Security

Authentication, authorization, threat modeling, compliance, and security policies for the Ordermatic platform.

Architecture & Technical Controls

Document	Description
Threat Model	Platform STRIDE + DREAD threat analysis, trust boundaries, and live gaps
API Security Model	Webapp API route categorization, middleware guards, and enforcement modes
CSRF Protection	Cross-site request forgery protection across Astro endpoints
Authentication Architecture	@clerk/astro client bootstrap, @repo/auth SSR middleware/handshake/RBAC, Cloudflare Access, MCP OAuth 2.1, and service tokens
Webapp Auth Audit (Archive)	Historical authentication audit summary
DNS Hardening Runbook	SPF, DKIM, DMARC, and Cloudflare DNS security hardening
GCP Cloud Audit	GCP IAM, Cloud Run, VPC, and Cloud SQL security review
Branch Protection Proposal	Repository branch protection and PR review controls

Compliance & Customer Assurance

Document	Description
SOC 2 Readiness	SOC 2 Type I / II control readiness assessment
Compliance Roadmap	Security and compliance milestones
Drata Remediation Map	Control-by-control Drata evidence and remediation mapping
CASA Self-Assessment	Google OAuth CASA Tier 2 security assessment
MSA Security Commitments	Contractual security, breach notification, and data handling commitments
Helix Compliance Discovery	CMMC / defense compliance discovery notes
Out-of-Scope Tests	Documented exclusions for automated compliance checks

Policies & People

Document	Description
Security Policies Index	Index of corporate security policies (InfoSec, Access, Change, IR, BCP/DR)
Organization Chart	Security and engineering ownership structure
Job Descriptions	Role responsibilities for compliance evidence
Performance Evaluation	Annual review process for security compliance