Designing for a Platform That Assumes It's a Target

Most platforms are designed for the world as it usually is: mostly honest users, occasional bugs, the rare bad actor. Country Observers Mission on Governance (COMoG) is a Ghanaian governance watchdog — research, anti-corruption advocacy, policy work that names names. That role makes its own platform a more plausible target for tampering than the average nonprofit site, so we designed it starting from that assumption rather than bolting security on at the end.

The clearest expression of that is the audit log. Every sensitive action — a login, a report status change, someone viewing the donor list — gets an entry whose hash covers its own content plus the previous entry's hash. If someone with database access tried to quietly edit history, the chain breaks and it shows. The log isn't just a record; it's evidence that the record hasn't been altered.

The same assumption shaped how people report governance issues to COMoG: anonymously, by default, with rate limiting and a hashed IP rather than a stored one, so reporting something doesn't require trusting the platform with your identity.

It also shaped how staff access is structured. A Super Admin, a Content Editor, a Report Reviewer, and a Donor & Finance Manager see different slices of the system, not the whole thing — so a single compromised account has a narrower blast radius than it would on a platform where every staff login sees everything.

Ghana's Data Protection Act 2012 (Act 843) gives people the right to access, correct, or ask for erasure of their data. We built that as a real workflow with an enforced 30-day response window, not a page that says "email us" and hopes someone remembers to follow up.

COMoG's platform is live at countryobservers.org.