Trust & security

We never hold your money

The safest thing we can tell you about your group's funds is that we do not have them. Members pay each other directly — mobile money, bank transfer, ATM, cash — and record it here. Ntalah has no access to your bank or mobile-money account, and there is no Ntalah balance for anyone to steal.

Access is enforced in the database, not just the app

Every table has row-level security, so the rules about who can read what are applied by the database itself on every query. A bug in a screen cannot expose another group's data, because the screen is not what is enforcing the boundary.

The few reads that must work without a session — an invite preview, the public pricing — are individually written to return a short, fixed list of safe columns. They never return member identities or financial figures.

Proof of payment

Proof files live in a private store. They are not reachable by URL: opening one mints a short-lived link only after we check your role in that group and the group's own visibility setting, which defaults to admin and finance members only. Every time a proof is opened, we record who opened it.

Nothing changes quietly

Contributions, payouts, loans, membership changes and role changes are written to a per-group activity log that members can read. Privileged staff actions are recorded separately in an operator audit trail. A group also cannot be left without an admin — the last active admin cannot be removed or demoted until someone else is promoted.

Your account

Sign-in is handled by our authentication provider; we never see your password. You can sign in with a one-time link instead of a password if you prefer. Your phone number is private unless you explicitly share it with your group.

We will never ask for your PIN, your password, or a one-time code. Anyone who does is not us — report it using the contact page.

Payments for your subscription

Seats, AI credits and extra groups are paid through our payment provider. Card details go to them, never to us — we store only the amount, currency, status and a reference. Provider callbacks are signature-verified before anything is credited, and fulfilment is idempotent, so a replayed message cannot grant twice.

Reporting a problem

If you think you have found a security issue, please tell us before telling anyone else, and give us a reasonable window to fix it. Contact [security contact — to confirm]. We will not pursue anyone acting in good faith under those terms.

Where your data lives

Our database and file storage are hosted by Supabase and the application by Vercel, which may mean processing outside your own country. See the Privacy Policy. [Hosting region — to confirm]