Security and Responsible Disclosure Policy

Pawalink is operated by Fortis Buildnext. Security reports about the Pawalink platform should be sent to Fortis Buildnext using the channel below. Do not test destructively, do not access other users' data, and do not disclose the issue publicly before Pawalink has reviewed it. Report it to [email protected] and give us reasonable time to respond. That is all we ask.

Pawalink uses layered controls including server-managed auth with httpOnly cookies, HMAC webhook validation, rate limiting, and security headers. These reduce risk but do not eliminate it. No internet service is perfectly secure.

Send your report to [email protected]. Include enough detail for Pawalink to reproduce and assess the issue.

• Affected URL or endpoint and the steps to reproduce.
• What you observed versus what you expected.
• Screenshots, request/response samples, or proof-of-concept code where relevant.
• Your contact details if you want a response.

We will review the report and investigate the affected surface. For confirmed vulnerabilities we will apply a fix, assess whether user data was exposed, and determine whether external notification is required. We will not take legal action against researchers who report in good faith and follow this policy.

This policy does not promise bounty payments, a specific response timeline, safe-harbor protection beyond what applicable law provides, or authorization to run broad penetration testing.

The following are not in scope for this disclosure policy.

• Social engineering or phishing attacks against Pawalink staff or users.
• Denial-of-service or resource exhaustion attacks.
• Vulnerabilities in third-party services or providers that Pawalink does not control.
• Physical access attacks.
• Issues that require physical access to an authenticated device.

Ghana's Cybersecurity Act 2020 (Act 1038) established the Cyber Security Authority and its incident-reporting arm CERT-GH. Serious incidents — including breaches affecting user data, payment flows, or critical platform infrastructure — may require notification to CERT-GH in addition to internal handling. The Cyber Security Authority operates reporting channels at csa.gov.gh.

Data breaches involving personal data held by Pawalink may also trigger obligations under Ghana's Data Protection Act 2012 (Act 843) and the Data Protection Commission. Pawalink will handle those notifications as required by law.