How Woodkraft protects your account, your data and your money, and how to report a security problem.
How we protect you
- No passwords to steal: you sign in with a one-time code that works once, for 10 minutes. Supplier staff and administrators also need an authenticator app.
- Guessing is stopped: codes lock after five wrong tries, and sign-in requests are rate-limited.
- Sessions: only a fingerprint (hash) of your session is stored, never the session itself. Sessions expire, and you can sign out everywhere at once.
- Separation: each company sees only its own data. Roles limit what each staff member can do.
- Tamper-evident records: every important action is written to an audit log in which each entry is sealed to the one before it, so any change to history is detected.
- Payments: handled by Paystack. An order counts as paid only when Paystack's signed confirmation arrives, never on a screenshot or message.
- Encryption: all connections use HTTPS, and stored data is encrypted by our hosting provider.
- Genuine software: licence keys are digitally signed, so they cannot be forged. Downloads and updates are signed so you can tell they came from us.
- Testing: every change is tested before release, and the platform is tested by independent security specialists before major launches.
How you can protect yourself
- Keep your email account secure, with its own strong password and two-step verification.
- Never share sign-in codes. Woodkraft will never ask for them.
- Pay only inside Woodkraft, never to a personal mobile money number.
- Download Woodkraft only from woodkraftgh.com.
Reporting a security problem
If you find a weakness, email support@woodkraftgh.com with the subject "Security", and include enough detail for us to reproduce it. We reply within 3 working days. We won't take action against anyone who reports in good faith, doesn't access or change other people's data beyond what is needed to show the problem, doesn't disrupt the service, and gives us reasonable time to fix it before telling others.