Security

Records nobody can quietly change#

• Double-entry books. Every amount is posted to a double-entry ledger, so the books always balance and every figure can be traced to its entries.
• Nothing is erased. A mistake is put right by reversing it with a new entry, never by editing or deleting the old one. A posted payment voucher is undone by reversing the voucher.
• Sealed entries. Each journal entry and its lines are sealed with a cryptographic fingerprint chained to the one before, per club. Changing an old entry would break the chain, and Kwessa can check the whole chain on demand.
• A tamper-evident audit trail. Changes in a club, and the actions of our own staff, are written to an audit log that is chained the same way. The service itself is not allowed to change or delete the log.
• Signed anchors, checked nightly. Every hour the latest fingerprint of every chain that moved is signed and stored in write-once storage that cannot be altered or deleted for seven years, not even by us. Each night every chain is checked against itself and those anchors, and our team is alerted by email if anything fails.
• Gap-free receipts. Receipts are numbered in sequence each year with no gaps, so a missing one would show.

Controls inside the club#

• Roles. Each user has a role in the club (administrator, treasurer, secretary, board member, sergeant at arms or member) and can see and do only what that role allows. A member sees their own figures, not other members’.
• Maker-checker for money going out. A club can require a second officer to approve payment vouchers, above an amount it sets. Whoever raises a voucher can never approve it, and only an approved voucher is posted to the books.
• Payments reported on WhatsApp wait for the treasurer. A pasted mobile money or bank message, or a screenshot of one, moves nothing until an officer confirms it.
• The AI on WhatsApp can only read. The language model answers from the club’s records and has no way to change them. Anything done on WhatsApp, such as reporting a payment, issuing a fine or voting, follows fixed steps that Kwessa checks against the sender’s role. Members are recognised by the phone number the club has on record, and personal figures go only to the member, never to a group.

Every club kept apart#

Kwessa serves many clubs, and each one’s data is kept apart from every other’s at two levels. Every request to the database is limited to the club the user is signed in to, and fails if no club is set. The books themselves sit behind a second check in the database (row-level security), which refuses to return one club’s entries to another.

Signing in#

• Passwords are at least 10 characters, and are stored only as a one-way hash (Argon2id), so nobody at Kwessa can read them.
• Two-step sign-in with an authenticator app, plus one-time recovery codes. Anyone can turn it on, and a club can require it for the roles it chooses.
• Signing in gives the app a pass that lasts 15 minutes, held only in memory. It is renewed quietly with a second token kept in a cookie that page scripts cannot read; that token is replaced every time it is used, stored by us only in hashed form, and lapses after 14 days without use. If an old one is ever reused, every session of that account is signed out.
• You can see every device you are signed in on, and sign any of them out, from your profile.
• Repeated sign-in attempts are slowed down to a few a minute, and ten wrong passwords or codes lock the account for 15 minutes. Our website’s forms are limited to a few an hour.
• Password reset links work for one hour; invitation links for seven days.
• Our staff sign in to a separate operations service with separate accounts and keys, and must use two-step sign-in. A club user’s pass does not work there, and theirs does not work in a club.

Where and how it runs#

• Encrypted in transit. Every connection to Kwessa uses HTTPS (TLS), with strict transport security so browsers refuse plain connections.
• Encrypted at rest. Our servers run on Amazon Web Services in the EU (Ireland) region. Their disks are encrypted, and so is every storage bucket.
• Private files. Photos, logos and documents are kept in a private storage bucket, one per environment, with all public access blocked. Files are served only through Kwessa, to people allowed to see them. Replaced files are kept for 30 days in case of mistakes.
• Few doors. Only the secure web port is open to the internet. The database, the search index, the ledger service and the WhatsApp connection are reachable only from inside the server.
• Least privilege in the database. The applications connect to the database as limited roles that cannot bypass the club separation or alter the audit trail and sealed entries. Only a separate owner role can change the database’s structure.
• Secrets locked away. Settings such as keys are stored encrypted in AWS’s parameter store, not in our code. Secrets a club gives us, such as its WhatsApp access token, are encrypted in our database (AES-256-GCM) and can be replaced but never read back.
• Backups. Changes to the production database are copied every five minutes, with a full copy every night, to separate encrypted storage that cannot be deleted early, and a second copy in another region. Backups are kept for 30 days, and each month one is restored to prove it works.
• Error reports without personal data. When something fails, the report we receive carries the technical details and the ids of the club and user, never names, amounts, phone numbers, passwords or what was typed.

Our own team#

Only the people who run the service have access to it, each with an operator account and a role that allows only what their job needs. They cannot post, reverse or edit a club’s money, or edit its members. When they act in a club, it is written to that club’s audit trail as well as our own.

Our staff do not see a club’s books or members’ register unless one of its administrators grants support access, for 1, 24 or 72 hours. That access is read-only, lasts at most 30 minutes at a time, and every page viewed is recorded in the club’s audit trail.

The most sensitive actions, such as closing a club, changing who its officers are, exporting its data without a support grant or giving a club a lower price, need a second operator to approve them.

Reporting a problem#

If you think you have found a security weakness in Kwessa, please tell us straight away at hello@kwessa.club or through our contact page, with enough detail for us to reproduce it. Please do not access other people’s data or disrupt the service while looking. We will reply, keep you informed while we fix it, and thank you.

If we learn of a breach that puts personal data at risk, we will tell the affected clubs and, where the law requires it, the Data Protection Commission, as soon as we reasonably can. Our privacy policy says more about how we handle personal data.