Non-Functional Requirements

Non-Functional Requirements (NFR): Drop — Fintech Payment App{{PROJECT_NAME}}

Project: Drop — Remittance + QR Payments{{PROJECT_NAME}} Version: 1.0{{VERSION}} Date: 2026-02-23{{DATE}} Author: John (AI Director){{AUTHOR}} Status: Draft | In Review | Approved Reviewers: Alem Bašić (CEO){{REVIEWERS}}

Document History

Version	Date	Author	Changes
0.1	2026-02-23{{DATE}}	John{{AUTHOR}}	Initial draft; targets from security audit + business casedraft

---

1. NFR Overview

Category	# Requirements	Highest Priority	Owner
Performance	6{{COUNT}}	Must Have{{HIGH/MED/LOW}}	John (Tech Lead)Lead
Scalability	4{{COUNT}}	Must Have	JohnTech Lead / DevOps
Availability	6{{COUNT}}	Must Have	John / DevOps
Security	12{{COUNT}}	Critical	JohnTech Lead + Security agent
Reliability	5{{COUNT}}	Must Have	JohnTech Lead / DevOps
Usability	5{{COUNT}}	Should Have	John (Designer)Designer
Compatibility	4{{COUNT}}	Must Have	JohnTech Lead
Maintainability	5{{COUNT}}	Should Have	JohnTech Lead
Compliance	8{{COUNT}}	Critical	JohnTech Lead + Legal
Data	5{{COUNT}}	Must Have	JohnTech Lead

---

2. Performance Requirements

ID	Requirement	Metric	Target	Measurement Conditions	Measurement Method	Priority
NFR-P01	Page load time (initial)	Time to Interactive	< 3 seconds	4G connection, cold cache	Lighthouse / WebPageTest	Must Have
NFR-P02	Page load time (subsequent)	Time to Interactive	< 1.5 seconds	Warm cache	Lighthouse	Must Have
NFR-P03	API response time (standard)	p95 response time	< 500ms	Normal load (200 concurrent{{CONCURRENT_USERS}} users)	APM tool / k6	Must Have
NFR-P03P04	API response time (bcryptcomplex operations)queries)	p95 response time	< 1,000ms2 seconds	Normal load	BenchmarkAPM teststool	MustShould Have
NFR-P04P05	Database query time	p95 query time	< 10ms (SELECT), < 20ms (INSERT)100ms	Normal load	api-benchmarks.test.tsDB monitoring	Must Have
NFR-P05P06	File upload throughput	Upload speed	{{SIZE}}MB in < {{TIME}}s	Single user	Load testing	{{PRIORITY}}
NFR-P07	Search response time	p95 response time	< 1 second	Normal load	APM tool	Should Have
NFR-P08	Report generation	Completion time	< {{TIME}} seconds	Normal load	APM tool	Could Have
NFR-P09	Core Web Vitals: LCP	Largest Contentful Paint	< 2.5 seconds	Mobile, 4G	Lighthouse	Must Have
NFR-P06P10	50Core concurrentWeb rateVitals: limit checksCLS	TotalCumulative timeLayout Shift	< 2,000ms total0.1	50Any concurrent callsdevice	api-benchmarks.test.tsLighthouse	ShouldMust Have

---

3. Scalability Requirements

PostgreSQL

ID	Requirement	Metric	MVPLaunch Target	Phase 212-Month Target	Measurement Method	Priority
NFR-S01	Concurrent users	ActiveSimultaneous active sessions	200{{X}} users (SQLite limit)	5,000+{{X}} users	Load testing (PostgreSQL)k6/JMeter)	Must Have
NFR-S02	Peak load handling	Requests per second	{{X}} RPS	{{X}} RPS	Load testing	Must Have
NFR-S02S03	Data volume growth	Database migrationsize triggergrowth	Concurrent users{{X}}GB/year	Migrate at 200 concurrent{{X}}GB/year	PostgreSQLStorage in Phase 2monitoring	Monitoring	MustShould Have
NFR-S03S04	API rate limits	Max requests per IPuser/hour	10{{X}} req/min (auth), 60 req/min (general)requests	Same{{X}} requests	RateAPI limitergateway configmetrics	Must Have
NFR-S04S05	File storage growth	Storage growth	DB size	< 1GB on Fly.io persistent volume	Managed{{X}}GB	{{X}}GB	Storage monitoring	Should Have
NFR-S06	Auto-scaling response	Time to scale out under load	< 2 minutes	< 2 minutes	Cloud console metrics	Should Have
NFR-S07	Geographic distribution	Regions supported	{{REGIONS}}	{{REGIONS}}	CDN configuration	{{PRIORITY}}

---

4. Availability Requirements

ID	Requirement	Target	Measurement Period	Exclusions	Priority
NFR-A01	System uptime SLA	≥ {{99.5%5 / 99.9}}%	Monthly rolling	Scheduled maintenance (advance notice)	Must Have
NFR-A02	Scheduled maintenance window	Max 4{{X}} hours/month	Monthly	Tue-Thu 02:00-06:00 CET preferred{{PREFERRED_WINDOW}}	Must Have
NFR-A03	Maintenance noticenotification lead time	≥ 2448 hours notice	Per event	Emergency patches: ASAP4 notifyhours	Must Have
NFR-A04	RPO (Recovery Point Objective)	Max 24{{X}} hours data loss	Per incident	Daily backup scheduleN/A	Must Have
NFR-A05	RTO (Recovery Time Objective)	System restored within 4{{X}} hours	Per incident	For staging; production target 2 hoursN/A	Must Have
NFR-A06	Database backup frequency	DailyEvery automated{{X}} backuphours	Ongoing	Fly.io persistent volumeN/A	Must Have
NFR-A07	Backup retention	{{X}} days rolling	Ongoing	N/A	Must Have
NFR-A08	Disaster recovery test	Pass DR drill	Annually	N/A	Should Have

SLA Calculation Reference:

Uptime %	Annual Downtime	Monthly Downtime
99.9%	8.7 hours	43.8 minutes
99.5%	43.8 hours	3.6 hours
99.0%	87.6 hours	7.3 hours

---

5. Security Requirements

Context: Drop is a fintech app handling real money flows. Security is Critical priority. See security/drop-security-rapport.md for full audit (score: 57/100 pre-Phase 0.5; target: 80/100 post-hardening).

ID	Requirement	Category	Target / Standard	Measurement Method	Priority
NFR-SEC01	Authentication method	Auth	JWT{{JWT/OAuth2/OIDC}} (jose+ library)MFA in httpOnly cookie; SameSite=Strict; 7-day expiryoptional	Code review + auditpentest	Must Have
NFR-SEC02	Password hashingpolicy	Auth	bcrypt,Min 128 rounds;chars, NO1 SHA-256uppercase, fallback1 number, 1 special	auth.test.tsAutomated test	Must Have
NFR-SEC03	JWTSession secretmanagement	SecretsAuth	JWT_SECRETTimeout: must30min beidle; setabsolute: via8 env var — fail fast if missinghours	CodeAutomated reviewtest	Must Have
NFR-SEC04	CSRFData protectionencryption in transit	InjectionEncryption	CSRFTLS middleware1.3 on all POST/PATCH/DELETE endpointsminimum	CodeSSL reviewLabs +scan test(grade A+)	Must Have
NFR-SEC05	RateData limitingencryption at rest	AbuseEncryption	10AES-256 req/minfor onPII; auth;database 60/min general; persistent (DB-backed, not in-memory)encryption	middleware.test.tsInfrastructure review	Must Have
NFR-SEC06	Input validation	Injection Prevention	All inputs sanitized server-side; parameterized SQL (no raw queries)queries	validation.test.tsCode review + SAST	Must Have
NFR-SEC07	XSS prevention	Injection Prevention	CSP headersheaders; (script-srcoutput 'self'); no dangerouslySetInnerHTMLencoding	OWASP ZAP / DAST	Must Have
NFR-SEC08	SecurityCSRF headersprotection	HTTPInjection Prevention	HSTS,CSRF X-Frame-Options:tokens DENY,on X-Content-Type-Options:all nosniff,state-changing CSPrequests	securityheaders.comCode review	Must Have
NFR-SEC09	CardRate datalimiting	PCI-DSSDDoS/Abuse	NEVERAPI: store{{X}} orreq/min returnper fullIP; cardlogin: number5 or CVV; only last_four + token_refattempts/15min	CodeLoad review + db.test.tstesting	Must Have
NFR-SEC10	Audit logging	Compliance	All auth events, transactions,data KYC changesmutations logged with user_id + IPuser + timestamp	CodeLog review	Must Have
NFR-SEC11	Per-userDependency transaction lockssecurity	FinancialSupply Chain	ConcurrentNo transactionsknown fromcritical sameCVEs userin serialised; no double-spenddependencies	IntegrationAutomated testscan (Snyk/Dependabot)	Must Have
NFR-SEC12	Secret management	Secrets	No secrets in code/git; use env vars or vault	Code scan + git history check	Must Have
NFR-SEC13	Role-based access control	Authorization	Principle of least privilege; no role escalation	Code review + penetration test	Must Have
NFR-SEC14	Security headers	HTTP Security	HSTS, X-Frame-Options, X-Content-Type-Options	securityheaders.com scan	Must Have
NFR-SEC15	Vulnerability scanning	Operations	Automated scan in CI; critical issues block deploy	CI pipeline	Should Have
NFR-SEC16	Penetration testing	Operations	ExternalAnnual external pentest before production launch	Third-party report	Should Have

---

6. Reliability Requirements

ID	Requirement	Metric	Target	Measurement Method	Priority
NFR-R01	Application error rate	5xx errors / total requests	< 0.1%	MonitoringAPM monitoring	Must Have
NFR-R02	TransactionClient-side integrityerror rate	AtomicJS transactionserrors per session	ACID< compliance;1% noof partial updatessessions	db.test.tsError tracking (Sentry)	MustShould Have
NFR-R03	MTTRMTBF (Mean Time Between Failures)	Average recoverytime timebetween incidents	<> 4{{X}} hoursdays	Incident logtracking	MustShould Have
NFR-R04	DataMTTR integrity(Mean Time To Recovery)	DatabaseAverage constraintstime to restore service	Zero< orphaned{{X}} records; FK constraints enabledhours	db.test.tsIncident tracking	Must Have
NFR-R05	Data integrity	Zero data corruption events	0 incidents	Database integrity checks	Must Have
NFR-R06	Transaction integrity	Atomic transactions	ACID compliance	Database tests	Must Have
NFR-R07	Graceful degradation	Partial failure handling	Non-critical features fail gracefully; core stays up	Chaos testing	Should Have
NFR-R08	Health check endpoint	System observabilityhealth observable	GET /api/health returns 200 withwhen DB statushealthy	CI smoke testsMonitoring	Must Have

---

7. Usability Requirements

ID	Requirement	Target	Measurement Method	Priority
NFR-U01	OnboardingTime completionto complete core task	New user completes onboarding (3 steps){{KEY_TASK}} in < 3{{X}} minutes	Usability testing	Must Have
NFR-U02	RemittanceError flow timerecovery	RegisteredUser usercan sendsrecover moneyfrom inany <error 2without minuteshelp	Usability testing	Must Have
NFR-U03	MobileWCAG responsivenesscompliance	FullyWCAG functional2.1 onLevel 375px–1440px (primary: 375-428px mobile)AA	ManualAutomated axe-core + automatedmanual review	Must Have
NFR-U04	ErrorKeyboard recoverynavigation	UserAll caninteractive recoverelements fromreachable anyby form error without page reloadkeyboard	Manual testing	Must Have
NFR-U05	LanguageScreen reader support	NorwegianCompatible (primary)with andNVDA English/ (secondary)VoiceOver	Manual testing	Should Have
NFR-U06	Mobile responsiveness	Fully functional on 375px–1440px width	Manual + automated	Must Have
NFR-U07	Color contrast	≥ 4.5:1 for normal text; ≥ 3:1 for large text	Contrast checker	Must Have
NFR-U08	Onboarding completion	{{X}}% of new users complete onboarding	Analytics	Should Have
NFR-U09	Help / documentation	All key features documented in-app or in help center	Content audit	Should Have

---

8. Compatibility Requirements

versioningMVP);semanticversioningin2

ID	Requirement	Category	Target	Priority
NFR-C01	Web browsers	Browser	Chrome 100+, Firefox 100+, Safari 16+, Edge 100+	Must Have
NFR-C02	Mobile browsers	Browser	Safari iOS 15+, Chrome Android 100+ (primary platform)	Must Have
NFR-C03	ScreenMobile resolutionsoperating systems	ResponsiveOS	375pxiOS (iPhone15+, SE)Android to 1440px (desktop); mobile-first11+	Must Have
NFR-C04	APIDesktop versioningoperating systems	OS	Windows 10+, macOS 12+, Ubuntu 20.04+	Must Have
NFR-C05	Screen resolutions	Responsive	375px to 2560px width	Must Have
NFR-C06	Minimum device specs	Performance	Works on mid-range 2020+ devices	Should Have
NFR-C07	Third-party integrations	API	Next.js{{EXTERNAL_SYSTEM}} API Routesversion (no{{VERSION}}	Must inHave
NFR-C08	Email Phaseclients	Email	Gmail, Outlook, Apple Mail, mobile clients	Should Have

---

9. Maintainability Requirements

in

ID	Requirement	Metric	Target	Measurement Method	Priority
NFR-M01	Test coverage	% of code covered by automated tests	≥ 80% overall; 100%≥ 95% for auth + transactioncritical paths	CI coverage (Vitest)report	Must Have
NFR-M02	CI/CDCode pipelinedocumentation	Deployment% frequencyof public APIs documented	Bug100% fixof topublic staging in < 30 minutes from mergeAPIs	GitHubCode Actionsreview	Must Have
NFR-M03	FeatureCyclomatic flagscomplexity	FeaturePer-function controlcomplexity	AllMax gated10 featuresper controllablefunction; viarefactor envif vars without redeployexceeded	feature-flags.test.tsStatic analysis (SonarQube)	Should Have
NFR-M04	DocumentationDependency currency	Doc% coverageof dependencies on current major version	All≥ API80% endpointscurrent; documented0 independencies docs/backend/API-REFERENCE.mdwith critical CVEs	DocAutomated reviewscan	Should Have
NFR-M05	DependencyDeployment currencyfrequency	CVETime exposureto deploy a bug fix to production	0< critical1 CVEshour infrom production dependenciesmerge	npmCI/CD auditmetrics	Should CIHave
NFR-M06	Feature flag support	Ability to disable features without deploy	Available for all major features	Code review	Could Have
NFR-M07	Logging completeness	Log coverage for operations	All external calls, errors, and user mutations logged	Log review	Must Have
NFR-M08	Monitoring observability	Dashboards for key metrics	Dashboards for error rate, response time, uptime	Monitoring tool	Must Have

---

10. Compliance Requirements

ID	Regulation	Applicability	Requirement	Technical Implementation	Priority
NFR-COMP01	GDPR (EU)	Yes{{YES — Norwegianif usershandling EU personal data}}	Lawful basis;basis for processing; right to deletion; DPA with BaaS; 72hrequired; breach notification within 72h	DataUser data deletion API; audit logs; DPA contractin place	Must Have
NFR-COMP02	GDPR — Cookie consent	{{YES — if using tracking cookies}}	Explicit consent before non-essential cookies	Cookie consent banner; opt-in only tracking	Must Have
NFR-COMP03	GDPR — Data minimisationminimization	Yes	Collect only data necessary for stated purpose	BA review of DBdata schema	Must Have
NFR-COMP03	PSD2 (EU)	Yes — payment initiation	PISP/AISP registration with Finanstilsynet; or operate under bank partner licence	Finanstilsynet registrationmodel	Must Have
NFR-COMP04	AML / AMLD6{{HIPAA}}	Yes{{YES/NO — moneyhealthcare transferdata}}	KYCPHI verificationprotection; beforeaudit transaction;logs; transactionBAA monitoring; SAR capabilityrequired	SumsubRole-based integration;access; monitoringencrypted alertsPHI fields	Must Have{{PRIORITY}}
NFR-COMP05	{{PCI-DSSDSS}}	Partial{{YES/NO (cards— feature)payment card data}}	NoSAQ compliance; tokenization; no card number/CVV storage; tokenisation onlystorage	last_fourStripe/payment +gateway token_ref only; tokenisation via partnertokenization	Must Have{{PRIORITY}}
NFR-COMP06	DORA (EU)	Yes	ICT risk management; incident reporting framework	Incident report template; business continuity	Should Have
NFR-COMP07	Norwegian Personvernloven	Yes{{YES}}	NationalAlignment with GDPR implementation;national same requirementsimplementation	Legal review	Must Have
NFR-COMP08COMP07	FinancialWCAG licence2.1 disclaimerAA	Yes{{YES}}	NEVERDigital use "banking" without licence disclaimer in UIaccessibility	UINFR-U01 copyto review; /learning-opportunity on violationsNFR-U07	Must Have

---

11. Data Requirements

endpoint

ID	Requirement	Category	Target	Implementation	Priority
NFR-D01	Data retention — user data	Retention	User{{X}} datayears active; deleted within 30 days of account deletion request	Scheduled deletion job (GDPR Art.17)	Must Have
NFR-D02	Data retention — audit logs	Retention	Application logs: 90 days; Audit logs: 53 years (AML requirement)	Log rotation policy	Must Have
NFR-D03	PIIDatabase fieldbackup documentationfrequency	PrivacyBackup	AllFull PIIbackup fieldsdaily; identifiedtransaction inlogs DATABASE-SCHEMA.mdevery {{X}} hours	DataAutomated dictionarybackup in docs/backend/schedule	Must Have
NFR-D04	DataBackup anonymisation (non-prod)encryption	PrivacyBackup	NoBackups realencrypted userwith data in staging/dev environmentsAES-256	SeedInfrastructure data only; no prod data migrationconfig	Must Have
NFR-D05	GDPRData dataintegrity checks	Integrity	Database constraints; no orphaned records	DB schema + integration tests	Must Have
NFR-D06	PII identification	Privacy	All PII fields identified and documented	Data dictionary	Must Have
NFR-D07	Data export	Portability	User can export their data in machine-readable format (GDPR Art.Article 20)	Export API endpoint	Must Have
NFR-D08	Data exportanonymization	Privacy	Anonymize user data in non-production environments	Dev/staging data scripts	Must Have
NFR-D09	Archival strategy	Retention	Data older than {{X}} years archived to cold storage	Archive schedule	Should Have

---

12. NFR Testing & Verification Plan

NFR Category	Testing Method	Tools	Frequency	Pass Criteria
Performance	Benchmark tests + loadLoad testing	api-benchmarks.test.ts,k6, JMeter, Lighthouse	Per sprintPre-launch + pre-launchmonthly	All NFR-P targets met
Scalability	Stress testing	k6	Pre-launch	System gracefully handles 2× peak load
Security	Security auditSAST + automatedDAST tests+ Pentest	validation.test.ts,Snyk, OWASP ZAP, external pentest	CI (SAST), Pre-launch (DAST+Pentest), Annual	No critical/high vulnerabilities unresolved
Accessibility	Automated + manual	axe-core, manual screen reader	Per sprint + pre-launch	ScoreWCAG ≥2.1 80/100; no critical openAA
Availability	UptimeMonitoring monitoring+ DR drill	Fly.ioUptime metrics, health endpointmonitor	Ongoing + annual	≥SLA 99.5%targets monthlymet
Compliance	Legal review + audit	Manual + Sumsubautomated	Pre-launch + annual	All compliance items verified
Reliability	Unit + integration tests	Vitest (db.test.ts)	Per commit	Zero failed integrity tests

---

Approval

(AI)

Role	Name	Date	Signature
Author	John (AI Director)	2026-02-23	Approved
Reviewer
Tech Lead	John	2026-02-23	Approved
Business Analyst
Product Owner
AI Director (John)	John	2026-02-23	Approved
CEOClient (Alem)Representative	Alem Bašić	TBD