Ordermatic Organization Chart

Owner	[Security Owner — to be named: founder/CTO]
Effective date	[set on approval]
Review cadence	On any hire/exit/role change; reviewed at the quarterly security review
Version	0.3 — DRAFT (Gusto + Drata roster reconciled 2026-06-26)
TSC mapping	CC1.3 (Maintains Organization Chart)
Source	Drata personnel ⨝ users (system-access roster) + Gusto (payroll)

Entity: ERP Unlocked Inc (dba Ordermatic) · C-Corporation · 3 OH locations (Shaker Heights, Bay Village, Beachwood) · joined Gusto 2026-06-18.

Roster (reconciled: Drata system-access ⨝ Gusto payroll, 2026-06-26)

The SOC 2 personnel population is everyone with system access (Drata = 10 identities: 8 humans + 2 service accounts), which is broader than Gusto payroll (3 interns). Both sources agree on the interns; the leadership/eng/contractors are not on Gusto payroll.

Name	Function / title	Type (Drata)	On Gusto payroll?
David Boone	Founder / CEO — Security Owner	Employee	No
Dan Mizener	[title — confirm]	Employee	No
Fabio Romero	[title — confirm; eng?]	Employee	No
Xiana Fejes	Marketing Intern	Employee	Yes
Nolan Reis	Summer Intern	Employee	Yes (seasonal)
Destiny Wiley	Summer Intern	Employee	Yes
Norbert O’Brien III	[engagement/role — confirm]	Contractor	No
Tyler Swanner	[engagement/role — confirm]	Contractor	No
Orders Inbox (orders@)	Shared mailbox — non-human	Service account	—
Technical Support (support@)	Shared mailbox — non-human	Service account	—

Personnel-population reconciliation — RESOLVED (2026-06-26):

• 8 humans (6 employees + 2 contractors) are in scope for background checks, security-awareness training, JDs, MFA, and access reviews.
• 2 service accounts (Orders Inbox, Technical Support) are non-human (notHumanReason set in Drata) → excluded from human personnel controls.
• Gusto payroll covers only the 3 interns. David, Dan, and Fabio are W-2 employees not on Gusto payroll yet; the 2 contractors are paid outside Gusto. → For SOC 2, drive personnel controls off the Drata roster, not Gusto.
• Only outstanding item: confirm titles for Dan Mizener, Fabio Romero, and the two contractors’ engagements (Drata jobTitle is blank for everyone).

Reporting structure

                ┌─────────────────────────────────────┐
                │  David Boone — Founder / CEO         │  ← Security Owner
                └──────────────────┬──────────────────┘
        ┌──────────────────┬───────┴────────┬───────────────────┐
 ┌──────┴───────┐  ┌───────┴────────┐  ┌────┴─────────┐  ┌───────┴────────┐
 │ Team (W-2)   │  │ Interns        │  │ Contractors  │  │ Service accts  │
 │ Mizener,     │  │ Fejes (mktg),  │  │ O'Brien III, │  │ Orders Inbox,  │
 │ Romero       │  │ Reis, Wiley    │  │ Swanner      │  │ Tech Support   │
 └──────────────┘  └────────────────┘  └──────────────┘  └────────────────┘

Security ownership & segregation of duties (CC1.3)

• Security Owner: David Boone (Founder/CEO) — accountable for the security program. (Confirm; if delegated to a CTO, update here.)
• Production deploy authority: restricted to engineering staff; the staging → main promotion is the gated release path (see Change Management Policy).
• Secret access: restricted to those who operate infrastructure; secrets live in Infisical / 1Password (see Access Control Policy).
• The author of a change is not its sole approver (review + manual promotion = separation of authoring and releasing).
• Interns and contractors have least-privilege access scoped to their function; they do not hold prod deploy or secret access.

This chart is maintained current and reviewed whenever someone joins, leaves, or changes role.