Privacy Policy

This policy covers three surfaces of one product, NOA Trust: the noatrust.com marketing site, the enterprise console (the hosted admin product at /admin), and the NOA Trust mobile app (the approver phone app that pairs with the console).

• Email address— used to sign you in and to send enterprise invitations. Console sign-in uses a password or your organization’s single sign-on (SSO), with a passkey optionally required to re-confirm sensitive actions; the NOA Trust mobile app signs in with a one-time magic link sent to your email. Your account email is stored in our database so we can operate your account; where a console password is used, it is stored only as a salted hash, never in plaintext. To deliver an email, the plaintext address is handed to our transactional-email provider at send time (see /subprocessors).
• Device public key— when an approver pairs the NOA Trust mobile app, only the device’s public signing/HPKE keys are registered with the console. The matching private keys are generated on the device, held in the phone’s OS-level secure keystore (iOS Keychain / Android Keystore), and are not transmitted — the console has no route that accepts a private key.
• Organization and audit data — for enterprise customers, the console records organization membership, member names, role assignments, and an append-only audit trail of admin actions (actor id, role, action, resource type/id, outcome, timestamp, and non-personal structured metadata) — scoped to that organization only.
• Receipts— where an integrating agent emits NOA receipts, the receipt records a hash of the action’s parameters, never the raw parameters, and identifies the approver by an opaque id, not by name or email. Low-entropy identifiers are replaced with tenant-scoped, HMAC-based opaque values, so receipts carry no raw personal data and are not directly correlatable across tenants.
• IP address — processed transiently to rate-limit requests and to enforce optional per-organization IP allowlists. Only hashed derivatives are persisted for abuse correlation; we do not keep a log of your raw IP address.
• Cookies — the console and admin area set only strictly-necessary cookies to keep you signed in: an admin session cookie (HttpOnly, SameSite=Lax, scoped to /admin) and a short-lived cookie during an enterprise SSO round trip. None are used for tracking or advertising. The public marketing pages (noatrust.com/*) set no cookies until you sign in, and this codebase contains no analytics or advertising tracker of any kind.

• Your signing key and display-decryption key are generated on your device and never leave it — not uploaded to any server, not visible to us. Unlocking the app (biometric/PIN) is a local gate on using the key; it is never itself transmitted as a credential.
• Push and relay messages to your device are stored only as ciphertext (an encapsulated key plus ciphertext) in our relay message store. To route an approval and record its outcome, the console does process the request envelope — the tool name and target, with any parameters recorded as hashes — but it never holds your device’s private signing key and cannot sign on your behalf.
• An administrator can revoke a paired device from the console (logged, with a required reason), and you can sign out or unpair on the device itself to stop that device from receiving further requests.
• Uninstalling the NOA Trust mobile app removes the on-device signing key, which never leaves the device and cannot be exported or copied. To use a new device you pair it afresh — an administrator revokes the old device and the new one generates its own signing key; the old key is never transferred.

• No advertising identifiers, no ad networks, no cross-app or cross-website tracking.
• No location, contacts, photos, or microphone access.
• No third-party analytics or marketing SDKs are bundled in the marketing site, the console, or the mobile app.
• We do not sell or rent personal data, and we do not share it for advertising.

A summary of the infrastructure and service providers this codebase actually calls — confirmed against the code, not assumed — is published at /subprocessors.

• Expired sign-in/authentication artifacts (login and WebAuthn challenges, mobile sessions, invitations) and aged security-event records are removed once expired/consumed and past the applicable retention window — your organization’s configured window (30–3650 days) for records tied to an organization, or a shorter fixed floor for records not tied to one — via an explicit, operator-run cleanup job.
• The audit trail is append-only by design and is not deleted by that cleanup job — it is kept for the life of the account, as the accountability record the security posture described at /security depends on.
• On-device data (signing key, session) is removed when you sign out, remove the paired device, or uninstall the mobile app.

• Unpair or sign out of the NOA Trust mobile app at any time to stop receiving requests on that device.
• Access, export, or deletion requests — contact toratoraman@gmail.com. We action these subject to the audit-retention your organization has configured: tamper-evident audit and receipt records are retained for that period for security and compliance, then removed by the scheduled retention sweep.
• Enterprise customers needing a Data Processing Agreement should contact toratoraman@gmail.com.

NOA Trust — the console and the mobile app — is a workplace tool and is not directed to children under 13, or the equivalent minimum age in your country. We do not knowingly collect data from children.

Decisions are signed on-device and receipts are tamper-evident: a receipt changed after signing is detectable and reads as invalid, and the receipt chain is independently verifiable. A full public summary of the technical controls protecting this data — access control, tenant isolation, encryption, audit-trail integrity, and named gaps — is at /security. We deliberately do not claim any system is “tamper-proof”, “unhackable”, or “100% secure”. To report a vulnerability, see /.well-known/security.txt.

We may update this policy as the product changes. Material changes will be reflected on this page with a new “Last updated” date above.

Questions about this policy, or a data-protection request: toratoraman@gmail.com.