Security Statement
1. Our Commitment to Security
Pakimu Investment Limited T/A WanPaus Microfinance ("Pakimu") takes the security of borrower data and financial records seriously. This Security Statement describes the technical and organisational measures we apply to protect the WanPaus Microfinance platform ("the Platform") and the data entrusted to us.
Security is a continuous process. We review and update our controls regularly in response to new threats, platform changes, and operational learnings.
2. Data Encryption
In transit: All communications between users and the Platform are encrypted using TLS (Transport Layer Security). Connections over plain HTTP are redirected to HTTPS. API endpoints and the web application enforce TLS exclusively.
At rest: Financial data, personal information, and credentials are stored in a managed PostgreSQL database (Neon) hosted in a secure cloud environment with encryption at rest enabled by the provider. Passwords are never stored in plain text; they are hashed using bcrypt with a high work factor before storage.
3. Authentication and Access Control
Borrowers authenticate using a one-time password (OTP) delivered to their registered email address, or using a password with OTP for reset flows. OTPs are single-use, time-limited (10 minutes), and invalidated on use.
Staff users authenticate using email and password. Sessions are managed via short-lived JWT access tokens (15-minute expiry) and httpOnly refresh cookies that are not accessible to JavaScript.
Role-based access control (RBAC) limits every user to only the data and operations their role permits. OPERATOR, TENANT_ADMIN, SUPER_ADMIN, AUDITOR, COMPLIANCE, and BORROWER roles are enforced at both the API and database query levels. Cross-tenant data access is blocked by tenant scoping applied to every query.
Account lockout: Repeated failed login attempts trigger account lockout. Borrower accounts are locked after 5 failed OTP attempts; lockout clears after 30 minutes. Admin accounts have equivalent protections.
Rate limiting: All authentication and sensitive endpoints are rate-limited. Password reset requests are limited to 3 per minute per IP; OTP verification to 5 per minute.
4. Audit Logging
All significant actions on the Platform are recorded in an immutable audit log, including:
- login events (success and failure) with timestamp and IP address;
- loan creation, approval, rejection, and disbursement;
- repayment recording and receipt;
- KYC document submission and verification;
- password reset requests and completions;
- administrative configuration changes;
- data export events.
Audit logs are retained for a minimum of five (5) years and are reviewed regularly by authorised personnel. AUDITOR-role users can access audit logs without write permissions.
5. Infrastructure Security
The Platform backend runs on Fly.io, a managed cloud infrastructure provider. The database is hosted on Neon (managed PostgreSQL). Both providers maintain SOC 2 compliance and operate hardened, monitored infrastructure.
Database access is restricted to the application server via connection string authentication. No direct public access to the database is permitted. Production credentials are stored as encrypted environment secrets, never in source code or version history.
We follow a rehearsed deployment process: all migrations are tested on a copy of production data before being applied to the live database.
6. Vulnerability Management
We apply dependency updates, including security patches, on a regular basis. We use automated tooling to identify known vulnerabilities in our dependencies (npm audit).
We welcome responsible disclosure of security vulnerabilities. If you believe you have found a security issue in the Platform, please contact us at hi@wantekpng.com before public disclosure. We aim to respond to security reports within 2 business days.
We ask researchers to:
- not access or modify data belonging to other users;
- not perform denial-of-service testing;
- not publicly disclose the vulnerability before we have had a reasonable opportunity to address it.
Security researchers who report vulnerabilities in good faith and follow these guidelines will not face enforcement action under our Acceptable Use Policy.
7. Incident Response
In the event of a confirmed security incident affecting borrower data, we will:
- (a) contain and investigate the incident as rapidly as possible;
- (b) notify affected borrowers by email within a reasonable timeframe following confirmation of the breach;
- (c) notify relevant regulatory authorities as required by applicable PNG law;
- (d) document and review the incident to prevent recurrence.
To report a suspected security incident, contact hi@wantekpng.com immediately.
8. Staff Security
Staff with access to production systems are granted the minimum permissions necessary for their role. Access is reviewed when roles change. All staff are expected to follow our internal data handling and access policies.
Pakimu staff will never ask you for your OTP, password, or any credential by phone, email, or message. If you receive such a request, treat it as a phishing attempt and report it to hi@wantekpng.com.
9. Contact
Pakimu Investment Limited T/A WanPaus Microfinance
Security contact: hi@wantekpng.com
Papua New Guinea