Compliance Roadmap + Cloudflare/Edge Assessment
Owner: Security/Eng · Date: 2026-06-25 · Status: DRAFT plan
Companion to: casa-self-assessment.md
Lean, prioritized plan — what to pursue, in what order, and why. Don’t boil the ocean: finish the one that’s required (CASA), then the one that unblocks revenue (SOC 2), then confirm the obligations you already trigger (PCI/privacy).
1. Framework roadmap
Section titled “1. Framework roadmap”| Framework | Why it applies to us | Effort | Priority |
|---|---|---|---|
| CASA (ADA) AL1 | Required for the Gmail restricted OAuth scopes we use; recurs annually. Mostly done — see §3. | Low (nearly there) | P0 — finish now |
| SOC 2 Type II | The #1 ask in enterprise procurement/security reviews. ~80% of its Common Criteria is already satisfied by the CASA controls we built (TLS, dep-scanning, secret rotation, tenant isolation, access control, no-credential-logging). Biggest revenue ROI. | Medium-High (3–6 mo observation window) | P1 |
| PCI DSS (scope-out) | We already scrub PAN/CVV at WhereFour ingest. Make it a formal scope decision: never store/process cardholder data → smallest SAQ. The scrub IS the control; document + monitor it. | Low (mostly documentation) | P1 — confirm now |
| GDPR / CCPA | We hold customer PII + email bodies with retention classes (retain_30d/keep_forever). Need a customer DPA, privacy policy, DSR process, documented retention. |
Low-Medium | P1 — confirm scope |
| ISO 27001 | ADA spec explicitly defers the ISMS (people/process) here. Enterprise/EU customers may ask. Heavier than SOC 2; usually after it. | High | P2 — later/if asked |
| HIPAA | Only if PHI ever transits. Likely N/A for food/ERP. | — | Skip unless a healthcare customer |
Phased plan
Section titled “Phased plan”- Phase 0 — Finish CASA (now): run the DAST scan on staging, fill the AL1 questionnaire + test report from the workbook, gather externals (SSL Labs, subdomain-takeover), bump the 9 Python CVEs PR #1916’s gate flags, engage an ADA-Authorized Lab.
- Phase 1 — SOC 2 + obligations (next quarter):
- SOC 2: pick a compliance platform (Vanta/Drata/Secureframe), map existing CASA evidence to the Common Criteria, define the control set, start the Type II observation window early (it’s 3–6 months of evidence, so the clock is the long pole).
- PCI: write the “no cardholder data in scope” statement; keep the WhereFour PAN-scrub as the documented, tested control.
- Privacy: customer DPA template, privacy policy, DSR runbook, retention-policy doc (the schema retention classes are the implementation).
- Phase 2 — ISO 27001 (if enterprise demand warrants).
Synergy: Every Phase-0 CASA control feeds SOC 2 evidence directly. Do CASA properly and SOC 2 is mostly assembly, not new work.
2. Cloudflare / edge assessment (2026-06-25, live read-only)
Section titled “2. Cloudflare / edge assessment (2026-06-25, live read-only)”Architectural finding (read this first)
Section titled “Architectural finding (read this first)”app.ordermatic.co is served by Google Frontend (Cloud Run) — NOT proxied through Cloudflare. Cloudflare’s role here is DNS + email routing + Workers (email-worker) + Access/tunnels, not app-traffic edge. Consequence: app-edge security (TLS policy, HSTS, WAF/DDoS) is GCP’s responsibility, not Cloudflare’s. Decide and document the boundary — either keep app traffic direct-to-GCP (then ensure Cloud Armor WAF + HSTS at the LB) or front it with Cloudflare for WAF/DDoS. This boundary is the single most important thing to get explicit.
Findings
Section titled “Findings”| # | Finding | Severity | Fix |
|---|---|---|---|
| CF-1 | App not CF-proxied; edge security split between GCP (app) and CF (DNS/email/tunnels) | Info → decide | Document the boundary; ensure the GCP side has WAF (Cloud Armor) + HSTS |
| CF-2 | No HSTS header on app.ordermatic.co (Google Frontend returned none) |
Medium | Add Strict-Transport-Security: max-age=63072000; includeSubDomains; preload (app middleware or Cloud Run/LB). Also CASA-adjacent. |
| CF-3 | DNSSEC disabled — no DS records on ordermatic.co / erpunlocked.com |
Medium | Enable DNSSEC in CF + publish DS at the registrar. Mitigates DNS spoofing (CASA 6.4 neighbor). |
| CF-4 | erpunlocked.com DMARC p=none (monitor-only, spoofable) |
Medium | Move to p=quarantine → p=reject. Spoofed sender = forged-PO fraud vector for an order-ingest product. |
| CF-5 | ordermatic.co DMARC p=quarantine (good, not strongest) |
Low | Tighten to p=reject once reports are clean. SPF uses ~all softfail — fine alongside DMARC enforcement. |
| CF-6 | CF API tokens: 16 total, some generic-named (Edit zone DNS, Edit Cloudflare Workers, R2 Account Token), new IaC token scoped to all zones |
Low-Med | Naming + least-privilege (started: new IaC token named + recorded in 1P). Retire generics after a terraform plan confirms coverage; consider tightening IaC token to ordermatic-family zones only. |
| CF-7 | Zone SSL mode / min-TLS / WAF managed rules unverified (CF_MK lacks zone-read scope) |
Verify | With a zone-read token: confirm SSL = Full (strict), min TLS 1.2+, WAF managed ruleset on the proxied hosts (email-worker, tunnels). |
| CF-8 | Account hardening unverified: member 2FA enforcement, audit-log review cadence | Verify | Enforce 2FA for all CF members; schedule periodic token + audit-log review (ties to the rotation playbook). |
What’s already healthy
Section titled “What’s already healthy”ordermatic.coemail = Google Workspace (aspmx.l.google.com), SPF present, DMARC enforcing (quarantine).CF_MKexists as a dedicated account-scoped management token (clean rotation path).- Email-worker inbound webhook is HMAC-verified; no unauthenticated Cloudflare-fronted endpoints.
3. Near-term action list (consolidated, prioritized)
Section titled “3. Near-term action list (consolidated, prioritized)”- [P0] Bump the 9 Python CVEs flagged by PR #1916’s
python-scagate (pillow, urllib3, requests, pydantic-settings, +5). - [P0] Run DAST (ADA Burp config or ZAP) against staging; triage Critical/High to zero.
- [P0] Fill CASA AL1 questionnaire + test report from the workbook; engage an ADA lab.
- [P1, CF-2] Add HSTS to the app (middleware or Cloud Run LB).
- [P1, CF-4/CF-5] DMARC:
erpunlocked.com→ quarantine→reject;ordermatic.co→ reject when clean. - [P1, CF-3] Enable DNSSEC + publish DS records.
- [P1, CF-7] Verify CF zone SSL = Full(strict), min TLS 1.2, WAF on proxied hosts.
- [P1] PCI scope statement; privacy DPA + retention doc.
- [P1] Kick off SOC 2 readiness (platform + start the observation clock).
- [P2, CF-6] Retire generic CF tokens after
terraform plan; tighten IaC token scope.
Run for the ADA repo specifically
Section titled “Run for the ADA repo specifically”- The DAST scan (above) — the required automated evidence.
- The ADA Cloud profile GCP config audit (
cloud-assessment/ada_cloud_audit+ GCP onboarding questionnaire) — separate from CASA-web, and relevant given our cloud footprint. - SSL Labs “A” per public host; subdomain-takeover scan.