NOA’s security posture, stated plainly — what ships today, what’s a documented procedure, and what’s a named gap.

4 roles (internal_admin, org_admin, approver, auditor) and 43 permissions, enumerated as data rather than scattered across `if` statements, enforced at every console route before the route body runs.

Postgres Row-Level Security enforced at the database ROLE level, not only in application `WHERE` filters — a dedicated non-superuser, non-BYPASSRLS role is SET LOCAL ROLE’d per transaction so RLS actually engages even though the platform’s own default connection is a superuser. The readiness check fails closed (503) if the effective role could still bypass RLS.

WebAuthn/passkey re-authentication required before sensitive mutations (audit export, key rotation, trust-root management, device pairing), with a 10-minute freshness window.

OIDC (PKCE + nonce + state) and SAML (signature-verified, replay-cached).

SCIM v2, bearer-token authenticated and tenant-scoped, with deprovision-cascade. The bearer token is itself revocable.

Append-only audit events, each linking to the previous event’s hash (sha256 of a canonical JSON form). A step-up-gated export includes the console’s own recomputed chain-verification result alongside the data, so a buyer’s auditor can re-derive the same check independently instead of trusting our attestation.

Each chain’s head can be signed with an Ed25519 key held outside the database (optionally timestamped by an external RFC 3161 authority) and streamed to a customer’s own SIEM as NDJSON. This makes a later rewrite of an earlier event detectable to anyone holding a copy of the anchor — it does not by itself prevent a rewrite by an actor who holds both the database and the signing key. Inert until an operator configures a signing key; never fabricates an anchor and never exits silently as if it had.

One verified evidence bundle at a time, streamed as its canonical bytes so `sha256(exported file)` matches a response header — no re-derivation trust required on the reader’s side.

The canonical Node (node:crypto) Ed25519 verifier vs. the browser-swap module (@noble/curves) this site’s own /playground uses, checked against 6 adversarial vector classes (cofactor-malleated signatures, small-order keys, out-of-range scalars, non-canonical encodings, loose base64 decoding, cross-implementation). Re-runnable yourself.

The email is stored only as a keyed hash; the login link token and session bearer are stored as sha256 hashes compared in constant time; the session subject is an opaque internal user id, never the email.

The human-readable approval-hold display is HPKE-encrypted to the approver device’s own key before it reaches the relay; the relay’s storage columns hold only ciphertext, encapsulated key, and AAD — no plaintext display column exists.

A first (and currently only) consumer of each organization’s configured retention window: purges expired auth artifacts and aged security events on an explicit --apply run (dry-run is the default). Deliberately does not touch the append-only audit chain itself.

RFC 9116 security.txt, machine-readable, at the standard well-known path.

Idempotent, checksum-tracked Postgres migrations, run against a real PG16 instance in CI before merge.

A restore-drill procedure — dump production, restore into an isolated throwaway Postgres, then verify migration-ledger checksums, row counts against source, audit-chain continuity, and tenant RLS negative tests — first EXECUTED 2026-07-21: the production dump restored cleanly, all 24 applied migration checksums matched the repository with zero drift, the restored row counts matched source, and tenant RLS isolation held on the restored copy.

Named alert conditions are documented (readiness failures, 5xx rate, login denial/rate-limit events, RLS errors, audit-chain conflicts, SCIM failures). No fully automated alerting pipeline runs today; the SIEM export above gives an operator-configured path to feed a customer’s own monitoring stack.