# Security-Storage Responsibility Attribution — Npontu engagement
Date: 2026-08-12. Method: operational evidence (pg_roles, server config,
GitLab namespaces, CI vars, network exposure). NOT speculation.

## Verdict: responsibility sits with NPONTU TECHNOLOGIES (the vendor/processor),
## NOT the data owners (GoG, banks, lenders).

### 1. The infrastructure is owned & operated by Npontu
- PG superusers on 65.109.51.221 are Npontu internal staff/accounts:
  wonder, abraham, mylar, kafkauser, pontian, nosa, priv_esc, backup_user.
  These map to GitLab committer namespaces (deabraham=abraham, etc.) — Npontu
  developers, not GoG/bank personnel.
- The compromised credential (kafkauser/helliobk#123X + shared
  0ArunW82jf$j0!ksh#ksP2eQ) is a Npontu-managed CDC/service account.
- The leaked SSH keys (F1, agi-trust-seal CI vars) are Npontu ops credentials
  (npontucontrl@..., support@npontu.com comments).

### 2. The security failure is Npontu's architecture, not a client's
- **listen_addresses = '*'** on the PG superuser instance (65.109.51.221:5542)
  — the 40-DB estate answered the public internet. A client (GoG/bank) does
  not control Npontu's pg_hba/network binding.
- **Shared superuser across products**: one kafkauser opens deywuro +
  creditscoring + snwolley + every tenant DB. That blast-radius-by-design is
  Npontu's platform engineering choice.
- **Secrets in GitLab CI vars / repo .env files** (SSH keys, DB passwords,
  Mailgun, SMTP) — Npontu's secret-management failure, committed by Npontu
  devs (ishmaila/agi-trust-seal CI vars, eamenyedzi/deywuro .env.old, etc.).
- **kafkauser plaintext storage + hellio.users.pass plaintext column** —
  Npontu's application design (deywuro/hellio are Npontu's own products).

### 3. The data owners are victims, not the cause
- GoG (BDR, Electoral Commission), GCB Bank, Bank of Ghana, Letshego, pharmacy
  chains — they are Npontu's CLIENTS. Their data sits on Npontu-managed,
  internet-exposed, single-superuser infrastructure. Under Ghana DPA Act 843
  they are controllers with notification duty, but the security-of-processing
  failure (Act 843 §27 security safeguards / processor obligations) is
  Npontu's.
- A controller can be faulted for vendor-selection/due-diligence (choosing a
  processor with weak controls), but the proximate cause of exposure = Npontu.

### 4. Named accountable functions (evidence-level)
- Platform/DBA ownership: the Npontu superuser set (wonder/abraham/mylar/
  kafkauser) — these individuals/roles controlled the exposed instance.
- DevOps/CI: whoever parked live SSH keys + DB creds in GitLab CI vars
  (ishmaila/agi-trust-seal) and committed .env/.env.old (eamenyedzi/deywuro,
  jjnyadroh/kedebah_v2_pim_api).
- Leadership/governance: Npontu board (incl. Prof. Noel Tagoe) — SME without
  visible DPO/security-officer function in public record.

## Bottom line
The entity RESPONSIBLE for the security of storage = **Npontu Technologies
Ltd** (processor). The entities whose DATA was exposed = GoG registries, banks,
lenders, pharmacies (controllers). For disclosure: notify Npontu as the
breached processor at fault, enumerate controllers; regulators (DPC, and for
bank data possibly Bank of Ghana) will apportion controller-vs-processor blame,
but the storage-security failure is squarely Npontu's.