Security
Last updated 20 July 2026

At Comutte, operated by Eniena Technologies Limited, the security of your personal and payment data is a core engineering priority. This page describes the measures we take to protect the platform and your information.

1. Data Encryption

In transit: all connections to the Comutte platform are encrypted with TLS 1.2 or higher (HTTPS). This applies to the website, API endpoints, the WhatsApp webhook, and all communication between our application servers and database.

At rest: our database is hosted on Supabase, which encrypts all data at rest using AES-256 on managed PostgreSQL storage volumes. Backups are encrypted with the same standard.

Payment data: we never store card numbers. Card payments are processed by Paystack, a PCI DSS Level 1 certified payment processor. Mobile Money transactions are recorded by reference number only.

2. Vulnerability Scanning

We maintain a regular vulnerability scanning schedule:

  • Automated scans: weekly DAST (Dynamic Application Security Testing) scans using ZAP by Checkmarx against the production site.
  • Dependency auditing: automated checks on every deployment for known vulnerabilities in third-party packages.
  • Security headers: the platform enforces a strict Content Security Policy, X-Frame-Options (DENY), X-Content-Type-Options (nosniff), and Referrer-Policy headers. These are verified with each scan.

3. Penetration Testing

We conduct penetration testing to identify and remediate vulnerabilities before they can be exploited:

  • July 2026: initial ZAP security assessment covering passive analysis, spider crawl, and active scan of all public endpoints. All findings (CSP, X-Frame-Options, X-Content-Type-Options, X-Powered-By disclosure) were remediated and verified in a follow-up scan.

Penetration testing will be conducted at least annually, or whenever significant architectural changes are made to the platform.

4. Incident Response

We maintain a structured incident response plan with five phases:

  1. Detection — monitoring of application logs, error rates, and security alerts. Anomalous patterns trigger immediate investigation.
  2. Containment — affected systems or features are isolated to prevent further impact. If a data breach is suspected, affected access credentials are rotated immediately.
  3. Notification — affected users are notified within 72 hours of a confirmed data breach, as required by the Ghana Data Protection Act, 2012 (Act 843). The Data Protection Commission is notified where legally required.
  4. Recovery — systems are restored from verified backups. Root cause is identified and a fix is deployed before affected services are brought back online.
  5. Post-incident review — a post-mortem is completed within 48 hours covering what happened, impact assessment, root cause analysis, remediation steps, and prevention measures. Completed post-mortems are stored in an internal knowledge base to prevent recurrence.

5. Data Storage Locations

Your data is processed and stored in the following locations:

  • Database: Supabase-managed PostgreSQL, hosted in AWS data centres. Data is encrypted at rest and in transit.
  • Application hosting: Vercel edge network, with server-side rendering in the US East (Washington, D.C.) region. Static assets are served from global edge locations.
  • Payment processing: Paystack (Lagos, Nigeria), PCI DSS Level 1 compliant. No card data touches our servers.
  • WhatsApp messaging:Meta Platforms (global infrastructure). AI responses are generated via Anthropic's Claude API (US-based).

We do not transfer personal data outside the scope of these service providers. All providers operate under data processing agreements.

6. Application Security Practices

  • Row-level security (RLS) policies on every database table.
  • Parameterised SQL queries — no string concatenation in queries.
  • Secrets stored in environment variables, never committed to code.
  • HMAC signature verification on all webhook endpoints (Paystack, WhatsApp).
  • Input validation at trust boundaries using Zod schemas.
  • Authentication via Supabase Auth with secure HTTP-only session cookies.
  • Principle of least privilege: service-role access is used only where RLS cannot apply.

7. Report a Vulnerability

If you discover a security vulnerability in the Comutte platform, we encourage responsible disclosure. Please report it to:

Please include a description of the vulnerability, steps to reproduce it, and any supporting evidence. We will acknowledge your report within 48 hours and aim to resolve confirmed vulnerabilities within 7 business days.

We ask that you do not publicly disclose the vulnerability until we have had a reasonable opportunity to address it. We will not take legal action against researchers who report vulnerabilities responsibly.

See also our Privacy Policy and Terms and Conditions.