Skip to content
Ordermatic Docs

Ordermatic — Deployment & Compliance Discovery

For: Helix · From: Ordermatic · ~10 minutes

Ordermatic can run in a few different ways depending on your security and compliance requirements — from a fully isolated instance in a government-authorized cloud to an on-premise appliance that keeps all data inside your facility. To recommend the right fit (and not over- or under-build it), we need a short picture of your data-handling and contractual requirements.

Please answer what you can below, or grab 20 minutes with us and we’ll walk through it together. If a question is better answered by your compliance officer, contracts lead, or IT/security team, feel free to forward it.

⚠️ Please don’t include any sensitive content in your answers. Describe your data and requirements in general terms — do not paste actual purchase orders, drawings, part specifications, contract text, CUI, or personal information into this form or the email carrying it. If sharing a sample would help, just say so and we’ll set up an approved secure channel first.

A. What data would actually flow through Ordermatic

Section titled “A. What data would actually flow through Ordermatic”

  1. What documents would you send us to process? (e.g., customer purchase orders, emails, quotes, drawings/specs, packing lists)

  2. Would any of that content include engineering drawings, part specifications, or technical data — as opposed to purely commercial order details (item numbers, quantities, prices, ship-to addresses)?

    • Commercial/transactional details only
    • Sometimes includes technical data / drawings / specs
    • Not sure

  3. Could any of it be export-controlled (ITAR or EAR)?

    • No [ ] Yes [ ] Not sure

B. Data classification

Section titled “B. Data classification”

  1. Would any information you send Ordermatic be marked or treated as Controlled Unclassified Information (CUI)?

    • No CUI [ ] Yes, CUI [ ] Federal Contract Information (FCI) but not CUI
    • Not sure

  2. If CUI: roughly what portion of what you’d send us is CUI vs. ordinary commercial data? (This matters — if CUI is rare or avoidable, we can often keep it out of Ordermatic entirely and simplify everything.)

C. Regulatory & contractual requirements

Section titled “C. Regulatory & contractual requirements”

  1. Do your DoD-related contracts include DFARS 252.204-7012 (safeguarding covered defense information / cyber incident reporting)?

    • Yes [ ] No [ ] Not sure

  2. What is your CMMC status?

    • Not required [ ] Level 1 [ ] Level 2 [ ] Level 3
    • Certified, or in progress? >

  3. Do any contracts or your prime contractor specify a required cloud security level for systems that handle this data? (e.g., FedRAMP Moderate, FedRAMP High, or DoD Impact Level IL2 / IL4 / IL5)

    • FedRAMP Moderate [ ] FedRAMP High [ ] DoD IL2 [ ] IL4 [ ] IL5
    • No specific requirement [ ] Not sure
    • If you can, paste the relevant contract clause or your prime’s requirement:

D. Hosting & network constraints

Section titled “D. Hosting & network constraints”

  1. Are you permitted to use an external cloud for this data if it is authorized at the required level (e.g., a FedRAMP-authorized, US-only, isolated instance)?

    • Yes [ ] No — must stay on our premises [ ] Not sure / depends

  2. Does any environment that would touch this data need to be air-gapped (no internet connectivity at all)?

    • No [ ] Yes [ ] Some systems

  3. Any outbound network restrictions at the site we should know about? (e.g., allowlist-only egress, no outbound to third parties)

  4. What ERP does this run against, and where does it live? (e.g., Epicor Kinetic / Eclipse, on-prem vs. hosted; plus Salesforce if in the loop)

E. Compliance relationship

Section titled “E. Compliance relationship”

  1. Would you expect Ordermatic to be assessed as part of your CMMC boundary, or to carry its own authorization/attestation as a service provider?

    • Part of our boundary [ ] Its own authorization [ ] Not sure

  2. Do you maintain a System Security Plan (SSP) or shared-responsibility matrix we should map our controls into?

    • Yes (can share) [ ] Yes (internal only) [ ] No [ ] Not sure

  3. Who is the best point of contact for security/compliance questions on your side?

Thank you — this lets us propose the smallest, fastest deployment that fully meets your requirements. We’ll follow up with a recommended architecture and a plain walkthrough of exactly what data does and doesn’t leave your environment.