> For the complete documentation index, see [llms.txt](https://docs.noon.capital/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.noon.capital/5.-the-security-framework/world-class-operational-security.md).

# World-Class Operational Security

Smart contracts can be perfect while the organization around them leaks. How Noon secures the humans, machines, and processes that manage the protocol.

## <mark style="color:$success;background-color:$success;">**Prevent**</mark>

Smart contract audits answer a critical question about code integrity, but they cannot evaluate human operations. How are signing keys stored? What prevents key compromise, phishing, or insider threats? How are transactions verified before execution?

For a protocol managing institutional reserves, operational security (OpSec) is a continuous discipline. <mark style="color:purple;">**Noon**</mark> maintains a comprehensive Operational Security Policy, reviewed quarterly and updated after any material infrastructure change. This page details the signing mechanics, key management controls, transaction workflows, and SEAL Framework evaluations that protect <mark style="color:purple;">**Noon**</mark>’s off-chain infrastructure.

<figure><img src="https://3816918787-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FL26rQzcNmiUZrCXkxkjS%2Fuploads%2FunYvrQW8WITyXAokJEcG%2FOpSecMatrix.png?alt=media&amp;token=b716b6cb-c516-476b-963c-2357a8c519c5" alt=""><figcaption></figcaption></figure>

## <mark style="color:$primary;">1. Segregated Signing Systems</mark>

<mark style="color:purple;">**Noon**</mark> runs two strictly isolated signing architectures. To eliminate single-system reliance, no single device or credential set can sign across both systems:

* **Signing System 1 (Infrastructure & Technical Operations):** Controls smart contract upgrades, protocol timelocks, emergency circuit breakers, whitelist parameters, mint/redemption caps, and oracle management.
* **Signing System 2 (Treasury & Strategy Management):** Controls fund movements, strategy rebalancing, yield harvesting, and treasury transfers across the Insurance, Operations, Community, and Ecosystem Funds.

Each system maintains separate access keys and distinct operational execution workflows.

## <mark style="color:$primary;">2. Signer Quorum & Geographic Distribution</mark>

Vaults and administrative roles are organized into risk tiers, with high-criticality actions requiring strict multi-party supermajority quorums. Beyond raw threshold counts, signer sets are bound by strict organizational and physical distribution rules designed to neutralize supply-chain attacks, physical coercion, and regional internet outages:

* **Organizational Independence:** Signer sets are distributed across teams to prevent single-point-of-failure insider risk.
* **Geographic Dispersion:** Key signers are geographically distributed across multiple legal jurisdictions.
* **Hardware & Device Diversity:** Signing devices span multiple independent hardware vendors and architectures to prevent single-manufacturer supply-chain exploits.
* **Air-Gapped Key Custody:** Signing keys reside exclusively on dedicated, air-gapped hardware security modules (HSMs) and physical signers used for no other purpose. Physical backups are secured in geographically separated physical vaults under strict access controls.

#### Signer Onboarding & Rotation Lifecycle

* **Controlled Onboarding:** New signers undergo rigorous identity verification, live out-of-band authentication, and mandatory quarterly OpSec training.
* **Periodic Rotation:** Signing keys are rotated periodically across administrative roles.
* **Offboarding Integrity:** Departing signers are replaced prior to credential removal, ensuring quorum requirements remain continuously intact while old keys are immediately revoked.

## <mark style="color:$primary;">3. Transaction Execution & Signing Protocol</mark>

Before any signer approves an administrative or treasury transaction, it must clear a mandatory three-step verification pipeline:

1. **Out-of-Band Confirmation:** The request must be authenticated over a dedicated, out-of-band communication channel isolated from primary team communication tools.
2. **Independent Parameter Audit:** Every signer independently inspects call data, target addresses, chain IDs, nonces, and transaction hashes.
3. **Simulation Review:** Transaction simulations are verified on-chain to ensure execution outcomes match communicated parameters exactly.

> *If a discrepancy occurs at any stage, <mark style="color:$warning;">**execution halts immediately**</mark> and the Signing System Owner initiates a formal review before any keys are applied.*

## <mark style="color:$primary;">4. Timelocks & Emergency Controls</mark>

* **48-Hour Public Upgrade Timelocks:** All non-emergency contract updates are subjected to a public 48-hour timelock, allowing the community to inspect code changes prior to execution.
* **Circuit Breakers & Emergency Pauses:** Authorized security roles can pause minting, redemptions, staking vaults, or $USN transfers instantaneously. Emergency pauses cannot move or redirect funds; they function exclusively as a non-destructive containment measure.
* **Address-Book Safeguards:** Adding new strategy counterparties or venues to <mark style="color:purple;">**Noon**</mark>'s Treasury Signing System requires a multi-party supermajority approval and a mandatory low-value test transaction.

## <mark style="color:$primary;">5. 24/7 Monitoring & Incident Response Integration</mark>

<mark style="color:purple;">**Noon**</mark> maintains round-the-clock infrastructure monitoring integrated with automated PagerDuty escalation:

* **Monitored Vectors:** Contract events, reserve drift, oracle price deviation, bridge messaging delays, protocol TVL shifts, and venue risk alerts.
* **Tiered Response Escalation:** Critical alerts trigger immediate automated containment mechanisms and rapid multi-sig quorum assembly.
* **Freeze-First Philosophy:** Played out across defined playbooks (for key compromise, DNS hijacking, or venue insolvency), the operational directive is simple: *pause first, investigate second*. Because pause mechanisms are reversible and cannot move funds, fast containment carries zero capital risk.

## <mark style="color:$primary;">6. SEAL Framework Evaluation & Scorecard</mark>

While smart contract audits verify code, operational security requires evaluating execution procedures. Noon assessed its Operational Security Policy against the Security Alliance (SEAL) Framework Checklist—the Web3 benchmark for multisig security and incident response.

Across 36 controls, Noon achieved an evidence-backed rating with zero critical gaps:

<figure><img src="https://3816918787-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FL26rQzcNmiUZrCXkxkjS%2Fuploads%2FWyGPxGcB9laAC8SNKcfp%2FSealTable.png?alt=media&amp;token=d3c1d944-a4ad-4ab5-a6fd-84dd1b9dd4e5" alt=""><figcaption></figcaption></figure>

*Note: The four partial ratings reflect planned infrastructure scale-outs as <mark style="color:purple;">**Noon**</mark> grows (including expanded dark-web breach monitoring and secondary backup infrastructure scheduled against TVL growth milestones).*

> Document: <mark style="color:purple;">**`Noon`**</mark>`Operational Security Policy — Internal Audit v1`
>
> Framework: SEAL Checklist Assessment ([**Link**](https://frameworks.securityalliance.org/opsec/overview))
>
> Internal Audit Summary: [**Link**](https://drive.google.com/file/d/1cLmsM100fNv9vNl6mbmiUODJErYbKFMm/view?usp=sharing)