Our own security self-assessment

NIST does not certify organizations against the Cybersecurity Framework — there is no badge to earn. This is Noctrel's own self-assessment against the six CSF 2.0 functions, published because it's useful for a technical buyer's own diligence, not because it carries the weight of a third-party audit. It never will, and isn't presented as one.

Last reviewed August 2026, re-reviewed whenever a control described below materially changes.

Segregation of duties is a real, enforced policy: when an org turns it on, a Member can't be the sole approver of a risk-flagged command — checked by one shared function every approval path calls (dashboard click, email link, API token, plan resume), specifically so the policy can't be enforced on some paths and not others. Command risk is classified by pattern-matching against known-dangerous shapes, never by asking the model whether its own proposal is safe.

Gap: Noctrel is operated by a single individual developer, not an incorporated company — stated plainly in the Terms rather than obscured. The agent ships as an unsigned npm package, with no release checksums or provenance attestation yet.

The set of commands an AI may ever propose is an explicit, customer-authored catalogue — not a free-form shell. Every command carries a risk classification computed at proposal time and frozen at that point, plus a separate, deterministic check for whether it actually needs root that doesn't trust the model's own self-report.

• TOTP two-factor authentication with single-use, atomically-claimed backup codes.
• Three-tier org roles with real privilege boundaries, not one undifferentiated "logged in" state.
• API tokens are scoped and carry an explicit expiry choice — never-expiring is a deliberate selection.
• AI provider credentials are envelope-encrypted (AES-256-GCM) at rest, never sent to the agent.
• Command output and server inventory are redacted before reaching a third-party model — known secret shapes and private/internal IP addresses masked, honestly documented as best-effort, not perfect.
• Outbound webhook destinations are checked against the full private/loopback/metadata address space before delivery.
• The audit log is append-only enforced by a database trigger, not application discipline alone.

An AI activity view surfaces daily/monthly usage and, specifically, commands that failed repeatedly against the same goal within the last week — a pattern otherwise only visible by reading the audit log entry by entry. New-device sign-in triggers an email alert.

Gap: this pattern-detection is scoped to AI-command failures. There's no general anomaly detection and no centralized export of security events to an external SIEM yet.

A real kill switch exists at both the organization and individual-server level — when engaged, the AI cannot propose or run anything new for the affected scope, enforced server-side, not a UI toggle the model could talk around. Toggling it is itself an audited action. Pending approvals and failures trigger email notifications, including a signed, single-use approval link, so nobody has to be watching the dashboard for something to get noticed.

A written incident-response plan now defines severity tiers and response steps, and a public status page exists for uptime visibility.

Gap: no fixed response-time SLA or on-call team — a single-operator product, stated plainly rather than implied otherwise. The Terms remain explicit that no uptime commitment exists.

A written backup/disaster-recovery policy confirms real automated backups on the production database: daily AWS RDS backups with a 7-day retention window, and point-in-time recovery to any second within it — an RPO target of 15 minutes, RTO of 24 hours. Still open: no tested restore procedure, no cross-region redundancy, single-AZ rather than multi-AZ, and deletion protection is currently off on a database that now holds real customer data. The Terms of Service says the backup part outright rather than staying silent about it: keep your own backups of anything you cannot afford to lose.

One control does work in this function's favor: audit history survives the deletion of the resources it describes — a server, a user, an organization — by design, so a post-incident reconstruction of what happened isn't lost just because the affected resource was later removed. The gateway is also a single, non-replicated process today; a crash is a real, self-healing-within-minutes outage window, not a masked one.