# Non-functional requirements

<!--
Every entry needs a NUMBER or NAMED THRESHOLD. "Fast" is not an NFR;
"p95 interaction < 100ms on mid-tier mobile" is.
-->

## Performance

- <metric>: <threshold> at <load>
- <metric>: <threshold> at <load>

## Scale

- Users: <expected at launch> → <year-1 target>
- Data: <volume> at <year-1 target>
- Throughput: <req/s, events/s, etc.>

## Availability

- Target uptime: <%>
- RTO / RPO: <values, if applicable>

## Security

- Authentication: <method>
- Authorization model: <roles / capabilities / none>
- Sensitive data: <classifications>
- Compliance frameworks in scope: <SOC2 / GDPR / HIPAA / none / TBD>

## Accessibility

- Standard: WCAG 2.2 AA (floor — see interaction-design.md for specifics)

## Browser / device support

- <list>

## Offline behavior

- <does the app function offline? what does it do when it can't reach the network?>

## Data retention & deletion

- <policy: how long, who can delete, what's the cascade>

## Observability

- <what we log / measure / alert on, at the requirement level>