Session & Device Security
Authenticated sessions are required today. Production device binding, trusted-device history, remote revocation and stronger step-up controls remain gated.
N
NoopalMoney Security
Trust · privacy · financial controls
Security Center
Protect the account. Protect the money.
NoopalMoney is being designed with financial controls, server-side authorization, balance privacy, separation of duties, device security, notification controls, audit, reconciliation and production gates built into the platform from the beginning.
Controlled pilot: this page distinguishes what is implemented for the pilot, what is implemented only as a production foundation, and what remains gated. It does not claim that every production control, certification or regulatory approval is complete.
Balance Privacy
Hide/show balance is standard across Personal and Business wallets and changes only the display, never the authoritative ledger balance.
MFA & Step-Up
Production contracts now require multi-factor authentication and transaction step-up authentication before sensitive financial actions can be enabled.
Maker · Checker · Approver
Payroll and governed business payments use separation of duties and approval limits rather than single-user execution.
Ledger & Reconciliation
A durable double-entry ledger schema, immutable posted-entry rules and provider reconciliation model are implemented as foundations but are not yet connected to real funds.
Fraud & Device Risk
Velocity controls, device changes, unusual activity, beneficiary risk, suspicious QR use and case management are required before production money movement.
Notifications & Security Alerts
Money received/sent, failed payments, approvals, payroll, settlement, verification and security-alert preferences are defined. Push, email and SMS delivery remain disabled in the pilot.
Receipt Integrity
A payment cannot produce an official success receipt until the transaction is Completed with authoritative ledger evidence, verified provider acknowledgement and reconciliation.
KYC / KYB
Identity and business verification will use approved providers and documented review controls. Pilot onboarding never makes a verification decision.
Audit & Evidence
Authentication events, financial approvals, provider actions and sensitive administrative changes are designed to produce append-only or immutable evidence.
Account Recovery
Production recovery must use verified identity, device/session controls and an auditable support process rather than bypassing account security.
Production Gate
No real-money activation until partner, compliance, security, reconciliation, operational and executive release conditions are satisfied.
Launch security readiness
Red design + balance privacy + authenticated pilot
Current controlled-product safeguards.
PILOT READYCurrent controlled-product safeguards.
Mobile/Web authorization boundary
Authenticated API and fail-closed production flags.
PILOT READYAuthenticated API and fail-closed production flags.
Durable ledger/security database schemas
Double-entry, device, auth-event and notification evidence structures exist but are not yet connected to production data.
FOUNDATIONDouble-entry, device, auth-event and notification evidence structures exist but are not yet connected to production data.
Receipt integrity contract
Official receipt requires Completed state, ledger evidence, provider acknowledgement and reconciliation.
FOUNDATIONOfficial receipt requires Completed state, ledger evidence, provider acknowledgement and reconciliation.
Production MFA + transaction step-up
Required contract exists; production factor enrollment and provider-backed enforcement remain disabled.
GATEDRequired contract exists; production factor enrollment and provider-backed enforcement remain disabled.
Device binding + remote revocation
Data model and preview contract exist; trusted-device production controls are not active.
GATEDData model and preview contract exist; trusted-device production controls are not active.
Push / email / SMS security delivery
Event catalog and preferences exist; delivery providers are not connected.
GATEDEvent catalog and preferences exist; delivery providers are not connected.
Approved KYC/KYB and AML integrations
Provider selection, retention, consent, screening and operations.
GATEDProvider selection, retention, consent, screening and operations.
Real bank/mobile-money rails and safeguarding
Commercial, technical and regulatory partner arrangements.
GATEDCommercial, technical and regulatory partner arrangements.
Penetration test and zero unresolved Critical/High findings
Required before production release.
PLANNEDRequired before production release.
Incident response, monitoring, backup and recovery drills
Operational resilience before launch.
PLANNEDOperational resilience before launch.