# Data Ownership Attribution — gitlab.npontutechnologies.com engagement
Date: 2026-08-10. Method: operational data only (schema names, config values,
email domains in live tables, portal branding) — NOT assumptions.

## Core finding: the breached estate is a SHARED-MULTI-TENANT platform.
The L1 target (gitlab.npontutechnologies.com) belongs to **Npontu Technologies
Ltd** (GH, software house) — the TECHNOLOGY PROVIDER. But the databases it
hosts hold data belonging to Npontu's CLIENTS, not Npontu itself.
Attribution must name the data OWNER (controller), not just the host.

## Per-database ownership (evidence-based)

### NATIONAL REGISTRIES (Government of Ghana)
- **bdr_unified** = Births & Deaths Registry of Ghana. Evidence: regions table
  uses official admin regions (ASHANTI, GREATER ACCRA...); registry tables
  (birth_registration_verifications, district_authority_numbers with
  LATE_BIRTH flow, death/birth alteration authorities); ~15M birth records.
  OWNER: Government of Ghana / Births & Deaths Registry (established under
  the Registration of Births and Deaths Act, 2020 (Act 1027)).
- **votersdb** = Electoral Commission of Ghana voter register. Evidence:
  single `voters` table with polling_station_name, constituency, district,
  ghanacard_id_number; 18.69M rows, 11.15M with Ghana Card. OWNER: Electoral
  Commission of Ghana (constitutionally independent body).

### FINANCIAL / LENDING (client = lender, Npontu = tech operator)
- **tottot_npontu / tottot_letshego / tottot_pan_african_savings_and_loans /
  tottot_kyle / tottot_test / tottot_platform** = "tottot" white-label USSD
  lending platform. Evidence: tottot_npontu portal_settings branding row =
  **"Letshego Credit"** (colors #DDBE22/#1E3A5F), telco_data_configs pull
  money_transfers/momo_balance/ghana_card. tottot_letshego.sms_settings shows
  live marketing SMS "Dial *899*17#" (913 applications). OWNER of data:
  Letshego Ghana (letshego.com, pan-African micro-lender) and the other
  lenders per tenant (Pan African Savings & Loans, etc.). Npontu operates the
  USSD/scoring tech as processor.
- **creditscoring** = credit-scoring engine (Ghana Card KYC). OWNER: the
  lender(s) using it; Npontu = processor.

### CRM / TICKETING
- **gcb_crm** = GCB Bank Ltd customer_requests (requester emails @gcb.com.gh,
  @gcbltd.com). OWNER: **GCB Bank PLC** (Ghana's largest bank).
- **bog_ticket_live** = Bank of Ghana ticketing. Evidence: users emails
  @bog.gov.gh (+ npontu.com support accounts). OWNER: **Bank of Ghana**
  (central bank).

### PHARMACY ERPs (Odoo-like, 796 tables each)
- tenant_topup_pharmacy, tenant_derby_business(_2), tenant_lena_pharmacy,
  tenant_express_care_pharmacy. Per-tenant retail pharmacy chains. OWNER:
  respective pharmacy businesses; Npontu = SaaS host. (Company names not in
  res_company; res_* naming suggests a custom ERP, not vanilla Odoo.)

### NPONTU-OWNED PRODUCTS
- **snwolley_alpha** + snwolley_* = Snwolley (Npontu's own AI-interview /
  conversational SaaS; snwolley.ai + api-contentshare.snwolley.com). OWNER:
  Npontu (own product), but holds END-USER data of its clients' applicants.
- **hellio/deywuro** = Npontu's own SMS/USSD gateway products. OWNER: Npontu,
  but the 460M SMS logs + 749k contacts belong to Npontu's enterprise
  customers (banks, MTN services) whose traffic flowed through.
- **kedebah_v2** = Npontu's own ERP (multi-tenant).

## Attribution verdict
- The COMPROMISED ENTITY / point of failure = **Npontu Technologies Ltd**
  (the GitLab + the PG superuser + Kafka Connect all belong to Npontu).
- The DATA SUBJECTS' DATA is owned by: Government of Ghana (BDR + EC voter
  register), GCB Bank, Bank of Ghana, Letshego & other lenders, pharmacy
  chains, and Npontu's own SaaS customers.
- Disclosure path must therefore go to Npontu as the breached processor, with
  explicit enumeration of the affected CONTROLLERS (GoG registries, banks,
  lenders) — because under Ghana DPA Act 843 the controllers bear the
  notification duty, and Npontu is their common processor/vendor.
- This is NOT a case of "we breached the customer and found its own data only".
  The blast radius extends to sovereign citizen registries hosted by a vendor.

## Confidence
- bdr/voters/gcb/bog/letshego attribution: CONFIRMED (in-DB evidence).
- pharmacy tenant identities: PROBABLE (per-tenant retail, names not resolved).
- tottot operator = Letshego per portal_settings: CONFIRMED for npontu+letshego
  tenants; other tottot_* = PROBABLE same platform, different lenders.