NOA’s security posture, stated plainly — what ships today, what’s a documented procedure, and what’s a named gap.

4 roles (internal_admin, org_admin, approver, auditor) and 43 permissions, enumerated as data rather than scattered across `if` statements, enforced at every console route before the route body runs.

Postgres Row-Level Security enforced at the database ROLE level, not only in application `WHERE` filters — production requires a dedicated NOINHERIT, non-owner login that SET LOCAL ROLE’s into a non-superuser, non-BYPASSRLS application role per transaction. Pre-deploy rejects privileged runtime credentials, and readiness fails closed (503) if the effective role can bypass RLS.

WebAuthn/passkey re-authentication required before sensitive mutations (audit export, key rotation, trust-root management, device pairing), with a 10-minute freshness window.

OIDC (PKCE + nonce + state) and SAML (signature-verified, replay-cached).

SCIM v2, bearer-token authenticated and tenant-scoped, with deprovision-cascade. The bearer token is itself revocable.

Append-only audit events, each linking to the previous event’s hash (sha256 of a canonical JSON form). A step-up-gated export includes the console’s own recomputed chain-verification result alongside the data, so a buyer’s auditor can re-derive the same check independently instead of trusting our attestation. The export is bounded honestly: a hard cap of 10,000 events per export — above it the route refuses and names the resumable SIEM stream, rather than silently truncating.

Each chain’s head can be signed with an Ed25519 key held outside the database (optionally timestamped by an external RFC 3161 authority) and streamed to a customer’s own SIEM as NDJSON. This makes a later rewrite of an earlier event detectable to anyone holding a copy of the anchor — it does not by itself prevent a rewrite by an actor who holds both the database and the signing key. Inert until an operator configures a signing key; never fabricates an anchor and never exits silently as if it had.

One verified evidence bundle at a time, streamed as its canonical bytes so `sha256(exported file)` matches a response header — no re-derivation trust required on the reader’s side.

The canonical Node (node:crypto) Ed25519 verifier vs. the browser-swap module (@noble/curves) this site’s own /playground uses, checked against 6 adversarial vector classes (cofactor-malleated signatures, small-order keys, out-of-range scalars, non-canonical encodings, loose base64 decoding, cross-implementation). Re-runnable yourself.

Scoped claim, stated precisely: for the mobile app’s magic-link sign-in artifacts, the email is stored only as a keyed hash, the login link token and session bearer are stored as sha256 hashes compared in constant time, and the session subject is an opaque internal user id. The console account profile itself does store your sign-in email so we can operate your account — see /privacy.

The human-readable approval-hold display is HPKE-encrypted to the approver device’s own key and persisted as the immutable encrypted_display member of noa_console_hold_artifacts. The signed-in handset fetches that tuple through the direct m1-authenticated mobile approval API; the retired private relay-message table is not the current transport.

A first (and currently only) consumer of each organization’s configured retention window: purges expired auth artifacts and aged security events on an explicit --apply run (dry-run is the default). Deliberately does not touch the append-only audit chain itself.

RFC 9116 security.txt, machine-readable, at the standard well-known path.

Idempotent, checksum-tracked Postgres migrations, run against a real PostgreSQL 18 instance in CI before merge. The migration runner refuses every other server major before execution.

A fail-closed logical restore procedure with checked-in drill tooling: restore-drill.sh plus dedicated verifiers for the restored migration ledger, the restored audit chain, and the core-8 invariants. The latest genuine drill (2026-08-29) restored a hash-bound production logical backup into isolated PostgreSQL 18 at exact head 060: 60 migrations and 92 public tables, with every MVCC table fingerprint and the audit and RLS/ACL probes passing. Its bounded verdict is SEMANTIC_PASS_WITH_NON_MVCC_SEQUENCE_BOUNDARY because PostgreSQL sequences were not quiesced. It does not prove provider-native backup restorability, provider PITR configuration or live health, or production RPO/RTO.

An automated readiness pager runs from checked-in code: a scheduled workflow probes production, opens one deduplicated P1 incident issue on failure, and closes it after verified recovery. Its cadence is stated honestly — GitHub’s scheduler is best-effort, so every run measures and reports its own gap since the previous probe (observed gaps up to 2h35m are disclosed in the workflow itself) instead of claiming a five-minute interval it cannot keep; a checked-in external-probe entrypoint provides a guaranteed interval when driven by an operator-supplied scheduler. Still open, named plainly: a guaranteed-interval scheduler in production and a public status page. The SIEM export above remains the path into a customer’s own monitoring stack.