When Nigeria’s National Digital Addressing System (NDAPS) launched on October 1, it promised to substitute casual, landmark-based navigation with exact 11-character alphanumeric codes. The system is designed to enhance e-commerce deliveries, allow handle verification for banking and identification companies, and assign distinctive digital postcodes to addressable buildings nationwide.
Led by the Nigerian Postal Service (NIPOST) below the Federal Ministry of Communications, Innovation and Digital Economy, the initiative is meant to present a dependable digital addressing infrastructure for the nation.
TechCabal reported that technical checks of postcode.gov.ng’s public area title system (DNS) information pointed to Amazon Web Services (AWS) infrastructure within the United States. The discovering raised questions on whether or not a essential public digital asset was hosted overseas, simply as Nigeria strengthens its push for information sovereignty.
“The system has distinct layers,” NIPOST spokesperson Ibrahim Musa instructed TechCabal in an e mail response. “Nigeria’s digital postcode infrastructure runs on both AWS and Galaxy Backbone—Nigeria’s official digital infrastructure and shared services provider—but they serve distinct functions.”
What AWS’s cloud companies imply
AWS has infrastructure throughout 247 nations. It opened its first Nigerian workplace in Lagos in 2022 and has invested in an AWS Local Zone in Lagos to assist prospects and companions adopting its companies regionally.
The firm instructed TechCabal that it doesn’t disclose buyer relationships with out their permission.
“AWS is sovereign-by-design,” AWS Communications Manager for Sub-Saharan Africa, Sonwabise Mzinyathi, stated in an e mail response. “We have infrastructure globally so organisations can run AWS services in their own facilities or in a location they specify, keeping data exactly where they need.”
AWS additionally factors to its Nitro System, which makes use of specialised {hardware} and firmware to defend buyer workloads working on Amazon Elastic Compute Cloud (EC2). It is designed to stop exterior entry to these workloads, together with by AWS staff.
The international cloud companies supplier acknowledged that prospects also can encrypt their information and handle their very own encryption keys. “Customers who need to store and use encryption keys outside the AWS Cloud can use an AWS Key Management Service (AWS KMS) external key store,” stated Mzinyathi, “retaining exclusive control over cryptographic material.”
AWS argued that its infrastructure is designed to stay obtainable throughout provide chain disruptions, community interruptions and pure disasters. “We’ve instilled cloud resilience into our infrastructure, service design and deployment, operational model, and mechanisms to build more resilient cloud architectures,” the corporate stated.
These capabilities, the corporate stated, assist its Digital Sovereignty Pledge, which guarantees prospects better management over the place their information resides, how it’s accessed, and the way workloads are managed. However, these controls don’t robotically decide the place buyer information lives. That determination in the end relies on how the client builds and manages its system.
The web site isn’t the database
NIPOST emphasised that the public-facing postcode.gov.ng makes use of AWS’s international content material supply and web-protection companies. These assist pages load sooner and defend the web site towards distributed denial-of-service (DDoS) assaults, which overwhelm on-line platforms with site visitors till they grow to be unavailable.
“The public web site, postcode.gov.ng, makes use of AWS’s international content material supply and web-protection companies, a regular strategy utilized by many authorities and monetary platforms to preserve public portals quick and guarded,” NIPOST instructed TechCabal.
The company stated Galaxy Backbone hosts and manages the core database. It comprises the information that make the addressing system work, together with constructing places, geographic coordinates, and administrative boundaries.
Its technical group and personal companions assist growth and upkeep below its course.
“The content-delivery provider serving the public website does not host or have administrative access to the core database,” NIPOST stated.
AWS helps ship and defend the general public web site however, in accordance to NIPOST, doesn’t maintain or handle the grasp postcode information. The database and its backups stay inside Nigeria.
What Nigeria’s cloud coverage says
NIPOST’s association relies on the National Digital Cloud Policy, launched by Communications Minister Bosun Tijani in August 2026, and NITDA’s supporting National Cloud Computing and Cloud Technical Guidelines.
The coverage distinguishes between public data and delicate authorities information, with totally different internet hosting necessities for every.
NIPOST considers public postcode lookups to fall below the coverage’s “Open” information class, which has no information residency restrictions. This permits the public-facing web site to use international infrastructure reminiscent of AWS.
The core database is handled otherwise. NIPOST stated it applies controls per the coverage’s “Highly Sensitive” (Level 3) necessities, together with retaining information inside Nigeria and sustaining home disaster-recovery capabilities.
Using Galaxy Backbone additionally displays the coverage’s course for federal companies to meet their cloud internet hosting wants by way of the federal government’s shared companies mannequin.
However, NIPOST stated it would nonetheless have interaction the Sovereign Government Cloud Governance Committee and NITDA on the system’s formal classification because the coverage’s sovereignty framework is carried out.
Formal classification remains to be a part of the method, despite the fact that NIPOST says its present internet hosting preparations observe the related Level 3 controls.
In July, TechCabal examined whether or not Nigeria’s home information centre business might assist the Central Bank of Nigeria’s (CBN) directive requiring banks, fintechs and fee corporations to transfer their transactional information from international cloud servers to infrastructure throughout the nation by January 1, 2027. The directive is anticipated to set off considered one of Nigeria’s largest cloud migrations.
NIPOST’s association displays a wider push to preserve delicate data inside Nigeria.
The company added that its internet hosting selections stability safety, resilience, price, scalability and information sovereignty, with core infrastructure offered by government-owned Nigerian supplier, Galaxy Backbone. It stated the internet hosting preparations can be reviewed as using NDAPS expands. It, nonetheless, didn’t disclose the contract particulars of the present hybrid association, arguing that they’re topic to public procurement guidelines.
Who controls the postcode database?
With the core database hosted regionally, the following query is who can entry or management it.
NIPOST stated it retains possession of NDAPS information and controls administrative privileges alongside Galaxy Backbone. The two organisations additionally handle the encryption keys defending the system.
Private contractors and technical companions, together with Milsat Technologies, do not need unrestricted entry. NIPOST stated service suppliers entry the system solely when essential to carry out their duties, below contractual confidentiality and data-protection obligations, role-based entry controls and audit logging.
Banks, logistics corporations and authorities companies will join to NDAPS by way of utility programming interfaces (APIs), permitting totally different software program platforms to trade data. These integrations might let a financial institution confirm an handle or a supply firm find a buyer’s constructing with out counting on casual landmarks.
NIPOST stated entry will probably be ruled by agreements and restricted to the placement data required for service supply.
“Personal data is not shared through these interfaces,” it stated.
Although the platform supplies location data moderately than private identification information, how organisations mix that data with their current buyer databases will matter for privateness.
Can native infrastructure deal with the demand?
Keeping the database in Nigeria addresses the place the knowledge lives, however not essentially how reliably it may be accessed.
Galaxy Backbone will assist the infrastructure behind a system anticipated to serve banks, logistics corporations and authorities companies by way of automated queries. As adoption grows, demand will improve.
Nigeria’s home internet hosting setting faces sensible challenges, together with unreliable energy provide, fibre cuts and community disruptions. Local suppliers should display that they’ll keep companies and recuperate rapidly when infrastructure fails.
NIPOST stated NDAPS has major databases, replicas, backups and disaster-recovery preparations inside Nigeria. It added that the system undergoes common testing and steady monitoring to restore companies following cyber incidents, infrastructure failures or lack of entry to a internet hosting setting.
But having backup preparations is totally different from displaying they’ll stand up to a significant disruption. The actual check will probably be how rapidly the system can recuperate when tens of millions of customers and companies rely upon it.
The excellent information safety query
Another compliance query issues the system’s information safety evaluation.
NIPOST confirmed that its Data Protection Impact Assessment (DPIA) remains to be in progress and that it’s participating the Nigeria Data Protection Commission (NDPC) on the system’s data-processing preparations.
A DPIA helps organisations determine privateness dangers related to methods that course of private data. NDAPS is designed to map buildings throughout Nigeria, making a nationwide location database that would grow to be more and more helpful to banks, companies and authorities companies.
Although NIPOST stated it doesn’t share private information by way of its APIs, location data can grow to be extra revealing when mixed with different datasets, significantly these held by monetary establishments and authorities companies.
While internet hosting the database on home servers satisfies information residency guidelines, location is simply half the equation. The true check for NDAPS will probably be whether or not native infrastructure can ship the uptime, automated question speeds, and catastrophe restoration that banks and logistics companies would want to make the system dependable.
