MSA — Security & Confidentiality Commitments

Owner	[Security Owner / commercial]
Status	0.2 — DRAFT (delta on Drata’s template) · needs counsel
TSC mapping	CC2.3 / CC9 (MSAs Offered to Customers)

Use Drata’s standard MSA / security-addendum template as the base. This file is only the delta — the security/confidentiality terms specific to Ordermatic to fold in. Counsel reviews before use.

The customer MSA (or its DPA exhibit) commits Ordermatic to:

• A security program consistent with its published policies and SOC 2 control set.
• Confidentiality and use-limitation of customer data.
• Encryption in transit (TLS) and at rest (AES-256-GCM / PBKDF2 for sensitive credentials).
• Least-privilege + MFA + tenant isolation of customer data.
• A maintained, customer-available subprocessor list (Vendor policy).
• Breach notification without undue delay (target 72h; IR policy).
• Data return/deletion on termination (Data policy).
• The SOC 2 report under NDA via the trust center.

No cardholder data in scope — PAN/CVV are scrubbed at ingestion; Stripe handles card billing. State this so customers don’t assume PCI scope.