Security Disclosure & Trust Architecture

1. Non-Custodial Security Paradigm

In traditional financial apps, customer funds are held in custodial omnibus bank accounts. If the fintech company suffers a security breach, liquidity squeeze, or system failure, user funds can be frozen or lost.

The PocketPadi Difference: PocketPadi is architected from the ground up as 100% non-custodial software.

3. 256-Bit TLS & Storage Cryptography

PocketPadi utilizes state-of-the-art cryptographic standards to secure user sessions and financial ledgers:

• Transport Layer Security (TLS 1.3): All network communications are encrypted with high-grade TLS 1.3 cryptographic suites using 256-bit keys and Perfect Forward Secrecy (PFS).
• Data at Rest: Core relational databases, backups, and user logs are encrypted with AES-256 block-level encryption.
• Salted Password / PIN Hashing: Device authentication PINs are salted with random 128-bit cryptographic salts and hashed via bcrypt with a high work factor. Plaintext credentials never touch disk.
• Stateless Session Tokens: Authenticated sessions use cryptographically signed, short-lived tokens stored in secure, HttpOnly, SameSite cookies to protect against session hijacking.

4. Isolated Gateway Subscriptions via Paystack

Subscription payments (GH₵ 10/month Solo, GH₵ 20/month Household) are strictly isolated from core application servers:

All payment transactions are handled directly through Paystack, a licensed Payment Service Provider certified under PCI-DSS Level 1 (the highest global financial security standard) and authorized by the Bank of Ghana.

When you pay via MTN MoMo, Telecel Cash, or debit card, your credentials are submitted directly into Paystack's tokenized vault. PocketPadi servers only receive an opaque webhook confirmation token, ensuring zero exposure of your card or wallet credentials.

5. Household Wall Cryptographic Isolation

Padi Household accounts enable family members to share budget pacing while guaranteeing individual privacy:

• Role-Based Access Control (RBAC): Queries for personal envelopes verify the requesting user's verified token before returning ledger rows.
• Granular Envelope Grants: Only transactions specifically categorized into shared envelopes (e.g., Household Groceries, Utilities) are accessible across member tokens.
• Confidential Private Balances: A spouse, partner, or parent cannot view your personal wallet balance, individual salary drops, or private cash purchases.

6. Edge Protection & Injection Defense

Our application infrastructure is defended by continuous security controls:

• Edge Web Application Firewall (WAF): Automated edge filtering protects against distributed denial-of-service (DDoS) attacks, brute-force PIN guessing, and automated bot scrapers.
• Strict Parameterized Queries (Zero SQL Injection): Every database call utilizes prepared SQL statements with parameter binding, eliminating SQL injection vectors.
• Context-Aware Output Encoding (Zero XSS): All user-supplied inputs and notes are escaped with context-aware HTML encoding to prevent Cross-Site Scripting (XSS).
• Cross-Site Request Forgery (CSRF) Tokens: All state-changing actions require randomized cryptographic CSRF tokens verified per request.

7. Responsible Vulnerability Disclosure Program

PocketPadi welcomes collaboration with ethical security researchers, penetration testers, and the Ghanaian cybersecurity community to enhance our platform's resilience.

Safe Harbor Commitment

If you conduct vulnerability research in good faith, avoid violating the privacy of other users, do not disrupt production systems, and report the vulnerability promptly to us, PocketPadi will not pursue legal action against you.

How to Report a Vulnerability

Response SLA: Our security operations team acknowledges all security disclosures within 24 hours and provides triage status updates within 72 hours.

8. Incident Response & Security Team Contact

Our dedicated Cyber Defense & Security Operations team is based in Accra, Ghana. For operational security inquiries or urgent vulnerability notifications: