A SaaS application is configured to allow public access to sensitive customer exports. Which responsibility needs immediate clarification?

1. The assumption that all SaaS data is public by design
2. The provider's ownership of the physical servers only
3. The customer's office network bandwidth
4. The customer's configuration and data-access responsibilities under the service model