Non-Functional Requirements

Non-Functional Requirements (NFR): Bilko{{PROJECT_NAME}}

Project: Bilko — Balkan Accounting SaaS{{PROJECT_NAME}} Version: 1.0{{VERSION}} Date: 2026-02-25{{DATE}} Author: John (AI Director){{AUTHOR}} Status: FinalDraft | In Review | Approved Reviewers: Alem Bašić (CEO){{REVIEWERS}}

Document History

Version	Date	Author	Changes
0.1	2026-02-23{{DATE}}	John (AI Director){{AUTHOR}}	Initial draft — Phase 1 Serbia MVP
1.0	2026-02-25	John (AI Director)	Finalized for v1.0 release

---

1. NFR Overview

Category	# Requirements	Highest Priority	Owner
Performance	8{{COUNT}}	Critical{{HIGH/MED/LOW}}	JohnTech Lead
Scalability	5{{COUNT}}	High	JohnTech Lead / DevOps agent
Availability	6{{COUNT}}	Critical	John / DevOps agent
Security	10{{COUNT}}	Critical	JohnTech Lead + Security
Reliability	6{{COUNT}}	Critical	JohnTech Lead / DevOps
Usability	7{{COUNT}}	High	John / Designer
Compatibility	6{{COUNT}}	High	JohnTech Lead
Maintainability	6{{COUNT}}	Medium	JohnTech Lead
Compliance	8{{COUNT}}	Critical	JohnTech Lead + AsmirLegal
Data	8{{COUNT}}	Critical	JohnTech Lead

---

2. Performance Requirements

ID	Requirement	Metric	Target	Measurement Conditions	Measurement Method	Priority
NFR-P01	Dashboard pagePage load time (initial)	Time to Interactive	< 3 seconds	4G connection, cold cache	Lighthouse / WebPageTest	Must Have
NFR-P02	Dashboard pagePage load time (subsequent)	Time to Interactive	< 11.5 secondseconds	Warm cache, average devicecache	Lighthouse	Must Have
NFR-P03	InvoiceAPI creationresponse wizardtime navigation(standard)	Timep95 perresponse steptime	< 500ms	AnyNormal device,load warm({{CONCURRENT_USERS}} cacheusers)	LighthouseAPM tool / k6	Must Have
NFR-P04	API response time (standardcomplex CRUD)	p95 response time	< 300ms	≤ 1000 concurrent users	APM tool / k6	Must Have
NFR-P05	API response time (reports)queries)	p95 response time	< 2 seconds	≤Normal 1000 concurrent orgsload	APM tool	Should Have
NFR-P05	Database query time	p95 query time	< 100ms	Normal load	DB monitoring	Must Have
NFR-P06	SEFFile submissionupload responsethroughput	End-to-endUpload latencyspeed	{{SIZE}}MB in < 30 seconds{{TIME}}s	SEFSingle APIuser	Load testing	{{PRIORITY}}
NFR-P07	Search response time	APIp95 monitoringresponse time	Must< 1 second	Normal load	APM tool	Should Have
NFR-P07P08	Report generation	Completion time	< {{TIME}} seconds	Normal load	APM tool	Could Have
NFR-P09	Core Web Vitals: LCP	Largest Contentful Paint	< 2.5 seconds	Mobile, 4G	Lighthouse	Must Have
NFR-P08P10	Core Web Vitals: CLS	Cumulative Layout Shift	< 0.1	Any device	Lighthouse	Must Have

---

3. Scalability Requirements

ID	Requirement	Metric	Launch Target	12-Month Target	Measurement Method	Priority
NFR-S01	Concurrent organizationsusers	ActiveSimultaneous organizationsactive sessions	1,000{{X}} users	10,000{{X}} users	Load testing (k6)k6/JMeter)	Must Have
NFR-S02	ConcurrentPeak userload sessionshandling	SimultaneousRequests sessionsper second	500{{X}} RPS	5,000{{X}} RPS	Load testing	Must Have
NFR-S03	API throughput	Requests per second	200 RPS	2,000 RPS	k6 load test	Must Have
NFR-S04	Data volume per organizationgrowth	TransactionsDatabase persize org/growth	{{X}}GB/year	50,000	200,000{{X}}GB/year	Storage + query monitoring	Should Have
NFR-S04	API rate limits	Max requests per user/hour	{{X}} requests	{{X}} requests	API gateway metrics	Must Have
NFR-S05	File storage growth	Storage volume	{{X}}GB	{{X}}GB	Storage monitoring	Should Have
NFR-S06	Auto-scaling response	Time to addscale newout instanceunder load	< 32 minutes	< 32 minutes	Cloud console metrics	Should Have
NFR-S07	Geographic distribution	Regions supported	{{REGIONS}}	{{REGIONS}}	CDN configuration	{{PRIORITY}}

---

4. Availability Requirements

ID	Requirement	Target	Measurement Period	Exclusions	Priority
NFR-A01	System uptime SLA	≥ {{99.9%5 / 99.9}}%	Monthly rolling	Scheduled maintenance windows	Must Have
NFR-A02	Scheduled maintenance window	Max 2{{X}} hours/month	Monthly	Preferred: Sunday 02:00-04:00 CET{{PREFERRED_WINDOW}}	Must Have
NFR-A03	Maintenance notification lead time	≥ 48 hours notice	Per event	Emergency patches: 4 hours	Must Have
NFR-A04	RPO (Recovery Point Objective)	Max 1{{X}} hourhours data loss	Per incident	N/A	Must Have
NFR-A05	RTO (Recovery Time Objective)	System restored within 4{{X}} hours	Per incident	N/A	Must Have
NFR-A06	Database backup frequency	DailyEvery full{{X}} + hourly transaction loghours	Ongoing	N/A	Must Have
NFR-A07	Backup retention	{{X}} days rolling	Ongoing	N/A	Must Have
NFR-A08	Disaster recovery test	Pass DR drill	Annually	N/A	Should Have

SLA Calculation Reference:

Uptime %	Annual Downtime	Monthly Downtime
99.9%	8.7 hours	43.8 minutes
99.5%	43.8 hours	3.6 hours
99.0%	87.6 hours	7.3 hours

---

5. Security Requirements

via npminCI

ID	Requirement	Category	Target / Standard	Measurement Method	Priority
NFR-SEC01	Authentication method	Auth	JWT (access: 15min TTL){{JWT/OAuth2/OIDC}} + refreshMFA token (30d rolling TTL); bcrypt password hashing (cost factor ≥ 12)optional	Code review + pentest	Must Have
NFR-SEC02	Password policy	Auth	Min 8 chars, 1 uppercase, 1 number, 1 special character	Automated test	Must Have
NFR-SEC03	AccountSession lockoutmanagement	Auth	5Timeout: failed30min attemptsidle; →absolute: 15-min8 lockout; logged in LoggedActionhours	Automated test	Must Have
NFR-SEC04	Data encryption in transit	Encryption	TLS 1.3 minimum; HTTP → HTTPS redirect enforcedminimum	SSL Labs scan (grade A+)	Must Have
NFR-SEC05	Data encryption at rest	Encryption	Database encryption at rest (cloud provider); bcryptAES-256 for passwordsPII; database encryption	Infrastructure review	Must Have
NFR-SEC06	Input validation	Injection Prevention	All inputs sanitized server-side with Zod;side; parameterized queries via Prisma	Code review + SAST	Must Have
NFR-SEC07	XSS prevention	Injection Prevention	React default encoding + CSP headers; nooutput dangerouslySetInnerHTMLencoding	OWASP ZAP / code reviewDAST	Must Have
NFR-SEC08	RateCSRF limitingprotection	DDoS/AbuseInjection Prevention	AuthCSRF endpoints:tokens 5on req/min;all Generalstate-changing API: 100 req/min per IPrequests	LoadCode test + monitoringreview	Must Have
NFR-SEC09	Rate limiting	DDoS/Abuse	API: {{X}} req/min per IP; login: 5 attempts/15min	Load testing	Must Have
NFR-SEC10	Audit logging	Compliance	All auth events, financialdata mutations logged in LoggedAction (append-only) with user ID + timestamp	Log review	Must Have
NFR-SEC10SEC11	OrganizationDependency data isolationsecurity	Multi-tenancySupply Chain	AllNo databaseknown queriescritical scopedCVEs toin organizationIddependencies	Automated middleware;scan (Snyk/Dependabot)	Must Have
NFR-SEC12	Secret management	Secrets	No secrets in code/git; use env vars or vault	Code scan + git history check	Must Have
NFR-SEC13	Role-based access control	Authorization	Principle of least privilege; no cross-tenantrole queriesescalation	Code review + penetration test	Must Have
NFR-SEC11SEC14	Security headers	HTTP Security	HSTS, X-Frame-Options: DENY,Options, X-Content-Type-Options: nosniff, CSPOptions	securityheaders.com scan	Must Have
NFR-SEC12SEC15	DependencyVulnerability securityscanning	Supply ChainOperations	No known critical CVEs; automatedAutomated scan in CICI; critical issues block deploy	SnykCI /pipeline	Should auditHave
NFR-SEC16	Penetration testing	Operations	Annual external pentest	Third-party report	Should Have

---

6. Reliability Requirements

ID	Requirement	Metric	Target	Measurement Method	Priority
NFR-R01	Application error rate	5xx errors / total requests	< 0.1%	APM monitoring	Must Have
NFR-R02	ACIDClient-side complianceerror rate	TransactionJS integrityerrors per session	100%< —1% allof financial transactions ACID-compliantsessions	PostgreSQLError guaranteestracking + DB tests(Sentry)	MustShould Have
NFR-R03	Double-entryMTBF balance(Mean integrityTime Between Failures)	DebitAverage =time Creditbetween for all transactionsincidents	Zero> imbalance{{X}} eventsdays	CIIncident test: balance check on all transactionstracking	MustShould Have
NFR-R04	SEFMTTR queue(Mean reliabilityTime To Recovery)	FailedAverage SEFtime submissionsto retriedrestore service	Max< 3{{X}} retries; success on retry > 99% for transient failureshours	SEFIncident monitoringtracking	Must Have
NFR-R05	Data integrity	Zero data corruption events	0 corruption events per 12 monthsincidents	Database integrity checks	Must Have
NFR-R06	Transaction integrity	Atomic transactions	ACID compliance	Database tests	Must Have
NFR-R07	Graceful degradation	Partial failure handling	Non-critical features fail gracefully; core stays up	Chaos testing	Should Have
NFR-R08	Health check endpoint	System health observable	/api/health returns 200 when healthy	Uptime monitoringMonitoring	Must Have

---

7. Usability Requirements

ID	Requirement	Target	Measurement Method	Priority
NFR-U01	Time to createcomplete firstcore invoicetask	New user createscompletes first invoice{{KEY_TASK}} in < 10{{X}} minutes	Beta userUsability testing	Must Have
NFR-U02	InvoiceError wizard completion raterecovery	≥User 85%can ofrecover usersfrom whoany starterror wizardwithout complete ithelp	AnalyticsUsability (funnel)testing	Must Have
NFR-U03	WCAG compliance	WCAG 2.1 Level AA	Automated axe-core automated + manual review	Must Have
NFR-U04	Keyboard navigation	All interactive elements reachable by keyboard	Manual testing	Must Have
NFR-U05	Screen reader support	Compatible with NVDA / VoiceOver	Manual testing	Should Have
NFR-U06	Mobile responsiveness	Fully functional on 375px–1440px viewportwidth	Manual + Lighthouse	Must Have
NFR-U06	Language: Serbian	Full UI in Serbian (Latin script) for Phase 1; Cyrillic toggle	Manual review by native speakerautomated	Must Have
NFR-U07	ErrorColor messagescontrast	≥ 4.5:1 for normal text; ≥ 3:1 for large text	Contrast checker	Must Have
NFR-U08	Onboarding completion	{{X}}% of new users complete onboarding	Analytics	Should Have
NFR-U09	Help / documentation	All errorskey features documented in-app or in Serbianhelp language; actionable advice includedcenter	Content audit	MustShould Have

---

8. Compatibility Requirements

UniCredit,BancaIntesa

ID	Requirement	Category	Target	Priority
NFR-C01	Web browsers (desktop)	Browser	Chrome 100+, Firefox 100+, Safari 16+, Edge 100+	Must Have
NFR-C02	WebMobile browsers (mobile)	Browser	Safari iOS 15+, Chrome Android 100+	Must Have
NFR-C03	Mobile operating systems	OS	iOS 15+, Android 11+	Must Have
NFR-C04	ScreenDesktop resolutionsoperating systems	ResponsiveOS	375pxWindows to10+, 2560pxmacOS viewport12+, widthUbuntu 20.04+	Must Have
NFR-C05	SEFScreen API compatibilityresolutions	External APIResponsive	SEF375px APIto v12560px (UBL 2.1 XML, REST)width	Must Have
NFR-C06	BankMinimum CSVdevice formatsspecs	ImportPerformance	SerbianWorks bankon CSVmid-range formats:2020+ Raiffeisen,devices	Should OTP,Have
NFR-C07	Third-party integrations	API	{{EXTERNAL_SYSTEM}} API version {{VERSION}}	Must Have
NFR-C08	Email clients	Email	Gmail, Outlook, Apple Mail, mobile clients	Should Have

---

9. Maintainability Requirements

for forerrorrate,

ID	Requirement	Metric	Target	Measurement Method	Priority
NFR-M01	Test coverage (backend)	% of code covered by automated tests	≥ 80% overall; ≥ 95% for financialcritical logic (double-entry, VAT, SEF)paths	CI coverage report	Must Have
NFR-M02	TypeScriptCode strict modedocumentation	Type% safetyof public APIs documented	strict:100% trueof inpublic tsconfig for all packagesAPIs	CICode type-checkreview	Must Have
NFR-M03	Cyclomatic complexity	Per-function complexity	Max 10 per function; refactor if exceeded	Static analysis (SonarQube)	Should Have
NFR-M04	Dependency currency	% of dependencies on current major version	≥ 80% current; 0 dependencies with critical CVEs	Automated scan	Should Have
NFR-M05	Deployment frequency	Time to deploy a bug fix to production	< 1 hour from PR merge	CI/CD metrics	Should Have
NFR-M04M06	DatabaseFeature migrationsflag support	SchemaAbility changeto processdisable features without deploy	Available for all major features	Code review	Could Have
NFR-M07	Logging completeness	Log coverage for operations	All changesexternal viacalls, Prismaerrors, migration;and neveruser editmutations existing migrationlogged	CodeLog review	Must Have
NFR-M05M08	MonorepoMonitoring build timeobservability	TurborepoDashboards build	Full build < 3 minutes; incremental < 30 seconds	CIkey metrics	ShouldDashboards Have
NFR-M06response time, uptime	LoggingMonitoring completeness	Log coverage	All external API calls (SEF, email, FX), all errors, all financial mutations logged	Log reviewtool	Must Have

---

10. Compliance Requirements

ID	Regulation	Applicability	Requirement	Technical Implementation	Priority
NFR-COMP01	Zakon o elektronskom fakturisanju (Serbia)GDPR	Yes{{YES — mandatoryif B2Bhandling 2023EU personal data}}	SubmitLawful e-invoicesbasis for processing; right to SEFdeletion; DPA required; breach notification within 72h	User data deletion API; audit logs; DPA in UBL 2.1; sequential numbering; digital signature	SefService module; UBL 2.1 XML generationplace	Must Have
NFR-COMP02	ZakonGDPR o— PDVCookie (Serbia)consent	Yes{{YES — allif VAT-registeredusing orgstracking cookies}}	20%Explicit standard,consent 10%before reducednon-essential PDV; monthly filing by 15th; PDV report format for ePorezicookies	PDVCookie calculationconsent engine;banner; reportopt-in exportonly tracking	Must Have
NFR-COMP03	Zakon o računovodstvu (Serbia)	Yes	Double-entry; 10-year document retention; annual balance sheet; audit trail	LoggedAction (append-only); DB retention policy	Must Have
NFR-COMP04	GDPR (EU / Norwegian Personvernloven)	Yes — ALAI Holding AS is Norwegian; processes EU citizen data	Lawful basis for processing; right to deletion within 30 days; DPA in place; breach notification within 72h; data export (Article 20)	User data deletion API; audit logs; DPA	Must Have
NFR-COMP05	GDPR — Data minimization	Yes	Collect only data necessary for accountingstated functionpurpose	BA review of data model; field-level PII auditmodel	Must Have
NFR-COMP04	{{HIPAA}}	{{YES/NO — healthcare data}}	PHI protection; audit logs; BAA required	Role-based access; encrypted PHI fields	{{PRIORITY}}
NFR-COMP05	{{PCI-DSS}}	{{YES/NO — payment card data}}	SAQ compliance; tokenization; no card storage	Stripe/payment gateway tokenization	{{PRIORITY}}
NFR-COMP06	GDPRNorwegian — Cookie consentPersonvernloven	Yes — if tracking cookies used{{YES}}	ExplicitAlignment consentwith beforeGDPR non-essentialnational cookiesimplementation	CookieLegal consent banner; opt-in only analyticsreview	Must Have
NFR-COMP07	Multi-tenancy data isolation	Yes — SaaS requirement	Organization data strictly scoped; no cross-tenant access	organizationId middleware + DB constraint	Must Have
NFR-COMP08	WCAG 2.1 AA	Yes — accessibility standard{{YES}}	Digital accessibility for all users	NFR-U03,U01 to NFR-U04U07	Must Have

---

11. Data Requirements

inprovider

ID	Requirement	Category	Target	Implementation	Priority
NFR-D01	MonetaryData precisionretention — user data	Data typeRetention	ALL{{X}} monetaryyears fields:active; NUMERIC(19,4)deleted —within NEVER30 float,days NEVERof JavaScriptaccount numberdeletion request	PrismaScheduled schema:deletion Decimal type enforcedjob	Must Have
NFR-D02	Data retention — financial records	Retention	10 years minimum (Serbia); 11 years (Croatia)	Retention policy in DB; no auto-delete of financial records	Must Have
NFR-D03	Data retention — logs	Retention	Application logs: 90 days; Audit logslogs: (LoggedAction):3 retain permanentlyyears	Log rotation + LoggedAction never purgedpolicy	Must Have
NFR-D04D03	Database backup frequency	Backup	Full backup daily; transaction logs every 1{{X}} hourhours	Automated backup schedule	Must cloudHave
NFR-D04	Backup encryption	Backup	Backups encrypted with AES-256	Infrastructure config	Must Have
NFR-D05	BackupData encryptionintegrity checks	BackupIntegrity	BackupsDatabase encryptedconstraints; atno restorphaned (AES-256)records	CloudDB providerschema encryption+ integration tests	Must Have
NFR-D06	PII identification	Privacy	All PII fields documented;identified userand email, name, tax ID (PIB) identifieddocumented	Data dictionary + Prisma annotations	Must Have
NFR-D07	Data export (portability)	Portability	User can export all organizationtheir data (invoices, expenses, transactions, contacts) in JSON/CSVmachine-readable format (GDPR Article 20)	Export API endpoint	Must Have
NFR-D08	ExchangeData rate immutabilityanonymization	IntegrityPrivacy	ExchangeAnonymize rateuser lockeddata atin transactionnon-production date; cannot be retroactively editedenvironments	DBDev/staging constraintdata + LoggedAction on change attemptscripts	Must Have
NFR-D09	Archival strategy	Retention	Data older than {{X}} years archived to cold storage	Archive schedule	Should Have

---

12. NFR Testing & Verification Plan

NFR Category	Testing Method	Tools	Frequency	Pass Criteria
Performance	LighthouseLoad + k6 load testtesting	Lighthouse,k6, k6JMeter, Lighthouse	Pre-launch + monthly	All NFR-P targets met at normal load
Scalability	k6Stress stress test (2× normal load)testing	k6	Pre-launch	GracefulSystem degradation;gracefully nohandles data2× corruptionpeak under stressload
Security	SAST + OWASP ZAPDAST + manual code reviewPentest	Snyk, OWASP ZAPZAP, external pentest	CI (SAST), Pre-launch (DAST)DAST+Pentest), Annual	No critical/high vulnerabilities unresolved vulnerabilities
Compliance (SEF)	SEF sandbox end-to-end test	SEF sandbox API	Pre-launch	100% invoice submission success in sandbox
Compliance (PDV)	Manual accounting verification + test data	Test data set	Pre-launch + each PDV change	PDV calculations match expected values for 20 test cases
Compliance (GDPR)	Manual review + deletion test	Manual	Pre-launch + annual	Right to deletion completes within 30 days; export works
Accessibility	axe-coreAutomated + keyboard manual test	axe-corecore, manual screen reader	Per sprint	WCAG 2.1 AA — 0 critical violations
Availability	Uptime monitoringMonitoring + DR drill	Uptime monitor	Ongoing + quarterlyannual	SLA ≥targets 99.9% monthlymet
Data integrityCompliance	DBLegal constraint testsreview + balance check in CIaudit	PrismaManual + custom testsautomated	CIPre-launch (every+ PR)annual	0All debit/creditcompliance imbalances;items 0 NUMERIC precision errorsverified

---

Approval

Role	Name	Date	Signature
Author	John (AI Director)	2026-02-23
Reviewer
Tech Lead	John	2026-02-23
Business Analyst	John	2026-02-23
Product Owner	John	2026-02-23
AI Director (John)	John	2026-02-23
CEOClient (Alem)Representative	Alem Bašić