Security — Akwaaba

The short version

✓All traffic to and from Akwaaba is encrypted (TLS 1.3).
✓We never see or store your full card number — Paystack handles that.
✓Passwords are hashed, never stored in plain text.
✓You can enable Face ID / Touch ID / fingerprint login in the app.
✓Found a security issue? Email security@akwaaba.app — see Section 07.

Encryption

Data is encrypted in transit and at rest.

All connections to akwaaba.app and the Akwaaba app use TLS 1.3 in transit — there is no unencrypted HTTP endpoint for account or payment data.
Data at rest in our primary database is encrypted using our database provider's built-in encryption-at-rest.
Session tokens are short-lived: access tokens expire after 15 minutes and refresh tokens after 7 days, limiting how long a leaked token stays useful.

Authentication & Accounts

Passwords are hashed, never stored in the clear. Biometric login is available in the app.

Passwords are hashed using industry-standard one-way hashing before storage — Akwaaba staff cannot read your password.
The mobile app supports biometric login (Face ID, Touch ID, or Android fingerprint/face unlock) as an optional layer on top of your password.
Sign-in uses JWT-based authentication with short-lived access tokens; sessions can be revoked by signing out.
You can delete your account at any time from Settings → Account → Delete Account, which removes your session and schedules your data for deletion per our Privacy Policy.

Payment Security

Payments are handled by Paystack. Akwaaba never sees or stores your full card number.

All payments are processed by Paystack, a PCI DSS-compliant payment processor. Card numbers, CVVs, and full payment credentials are entered directly into Paystack's secure payment flow — Akwaaba's servers never receive or store your full card details. We store only what is necessary to confirm a booking (transaction reference, amount, status).

Infrastructure

Hosted on managed cloud infrastructure with access controls and monitoring.

The website is hosted on Vercel's edge network; the API backend runs on access-controlled cloud servers reachable only via SSH key (no password-based server access).
Database access is restricted to backend services and authorized administrators — it is never exposed directly to the public internet.
We run automated monitoring to detect service outages and abnormal error rates, so incidents are caught quickly.

Compliance

Registered with Ghana's Data Protection Commission; practices aligned with Ghana's Cyber Security Act.

Akwaaba App Limited is registered as a Data Controller with the Ghana Data Protection Commission under the Data Protection Act 2012 (Act 843), and our security practices are aligned with the Cyber Security Act, 2020 (Act 1038). See our Privacy Policy for details on your rights as a data subject.

Incident Response

If a breach affects your data, we will notify you and the relevant authority as required by law.

In the event of a data security incident that affects your personal information, we will notify affected users and the Ghana Data Protection Commission without undue delay, as required under Act 843, and take immediate steps to contain and remediate the issue.

Report a Vulnerability

Found a security issue? Tell us privately before disclosing it publicly, and we'll fix it.

If you believe you've found a security vulnerability in Akwaaba's website or app, please report it to us privately so we can investigate and fix it before it's disclosed publicly. Please include as much detail as possible (steps to reproduce, affected URL or screen, potential impact).

📧security@akwaaba.app

📧(backup: support@akwaaba.app if you don't hear back within a few days)

We will not pursue legal action against good-faith security research that follows this responsible disclosure process and does not access, modify, or exfiltrate other users' data.