API
    API --> FE
    FE --> SF
    SF --> S3
    S3 --> SIGN
    CRM --> PD
    CRM --> DATEV

    style Core fill:#0a1628,stroke:#22c55e,color:#22c55e
    style Frontend fill:#0a1628,stroke:#2563eb,color:#2563eb
    style Storage fill:#0a1628,stroke:#a78bfa,color:#a78bfa
    style Keep fill:#0a1628,stroke:#FFB342,color:#FFB342
    style CRM fill:#142036,stroke:#22c55e,color:#f6fbff
    style PD fill:#142036,stroke:#22c55e,color:#f6fbff
    style FE fill:#142036,stroke:#2563eb,color:#f6fbff
    style API fill:#142036,stroke:#2563eb,color:#f6fbff
    style SF fill:#142036,stroke:#2563eb,color:#f6fbff
    style S3 fill:#142036,stroke:#a78bfa,color:#f6fbff
    style SIGN fill:#142036,stroke:#a78bfa,color:#f6fbff
    style DATEV fill:#142036,stroke:#FFB342,color:#f6fbff
    style SSO fill:#142036,stroke:#FFB342,color:#f6fbff
    

graph TB
    subgraph USR ["End Users"]
        BANK["Bank / Prospect"]
        ADMIN["Compliance Team"]
    end

    subgraph FE ["Frontend Layer - Next.js / Vercel"]
        AUTH["Auth Middleware\nLogin - SSO SAML - Session"]
        TC["Trust Center UI\nDashboard - Categories - Tiles"]
        DL["Secure Download API\nTier check then S3 presigned URL"]
        SEARCH["Search UI\nAlgolia - Phase 3"]
    end

    subgraph HS ["HubSpot CRM - Backbone"]
        CO["Custom Objects\nTrust Center Documents\nSales Hub Enterprise"]
        WF["Workflows 7+\nTier automation - Stage gates\nApproval - Churn revocation"]
        PIPE["Deal Pipeline\nProspect - NDA - Quote\nContract - Customer"]
        PROP["CRM Properties\ntrust_center_enabled\naccess_tier - company_status"]
        CODED["Coded Actions + Webhooks\nData Hub Professional"]
    end

    subgraph STORE ["Document Storage"]
        S3["AWS S3 private\nPresigned URLs - 60s expiry"]
    end

    subgraph EXT ["External Integrations"]
        PANDA["PandaDoc / DocuSign\nNDA - Contract - Invoice"]
        DATEV["DATEV Middleware\nsevDesk / lexoffice"]
        ALGOLIA["Algolia Index\nTier-filtered search"]
        SANITY["Sanity Studio\nEditorial CMS - Phase 3"]
    end

    BANK --> AUTH
    ADMIN --> SANITY
    AUTH -->|"contact lookup"| PROP
    AUTH --> TC
    TC -->|"CRM API read"| CO
    TC -->|"tier resolution"| PROP
    TC --> DL
    DL -->|"tier >= min_tier?"| CO
    DL -->|"presigned URL"| S3
    S3 -->|"302 redirect"| BANK
    TC --> SEARCH
    SEARCH -->|"query"| ALGOLIA

    PIPE -->|"stage change"| WF
    WF -->|"tier upgrade/downgrade"| PROP
    PANDA -->|"signed event webhook"| CODED
    CODED -->|"update deal/tier"| WF
    CODED -->|"invoice export"| DATEV
    CO -->|"metadata sync"| ALGOLIA
    SANITY -->|"publish"| CO
    CO -->|"editorial data"| SANITY

    classDef hs fill:#fff4e6,stroke:#f59e0b,stroke-width:2px
    classDef fe fill:#eff6ff,stroke:#3b82f6,stroke-width:2px
    classDef ext fill:#f0fdf4,stroke:#22c55e,stroke-width:2px
    classDef store fill:#fef2f2,stroke:#ef4444,stroke-width:2px

    class CO,WF,PIPE,PROP,CODED hs
    class AUTH,TC,DL,SEARCH fe
    class PANDA,DATEV,ALGOLIA,SANITY ext
    class S3 store
    

gantt
    title Hybrid Trust Center — Implementation Timeline
    dateFormat YYYY-MM-DD
    axisFormat %b %Y

    section Phase 0
    License decisions & tool selection   :p0a, 2026-04-01, 2w
    Environment setup (Vercel, S3, repo)  :p0b, after p0a, 1w

    section Phase 1
    CRM data model & workflows           :p1a, after p0b, 3w
    Next.js frontend + auth layer        :p1b, after p0b, 5w
    S3 storage + secure download API     :p1c, after p1a, 2w
    Tier-based access UI + pages         :p1d, after p1b, 3w
    Integration testing + go-live        :p1e, after p1d, 2w

    section Phase 2
    PandaDoc / DocuSign integration      :p2a, after p1e, 2w
    Quote-to-Cash pipeline automation    :p2b, after p2a, 2w
    DATEV middleware setup               :p2c, after p2a, 1w

    section Phase 3
    Algolia search integration           :p3a, after p2b, 2w
    Sanity Studio editorial workflow     :p3b, after p2b, 3w
    My Risiq dashboard + entitlements    :p3c, after p3a, 3w

    section Phase 4
    Enterprise SSO (single IdP)          :p4a, after p3c, 1w
    Audit logging + compliance           :p4b, after p3c, 2w
    Provisioning webhook service         :p4c, after p4a, 2w