Skip to content
Ordermatic Docs

Ordermatic Security Policy Set

This directory is the source of truth for Ordermatic’s SOC 2 / Trust Services policy bundle. Policies are drafted and reviewed as code (PR against staging), then published to Drata, where the founder signs and the team acknowledges. The Drata-published, signed version is the controlling copy of record; this repo holds the reviewable draft and version history.

Status: DRAFT (v0.1). Every policy below is a draft for review. Each is grounded in controls that already exist in this codebase (cited inline) — the work is to confirm the practice, name the owner/signatory, set the effective date, and publish. See ../soc2-readiness.md for the CC1–CC9 gap analysis these policies close.

Bundle

Section titled “Bundle”
# Policy Primarily covers Anchored in
1 Information Security Policy CC1, CC2, CC5 Security owner, governance cadence, this whole set
2 Access Control Policy CC6 Clerk authn, clerkOrganizationId tenant isolation, support-admin audit, MFA, quarterly access review
3 Change Management Policy CC8 PR→staging→main FF promotion, CI gates, branch protection, Drizzle migrations, feature-flag-gated ERP writes
4 Incident Response Policy CC7.3–7.4 Severity tiers, breach clock, existing rotation/pooler runbooks, annual tabletop
5 Vendor & Subprocessor Management Policy CC9.2 Subprocessor inventory, SOC 2 collection, DPAs, annual review
6 Business Continuity & Disaster Recovery Policy A1, CC7.5 Cloud Run multi-zone, Neon PITR, RTO/RPO, annual restore drill
7 Data Classification & Retention Policy C1, CC6.7 retain_30d/keep_forever, PAN/CVV scrub, AES-256-GCM + PBKDF2
8 Acceptable Use Policy CC1, CC2 Endpoint baseline (disk encryption, screen lock, antimalware), secrets handling, MFA

Publishing checklist (per policy)

Section titled “Publishing checklist (per policy)”
  1. Review the draft in a PR against staging; confirm every cited control is accurate and current.
  2. Name the Owner and Approved by signatory (fill the placeholders).
  3. Set the Effective date on approval.
  4. Publish to Drata (Public API v2 POST /policies or the Drata UI policy editor); founder marks Approved; assign team acknowledgement.
  5. Verify Drata policy totalCount ≥ 8 and that CC1/CC2 control evidence picks the policies up.

Review cadence

Section titled “Review cadence”

All policies are reviewed at least annually and on any material change to the system or the team. The annual review is the responsibility of the Security Owner and is itself an operating control (CC4 / CC5.3).