When Nigeria’s National Digital Addressing System (NDAPS) launched on October 1, it promised to exchange casual, landmark-based navigation with exact 11-character alphanumeric codes. The system is designed to enhance e-commerce deliveries, allow deal with verification for banking and identification companies, and assign distinctive digital postcodes to addressable buildings nationwide.
Led by the Nigerian Postal Service (NIPOST) beneath the Federal Ministry of Communications, Innovation and Digital Economy, the initiative is meant to present a dependable digital addressing infrastructure for the nation.
TechCabal reported that technical checks of postcode.gov.ng’s public area identify system (DNS) information pointed to Amazon Web Services (AWS) infrastructure within the United States. The discovering raised questions on whether or not a crucial public digital asset was hosted overseas, simply as Nigeria strengthens its push for information sovereignty.
“The system has distinct layers,” NIPOST spokesperson Ibrahim Musa advised TechCabal in an e-mail response. “Nigeria’s digital postcode infrastructure runs on both AWS and Galaxy Backbone—Nigeria’s official digital infrastructure and shared services provider—but they serve distinct functions.”
What AWS’s cloud companies imply
AWS has infrastructure throughout 247 international locations. It opened its first Nigerian office in Lagos in 2022 and has invested in an AWS Local Zone in Lagos to assist prospects and companions adopting its companies regionally.
The firm advised TechCabal that it doesn’t disclose buyer relationships with out their permission.
“AWS is sovereign-by-design,” AWS Communications Manager for Sub-Saharan Africa, Sonwabise Mzinyathi, mentioned in an e-mail response. “We have infrastructure globally so organisations can run AWS services in their own facilities or in a location they specify, keeping data exactly where they need.”
AWS additionally factors to its Nitro System, which makes use of specialised {hardware} and firmware to shield buyer workloads working on Amazon Elastic Compute Cloud (EC2). It is designed to forestall outdoors entry to these workloads, together with by AWS workers.
The world cloud companies supplier said that prospects can even encrypt their information and handle their very own encryption keys. “Customers who need to store and use encryption keys outside the AWS Cloud can use an AWS Key Management Service (AWS KMS) external key store,” mentioned Mzinyathi, “retaining exclusive control over cryptographic material.”
AWS argued that its infrastructure is designed to stay out there throughout provide chain disruptions, community interruptions and pure disasters. “We’ve instilled cloud resilience into our infrastructure, service design and deployment, operational model, and mechanisms to build more resilient cloud architectures,” the corporate mentioned.
These capabilities, the corporate mentioned, assist its Digital Sovereignty Pledge, which guarantees prospects higher management over the place their information resides, how it’s accessed, and the way workloads are managed. However, these controls don’t routinely decide the place buyer information lives. That determination in the end will depend on how the shopper builds and manages its system.
The web site isn’t the database
NIPOST emphasised that the public-facing postcode.gov.ng makes use of AWS’s world content material supply and web-protection companies. These assist pages load sooner and shield the web site towards distributed denial-of-service (DDoS) assaults, which overwhelm on-line platforms with site visitors till they turn out to be unavailable.
“The public web site, postcode.gov.ng, makes use of AWS’s world content material supply and web-protection companies, a normal strategy utilized by many authorities and monetary platforms to maintain public portals quick and guarded,” NIPOST advised TechCabal.
The company mentioned Galaxy Backbone hosts and manages the core database. It incorporates the information that make the addressing system work, together with constructing places, geographic coordinates, and administrative boundaries.
Its technical group and personal companions assist growth and upkeep beneath its route.
“The content-delivery provider serving the public website does not host or have administrative access to the core database,” NIPOST mentioned.
AWS helps ship and shield the general public web site however, in accordance to NIPOST, doesn’t maintain or handle the grasp postcode information. The database and its backups stay inside Nigeria.
What Nigeria’s cloud coverage says
NIPOST’s association is predicated on the National Digital Cloud Policy, launched by Communications Minister Bosun Tijani in August 2026, and NITDA’s supporting National Cloud Computing and Cloud Technical Guidelines.
The coverage distinguishes between public data and delicate authorities information, with totally different internet hosting necessities for every.
NIPOST considers public postcode lookups to fall beneath the coverage’s “Open” information class, which has no information residency restrictions. This permits the public-facing web site to use world infrastructure resembling AWS.
The core database is handled otherwise. NIPOST mentioned it applies controls per the coverage’s “Highly Sensitive” (Level 3) necessities, together with maintaining information inside Nigeria and sustaining home disaster-recovery capabilities.
Using Galaxy Backbone additionally displays the coverage’s route for federal companies to meet their cloud internet hosting wants by way of the federal government’s shared companies mannequin.
However, NIPOST mentioned it’s going to nonetheless interact the Sovereign Government Cloud Governance Committee and NITDA on the system’s formal classification because the coverage’s sovereignty framework is applied.
Formal classification remains to be a part of the method, despite the fact that NIPOST says its present internet hosting preparations observe the related Level 3 controls.
In July, TechCabal examined whether or not Nigeria’s home information centre business might assist the Central Bank of Nigeria’s (CBN) directive requiring banks, fintechs and fee corporations to transfer their transactional information from international cloud servers to infrastructure inside the nation by January 1, 2027. The directive is anticipated to set off certainly one of Nigeria’s largest cloud migrations.
NIPOST’s association displays a wider push to maintain delicate data inside Nigeria.
The company added that its internet hosting choices stability safety, resilience, value, scalability and information sovereignty, with core infrastructure offered by government-owned Nigerian supplier, Galaxy Backbone. It mentioned the internet hosting preparations can be reviewed as the usage of NDAPS expands. It, nonetheless, didn’t disclose the contract particulars of the present hybrid association, arguing that they’re topic to public procurement guidelines.
Who controls the postcode database?
With the core database hosted regionally, the subsequent query is who can entry or management it.
NIPOST mentioned it retains possession of NDAPS information and controls administrative privileges alongside Galaxy Backbone. The two organisations additionally handle the encryption keys defending the system.
Private contractors and technical companions, together with Milsat Technologies, do not need unrestricted entry. NIPOST mentioned service suppliers entry the system solely when essential to carry out their duties, beneath contractual confidentiality and data-protection obligations, role-based entry controls and audit logging.
Banks, logistics corporations and authorities companies will join to NDAPS by way of utility programming interfaces (APIs), permitting totally different software program platforms to change data. These integrations might let a financial institution confirm an deal with or a supply firm find a buyer’s constructing with out counting on casual landmarks.
NIPOST mentioned entry will likely be ruled by agreements and restricted to the situation data required for service supply.
“Personal data is not shared through these interfaces,” it mentioned.
Although the platform offers location data fairly than private identification information, how organisations mix that data with their present buyer databases will matter for privateness.
Can native infrastructure deal with the demand?
Keeping the database in Nigeria addresses the place the data lives, however not essentially how reliably it may be accessed.
Galaxy Backbone will assist the infrastructure behind a system anticipated to serve banks, logistics corporations and authorities companies by way of automated queries. As adoption grows, demand will improve.
Nigeria’s home internet hosting atmosphere faces sensible challenges, together with unreliable energy provide, fibre cuts and community disruptions. Local suppliers should show that they will preserve companies and get better rapidly when infrastructure fails.
NIPOST mentioned NDAPS has major databases, replicas, backups and disaster-recovery preparations inside Nigeria. It added that the system undergoes common testing and steady monitoring to restore companies following cyber incidents, infrastructure failures or lack of entry to a internet hosting atmosphere.
But having backup preparations is totally different from exhibiting they will face up to a significant disruption. The actual take a look at will likely be how rapidly the system can get better when hundreds of thousands of customers and companies depend upon it.
The excellent information safety query
Another compliance query considerations the system’s information safety evaluation.
NIPOST confirmed that its Data Protection Impact Assessment (DPIA) remains to be in progress and that it’s partaking the Nigeria Data Protection Commission (NDPC) on the system’s data-processing preparations.
A DPIA helps organisations determine privateness dangers related to techniques that course of private data. NDAPS is designed to map buildings throughout Nigeria, making a nationwide location database that might turn out to be more and more helpful to banks, companies and authorities companies.
Although NIPOST mentioned it doesn’t share private information by way of its APIs, location data can turn out to be extra revealing when mixed with different datasets, significantly these held by monetary establishments and authorities companies.
While internet hosting the database on home servers satisfies information residency guidelines, location is simply half the equation. The true take a look at for NDAPS will likely be whether or not native infrastructure can ship the uptime, automated question speeds, and catastrophe restoration that banks and logistics corporations would want to make the system dependable.
