Security model
NWatch is designed around trusted, invite-only groups and least-privilege service access. Mobile and portal requests are authenticated, manager actions are re-authorised on the server, and super-admin access is placed behind Cloudflare Access with Microsoft Entra ID.
- Every mobile API request carries a Firebase ID token that is verified by the API.
- Group roles and status are checked server-side rather than trusted from the client.
- Rate limiting protects high-risk writes but is deliberately fail-open on the panic path so a limiter fault cannot silence a real alert.
- Administrative and sensitive recovery actions are written to an audit trail.
Recipient-specific alert encryption
The sender's phone encrypts sensitive alert content before upload. ML-KEM-768 establishes a separate shared secret for each recipient; AES-256-GCM then protects that recipient's own ciphertext, nonce and authenticated context. Private keys are stored in the device's operating-system secure storage.
Alert envelopes are bound to the group, incident, recipient and key identifier so an envelope moved to the wrong context fails authentication instead of displaying misleading content.
Identity and access controls
Members sign in through supported identity providers rather than an NWatch password database. Google and Microsoft are supported across relevant user surfaces, and Sign in with Apple is provided on iOS. Firebase links the provider credential to the NWatch identity used by the API.
Group invite codes expire or have use limits. Managers can pause or ban members and can promote another active member. The service refuses an operation that would remove, demote, pause or transfer the last active manager because that would leave an operating group unrecoverable. A group that is wound up is archived instead of deleted: new alerts and membership activity stop, while its incident evidence and lifecycle records remain available to authorised support and audit paths.
Delivery reliability and diagnostics
Android uses a dedicated alarm path and iOS uses Critical Alerts where Apple has granted the entitlement and the user has allowed the permission. The mobile app provides an emergency-alert readiness check for notification, alarm, DND and full-screen settings.
Devices report bounded delivery events such as received, alarm started, failed, opened and stopped, plus relevant audio/notification state. These records let authorised support staff distinguish "push sent" from "phone actually sounded" and investigate decrypt failures by key identifier.
Data protection and operations
- HTTPS protects traffic in addition to the alert envelope encryption.
- Secrets such as the Firestore service credential, Stripe webhook secret and system private key are Worker secrets, not client configuration.
- Payment-card details are handled by Stripe and are not stored in NWatch.
- Account deletion removes active device tokens, public keys, memberships and recipient envelopes, subject to the limited safety, audit and billing retention described in the Privacy Policy.
- Cloudflare Worker observability and delivery diagnostics support investigation of alert and security failures.
Important limits
No app, cryptographic system, push provider or mobile operating system can guarantee uninterrupted delivery. Network loss, disabled permissions, device restrictions, invalidated keys and third-party outages can affect an alert. NWatch is one layer of a safety plan, not a replacement for emergency services or a professionally monitored alarm.
Security also depends on people: protect identity-provider accounts, do not share invite codes publicly, remove former members promptly, keep the app updated and run a real two-device group test after major OS or app updates.
Responsible security disclosure
If you believe you found a vulnerability, email [email protected] with "NWatch security report" in the subject. Include the affected surface, impact, reproducible steps and a safe proof of concept.
Do not access another person's data, test against emergency alerts in a real group without permission, disrupt production, use social engineering, or publish sensitive detail before we have had a reasonable opportunity to investigate. Never email credentials, private keys, live invite codes or decrypted alert content.
We will acknowledge reports and prioritise issues according to their risk to alert confidentiality, integrity and delivery. NWatch does not currently operate a paid bug-bounty program.