When Nigeria’s National Digital Addressing System (NDAPS) launched on October 1, it promised to replace informal, landmark-based navigation with precise 11-character alphanumeric codes. The system is designed to improve e-commerce deliveries, enable address verification for banking and identity services, and assign unique digital postcodes to addressable buildings nationwide.
Led by the Nigerian Postal Service (NIPOST) under the Federal Ministry of Communications, Innovation and Digital Economy, the initiative is intended to provide a reliable digital addressing infrastructure for the country.
TechCabal reported that technical checks of postcode.gov.ng’s public domain name system (DNS) records pointed to Amazon Web Services (AWS) infrastructure in the United States. The finding raised questions about whether a critical public digital asset was hosted abroad, just as Nigeria strengthens its push for data sovereignty.
“The system has distinct layers,” NIPOST spokesperson Ibrahim Musa told TechCabal in an email response. “Nigeria’s digital postcode infrastructure runs on both AWS and Galaxy Backbone—Nigeria’s official digital infrastructure and shared services provider—but they serve distinct functions.”
What AWS’s cloud services mean
AWS has infrastructure across 247 countries. It opened its first Nigerian office in Lagos in 2022 and has invested in an AWS Local Zone in Lagos to support customers and partners adopting its services locally.
The company told TechCabal that it does not disclose customer relationships without their permission.
“AWS is sovereign-by-design,” AWS Communications Manager for Sub-Saharan Africa, Sonwabise Mzinyathi, said in an email response. “We have infrastructure globally so organisations can run AWS services in their own facilities or in a location they specify, keeping data exactly where they need.”
AWS also points to its Nitro System, which uses specialised hardware and firmware to protect customer workloads running on Amazon Elastic Compute Cloud (EC2). It is designed to prevent outside access to those workloads, including by AWS employees.
The global cloud services provider stated that customers can also encrypt their data and manage their own encryption keys. “Customers who need to store and use encryption keys outside the AWS Cloud can use an AWS Key Management Service (AWS KMS) external key store,” said Mzinyathi, “retaining exclusive control over cryptographic material.”
AWS argued that its infrastructure is designed to remain available during supply chain disruptions, network interruptions and natural disasters. “We’ve instilled cloud resilience into our infrastructure, service design and deployment, operational model, and mechanisms to build more resilient cloud architectures,” the company said.
These capabilities, the company said, support its Digital Sovereignty Pledge, which promises customers greater control over where their data resides, how it is accessed, and how workloads are managed. However, these controls do not automatically determine where customer data lives. That decision ultimately depends on how the customer builds and manages its system.
The website is not the database
NIPOST emphasised that the public-facing postcode.gov.ng uses AWS’s global content delivery and web-protection services. These help pages load faster and protect the website against distributed denial-of-service (DDoS) attacks, which overwhelm online platforms with traffic until they become unavailable.
“The public website, postcode.gov.ng, uses AWS’s global content delivery and web-protection services, a standard approach used by many government and financial platforms to keep public portals fast and protected,” NIPOST told TechCabal.
The agency said Galaxy Backbone hosts and manages the core database. It contains the records that make the addressing system work, including building locations, geographic coordinates, and administrative boundaries.
Its technical team and private partners support development and maintenance under its direction.
“The content-delivery provider serving the public website does not host or have administrative access to the core database,” NIPOST said.
AWS helps deliver and protect the public website but, according to NIPOST, does not hold or manage the master postcode records. The database and its backups remain within Nigeria.
What Nigeria’s cloud policy says
NIPOST’s arrangement is based on the National Digital Cloud Policy, released by Communications Minister Bosun Tijani in August 2026, and NITDA’s supporting National Cloud Computing and Cloud Technical Guidelines.
The policy distinguishes between public information and sensitive government data, with different hosting requirements for each.
NIPOST considers public postcode lookups to fall under the policy’s “Open” data category, which has no data residency restrictions. This allows the public-facing website to use global infrastructure such as AWS.
The core database is treated differently. NIPOST said it applies controls consistent with the policy’s “Highly Sensitive” (Level 3) requirements, including keeping records within Nigeria and maintaining domestic disaster-recovery capabilities.
Using Galaxy Backbone also reflects the policy’s direction for federal agencies to meet their cloud hosting needs through the government’s shared services model.
However, NIPOST said it will still engage the Sovereign Government Cloud Governance Committee and NITDA on the system’s formal classification as the policy’s sovereignty framework is implemented.
Formal classification is still part of the process, even though NIPOST says its current hosting arrangements follow the relevant Level 3 controls.
In July, TechCabal examined whether Nigeria’s domestic data centre industry could support the Central Bank of Nigeria’s (CBN) directive requiring banks, fintechs and payment companies to move their transactional data from foreign cloud servers to infrastructure within the country by January 1, 2027. The directive is expected to trigger one of Nigeria’s largest cloud migrations.
NIPOST’s arrangement reflects a wider push to keep sensitive information within Nigeria.
The agency added that its hosting decisions balance security, resilience, cost, scalability and data sovereignty, with core infrastructure provided by government-owned Nigerian provider, Galaxy Backbone. It said the hosting arrangements would be reviewed as the use of NDAPS expands. It, however, didn’t disclose the contract details of the current hybrid arrangement, arguing that they are subject to public procurement rules.
Who controls the postcode database?
With the core database hosted locally, the next question is who can access or control it.
NIPOST said it retains ownership of NDAPS data and controls administrative privileges alongside Galaxy Backbone. The two organisations also manage the encryption keys protecting the system.
Private contractors and technical partners, including Milsat Technologies, do not have unrestricted access. NIPOST said service providers access the system only when necessary to perform their duties, under contractual confidentiality and data-protection obligations, role-based access controls and audit logging.
Banks, logistics companies and government agencies will connect to NDAPS through application programming interfaces (APIs), allowing different software platforms to exchange information. These integrations could let a bank verify an address or a delivery company locate a customer’s building without relying on informal landmarks.
NIPOST said access will be governed by agreements and limited to the location information required for service delivery.
“Personal data is not shared through these interfaces,” it said.
Although the platform provides location information rather than personal identity records, how organisations combine that information with their existing customer databases will matter for privacy.
Can local infrastructure handle the demand?
Keeping the database in Nigeria addresses where the information lives, but not necessarily how reliably it can be accessed.
Galaxy Backbone will support the infrastructure behind a system expected to serve banks, logistics companies and government agencies through automated queries. As adoption grows, demand will increase.
Nigeria’s domestic hosting environment faces practical challenges, including unreliable power supply, fibre cuts and network disruptions. Local providers must demonstrate that they can maintain services and recover quickly when infrastructure fails.
NIPOST said NDAPS has primary databases, replicas, backups and disaster-recovery arrangements within Nigeria. It added that the system undergoes regular testing and continuous monitoring to restore services following cyber incidents, infrastructure failures or loss of access to a hosting environment.
But having backup arrangements is different from showing they can withstand a major disruption. The real test will be how quickly the system can recover when millions of users and businesses depend on it.
The outstanding data protection question
Another compliance question concerns the system’s data protection assessment.
NIPOST confirmed that its Data Protection Impact Assessment (DPIA) is still in progress and that it is engaging the Nigeria Data Protection Commission (NDPC) on the system’s data-processing arrangements.
A DPIA helps organisations identify privacy risks associated with systems that process personal information. NDAPS is designed to map buildings across Nigeria, creating a national location database that could become increasingly useful to banks, businesses and government agencies.
Although NIPOST said it doesn’t share personal data through its APIs, location information can become more revealing when combined with other datasets, particularly those held by financial institutions and government agencies.
While hosting the database on domestic servers satisfies data residency rules, location is only half the equation. The true test for NDAPS will be whether local infrastructure can deliver the uptime, automated query speeds, and disaster recovery that banks and logistics firms would need to make the system reliable.