Verify it, don't take our word.
Wynk holds some of the most sensitive data in the economy: identity, income, health and criminal-adjacent screening outcomes. The controls below are described in the specific, and the ones that can be checked from a browser are checked from your browser, now.
Ledger integrity
checking…Each check recomputes the hash chain across every row in the ledger. It is running on this request, not read from a cache written at build time.
What actually protects the record.
Envelope encryption with segregated key domains
Personal information, biometric templates, health data and financial detail are each sealed under a separate key domain derived through HKDF. Compromising one domain does not yield the others, and a key can be shredded per domain — which is how erasure under POPIA §71 is made attributable rather than best-effort.
Hash-chained, append-only ledgers
Consent grants and revocations, processing events and power-of-attorney mandates each commit to the entry before them. Editing history breaks the chain; the loyalty ledger is verified at every boot and the process refuses to start on a break rather than serve a balance it cannot prove.
Consent as a gate, not a checkbox
Each engine is bound to a consent purpose — credit_scoring, identity_verification, fica_cdd, health_intelligence, recoveries_history_check. Without an active grant the engine raises a consent error. It does not return a degraded answer.
Pseudonymous by default
Identifiers are salted into blind indexes; the graph resolves on the index, never the raw identifier. Unsealing personal information is a separate, role-gated action that writes its own audit entry — so every access to identity is on the record, including ours.
Least-privilege access
Five staff roles and two data-subject roles map to a permission matrix that routes check by permission, never by role name. Unsealing personal information requires admin or compliance specifically. Optional TOTP two-factor authentication is enforced at sign-in when enabled.
Session and abuse controls
Staff sessions idle out after 30 minutes and expire at 12 hours; data-subject sessions idle out at 20 minutes and expire at 4. Every state-changing request carries a session-bound CSRF token. Failed sign-ins trigger exponential lockout on both the account and the source network.
The rights POPIA gives, implemented as endpoints.
A right that requires a support ticket is not really a right. Every one of these is a call a data subject can make from their own portal account.
Which rules we are building against.
| Framework | What it governs here | How it shows up |
|---|---|---|
| POPIA | Processing of personal and special personal information | Purpose-bound consent gates, segregated key domains for health and biometrics, per-domain key shredding for erasure, audited access to identifying data |
| FIC Act 38 of 2001 | Customer due diligence and record retention | Five-step CDD with a risk-rated outcome, PEP and sanctions screening, CIPC look-through, five-year retention reference on every check |
| National Credit Act | Affordability assessment and reckless-lending prevention | Reg 23A debt-service-ratio assessment in the decisioning engine; a three-layer guard prevents loyalty rewards being framed as an inducement to borrow |
| Model risk governance | Fitness of models used in credit decisions | Registered models with version, role and measured discrimination; champion/challenger on every score; underwriting memoranda on model change |
Responsible disclosure
If you have found a security issue, tell us before you tell anyone else and we will work the fix with you. Send the detail to security@wynk.credit.
We will acknowledge within one business day, keep you updated while we remediate, and credit you when the fix ships unless you would rather we did not. We will not pursue anyone who reports in good faith, stays within their own test data and does not degrade the service for others.
Operational transparency
The health probe is open by design so that your monitoring can page on it without a credential.
The Prometheus endpoint carries counters, latency histograms and build info, and can be restricted to an internal address range in production. It never carries a secret or a subject.