> ## Documentation Index
> Fetch the complete documentation index at: https://holder.docs.fiskil.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction to Data Provider

> Enable secure, user-permissioned data sharing with confidence. Fiskil handles authorization, consent flows, and compliance so you can focus on your product.

Fiskil Data Provider enables your application to expose first-party data to trusted third parties with confidence. We take care of OpenID Connect authorization, user consent flows, multi-environment support, and operational tooling so your team can focus on your product and user experience.

<Card title="Start Building" href="/docs/get-started" icon="rocket" />

<Note>
  Fiskil is certified for SOC 2 Type 2 and ASAE 3150 Type 2. We offer integrated DDoS protection, secure audit trails, and industry-aligned safeguards. Learn more in our <a href="https://www.fiskil.com/product/data-provider">product overview</a>.
</Note>

***

## What is User-Permissioned Data Sharing?

**User-Permissioned Data Sharing** is a model where your customers are in control. They explicitly grant consent for trusted third parties (Data Recipients) to access specific datasets, for a defined purpose and duration.

Unlike traditional data sharing models — bulk exports, file transfers, or backchannel APIs — user-permissioned data sharing is:

* **Consent-driven** — Users approve access via hosted consent flows
* **Scoped** — Access tokens carry only the permissions granted by the user
* **Time-bound** — Consents expire automatically or can be revoked at any time
* **Auditable** — All activity is logged and linked to a consent record

This model is the foundation of the Fiskil Data Provider. It enables you to expose first-party data securely and compliantly, without building complex authorization and consent infrastructure yourself.

***

## What is the Fiskil Data Provider?

The **Fiskil Data Provider** is the platform that turns your organization into a **trusted source of user-permissioned data**.

You are the Data Provider: you own the customer and product data. Fiskil gives you everything you need to expose that data securely, with built-in consent, authorization, and compliance.

### Your Core Responsibilities

As a Data Provider, you:

* Implement the **Resource Server** — APIs that return customer and product data
* Define the **datasets and scopes** that can be shared

### What Fiskil Provides

Fiskil handles the infrastructure:

* Hosts the **consent flows and dashboards** on your branded domain
* Issues and validates tokens aligned to the granted scopes
* Provides the **management console, request logs, and metrics** for your team
* Handles the heavy lifting of compliance (authorization standards, audit trails, regulatory reporting)

### Why Choose Fiskil?

* **Accelerated time to market** — Ship data sharing in weeks, not years
* **Security built-in** — Tokens, JWKS validation, audit logs, DDoS protection
* **User experience managed for you** — Hosted consent screens and optional consumer dashboard
* **Global standards ready** — Designed for frameworks like CDR, FDX, and open banking

***

## Architecture Overview

The Fiskil Data Provider works alongside your **Resource Server** to deliver secure, user-permissioned data sharing. Here's how the components connect and who is responsible for each:

### Core Components

<Tabs>
  <Tab title="Your Resource Server">
    * Your API that implements the data-sharing endpoints (e.g., accounts, balances, transactions)
    * Authenticates the Fiskil Data provider to secure your connection
    * Returns customer and product data in the expected format
  </Tab>

  <Tab title="Fiskil Data Provider">
    * Authorization server for consent flows and token issuance
    * Hosted consent UI and optional consumer consent dashboard
    * Instance management (staging, production, multi-region/brand)
    * Authentication (JWT, JWKS, optional mTLS)
    * Logs and metrics for observability
  </Tab>

  <Tab title="Data Recipients">
    * Trusted third-party apps or services requesting access
    * Integrated directly (custom) or via regulatory registries (e.g., accredited recipients)
    * Use OAuth2/OIDC flows to obtain tokens scoped by user consent
  </Tab>
</Tabs>

### Data Flow Architecture

The diagram below shows how data flows between your customers, the Fiskil platform, and third-party applications:

<div style={{ height: '400px', border: '1px solid #e2e8f0', borderRadius: '8px', marginBottom: '2rem' }}>
  <iframe
    src="data:text/html,
<!DOCTYPE html>
<html>
<head>
<script src='https://unpkg.com/react@18/umd/react.development.js'></script>
<script src='https://unpkg.com/react-dom@18/umd/react-dom.development.js'></script>
<script src='https://unpkg.com/reactflow@11/dist/umd/index.js'></script>
<style>
body { margin: 0; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; }
.react-flow__node { font-size: 12px; }
.react-flow__edge-text { font-size: 11px; }
.provider-node { background: #f0f9ff; border: 2px solid #0369a1; border-radius: 8px; padding: 12px; }
.fiskil-node { background: #f0fdf4; border: 2px solid #16a34a; border-radius: 8px; padding: 12px; }
.recipient-node { background: #fef3c7; border: 2px solid #d97706; border-radius: 8px; padding: 12px; }
.user-node { background: #f3e8ff; border: 2px solid #9333ea; border-radius: 8px; padding: 12px; }
</style>
</head>
<body>
<div id='root' style='width: 100%; height: 400px;'></div>
<script>
const { useState, useCallback } = React;
const { ReactFlow, Controls, Background, useNodesState, useEdgesState } = ReactFlowLib;

const initialNodes = [
{
id: '1',
type: 'default',
position: { x: 50, y: 50 },
data: {
label: React.createElement('div', { className: 'user-node' },
React.createElement('strong', null, 'Your Customers'),
React.createElement('br'),
'Grant consent for data sharing'
)
},
style: { width: 160, height: 60 }
},
{
id: '2',
type: 'default',
position: { x: 300, y: 20 },
data: {
label: React.createElement('div', { className: 'fiskil-node' },
React.createElement('strong', null, 'Fiskil Data Provider'),
React.createElement('br'),
'Consent UI • Authorization Server • Compliance'
)
},
style: { width: 200, height: 80 }
},
{
id: '3',
type: 'default',
position: { x: 300, y: 150 },
data: {
label: React.createElement('div', { className: 'provider-node' },
React.createElement('strong', null, 'Your Resource Server'),
React.createElement('br'),
'Customer data • Product APIs • Scope enforcement'
)
},
style: { width: 200, height: 80 }
},
{
id: '4',
type: 'default',
position: { x: 600, y: 50 },
data: {
label: React.createElement('div', { className: 'recipient-node' },
React.createElement('strong', null, 'Third-party Apps'),
React.createElement('br'),
'Data Recipients • Consumer Applications'
)
},
style: { width: 160, height: 60 }
}
];

const initialEdges = [
{
id: 'e1-2',
source: '1',
target: '2',
type: 'smoothstep',
label: '1. Consent Flow',
labelStyle: { fontSize: '10px' },
style: { stroke: '#9333ea' }
},
{
id: 'e2-4',
source: '2',
target: '4',
type: 'smoothstep',
label: '2. Access Token',
labelStyle: { fontSize: '10px' },
style: { stroke: '#16a34a' }
},
{
id: 'e4-3',
source: '4',
target: '3',
type: 'smoothstep',
label: '3. API Calls',
labelStyle: { fontSize: '10px' },
style: { stroke: '#d97706' }
},
{
id: 'e3-4',
source: '3',
target: '4',
type: 'smoothstep',
label: '4. Customer Data',
labelStyle: { fontSize: '10px' },
style: { stroke: '#0369a1' }
},
{
id: 'e2-3',
source: '2',
target: '3',
type: 'smoothstep',
label: 'Token Validation',
labelStyle: { fontSize: '10px' },
style: { stroke: '#16a34a', strokeDasharray: '5,5' }
}
];

function DataProviderFlow() {
const [nodes, setNodes, onNodesChange] = useNodesState(initialNodes);
const [edges, setEdges, onEdgesChange] = useEdgesState(initialEdges);

return React.createElement(ReactFlow, {
nodes: nodes,
edges: edges,
onNodesChange: onNodesChange,
onEdgesChange: onEdgesChange,
fitView: true,
attributionPosition: 'bottom-left',
children: [
React.createElement(Controls, { key: 'controls' }),
React.createElement(Background, { key: 'background' })
]
});
}

ReactDOM.render(React.createElement(DataProviderFlow), document.getElementById('root'));
</script>
</body>
</html>"
    width="100%"
    height="400px"
    frameBorder="0"
  />
</div>

### How It Works

<Steps>
  <Step title="Consent Initiation">
    A Data Recipient initiates a consent flow with your customer.
  </Step>

  <Step title="User Authentication & Consent">
    Fiskil's Data Provider authorization server authenticates the user, presents branded consent screens, and captures approved scopes.
  </Step>

  <Step title="Token Issuance">
    Fiskil issues an access token with the specific scopes granted by the user.
  </Step>

  <Step title="Data Access">
    The Data Recipient calls Fiskil data sharing endpoints with the token to access consented data.
  </Step>

  <Step title="Authorization & Response">
    Fiskil validates the token and checks that the request is authorised before fetching the customer data from your Resource Server.
  </Step>

  <Step title="Monitoring & Compliance">
    All activity is logged in Request Logs and surfaced in Metrics for monitoring and audit purposes.
  </Step>
</Steps>

### Division of Responsibilities

<CardGroup cols={3}>
  <Card title="You (Data Provider)" icon="server">
    Build and maintain your Resource Server.
  </Card>

  <Card title="Fiskil" icon="shield-check">
    Provide the Data Provider infrastructure: consent flows, tokens, AuthN/AuthZ, observability, and compliance-ready tooling.
  </Card>

  <Card title="Data Recipients" icon="mobile">
    Build integrations with your data under user consent.
  </Card>
</CardGroup>

***

## How Fiskil Fits Into Your Architecture

* Your team builds and manages a `Resource Server`, which implements the APIs to expose your data
* Fiskil provides:
  * A FAPI 2.0-compliant authorization & resource server
  * Fully managed consent flows
  * Staging and production environments
  * A management console for observability, configuration, and tooling
* Third parties access data through direct onboarding or via registered data recipient frameworks (e.g., CDR, FDX)

### Environments

Each integration runs in isolated **instances**:

* **Staging**: for development, integration, and testing with mock recipients
* **Production**: for live, regulated traffic
* Additional instances can be created for multi-brand or multi-region deployments

<Tip>
  Learn more about setting up your environments in our [Instances Guide](/docs/get-started/instances).
</Tip>

***

## Key Capabilities

<AccordionGroup>
  <Accordion title="Financial-grade Authorization">
    Certified FAPI 2.0 OpenID Connect implementation, providing robust protection for sensitive data.
  </Accordion>

  <Accordion title="Consent Management">
    A complete system to create, view, and revoke user consents via API or prebuilt UI components.
  </Accordion>

  <Accordion title="Observability and Auditability">
    Real-time traffic logs, availability metrics, and audit trails for complete visibility into data sharing activities.
  </Accordion>

  <Accordion title="Third-party Onboarding">
    Onboard external recipients directly or integrate with regulatory data sharing registers.
  </Accordion>

  <Accordion title="Complex Account Support">
    Support for organisational, joint, and multi-party accounts with flexible permission management.
  </Accordion>

  <Accordion title="Global Data Sharing Standards">
    Support for frameworks such as Consumer Data Right (CDR) and Financial Data Exchange (FDX).
  </Accordion>

  <Accordion title="Product and Metadata Sharing">
    Expose product schemas and metadata alongside customer-specific data.
  </Accordion>

  <Accordion title="Regulatory Reporting">
    Workflows aligned with compliance and reporting obligations for your jurisdiction.
  </Accordion>
</AccordionGroup>

***

## Get Started

Choose how you'd like to begin your integration:

<CardGroup cols={3}>
  <Card title="Deploy Your First Tenant" href="/docs/get-started/instances" icon="layers">
    Set up staging and production environments for your data sharing integration.
  </Card>

  <Card title="Build Your Resource Server" href="/docs/build" icon="code">
    Implement the APIs that will expose your customer and product data.
  </Card>

  <Card title="Follow a Regulatory Framework" href="/docs/integrations/plaid" icon="globe">
    Integrate with established frameworks like CDR, FDX, or open banking standards.
  </Card>
</CardGroup>

***

## Stay Connected

<CardGroup cols={2}>
  <Card title="Read Our Blog" href="https://www.fiskil.com/blog" icon="book-open">
    Stay updated with the latest insights and best practices in data sharing.
  </Card>

  <Card title="Subscribe to Our Newsletter" href="https://www.fiskil.com/newsletter" icon="mail">
    Get product updates and industry news delivered to your inbox.
  </Card>
</CardGroup>