Nigeria's National Digital Addressing System (NDAPS) went live on October 1, aiming to end the practice of locating places by informal landmarks and to replace it with exact codes of 11 letters and digits. The Nigerian Postal Service (NIPOST), working under the Federal Ministry of Communications, Innovation and Digital Economy, is running the project, which is meant to give the country dependable digital addressing infrastructure.
Among its stated goals are:
- smoother e-commerce deliveries;
- confirming addresses for banks and ID services;
- a one-of-a-kind digital postcode for each addressable building nationwide.
Technical checks on the public DNS (domain name system) records of postcode.gov.ng, according to TechCabal, point to the site being served from Amazon Web Services (AWS) machines in the United States. That discovery prompted concerns about a vital national digital asset being kept overseas at a time when Nigeria is stepping up its drive for data sovereignty.
Replying by email to TechCabal, NIPOST spokesman Ibrahim Musa said: “The system has distinct layers,” and added: “Nigeria’s digital postcode infrastructure runs on both AWS and Galaxy Backbone—Nigeria’s official digital infrastructure and shared services provider—but they serve distinct functions.”
NIPOST: What AWS's cloud offerings involve
Amazon Web Services (AWS) is present in 247 countries. Its Nigerian presence began in 2022 with a first office in Lagos, and it has additionally put money into an AWS Local Zone in the same city, built to make it easier for local customers and partners to take up its services.
TechCabal was informed by the company that customer relationships are never disclosed unless the customers themselves give consent.
“AWS is sovereign-by-design,” AWS Communications Manager for Sub-Saharan Africa, Sonwabise Mzinyathi, wrote in reply to questions by email. Describing the company's worldwide footprint, he said: “We have infrastructure globally, so organisations can run AWS services in their own facilities or in a location they specify, keeping data exactly where they need.”
AWS also cites its Nitro System, a design built on purpose-made chips and low-level software that shields the workloads customers run on Amazon Elastic Compute Cloud (EC2). The aim is to keep outsiders out, and that includes AWS's own staff.
According to AWS, its data centres and systems are designed to keep running whether a natural disaster hits, connections go down or supplies are interrupted. The company added: “We’ve instilled cloud resilience into our infrastructure, service design and deployment, operational model, and mechanisms to build more resilient cloud architectures,”
The company says these capabilities underpin its Digital Sovereignty Pledge, which hands customers greater say over the location of their data, the people permitted to access it, and the way their systems are operated. Even so, such controls alone cannot decide where customer data ends up being stored. Ultimately, that depends on the way each customer designs and manages its own environment.
Why the NIPOST public website and the database are separate things
According to NIPOST, its publicly accessible postcode.gov.ng website depends on global services from AWS, both to deliver its content and to protect it. Such services speed up how quickly pages appear and shield the site from DDoS attacks, in which a platform is flooded with so much traffic that nobody can get in.
“The public website, postcode.gov.ng, uses AWS’s global content delivery and web-protection services, a standard approach used by many government and financial platforms to keep public portals fast and protected,” NIPOST told TechCabal.
The agency explained that the central database, which holds the records the addressing system depends on, is hosted and managed by Galaxy Backbone. The records include:
- the locations of buildings;
- their geographic coordinates;
- the boundaries of administrative areas.
Development and upkeep are handled by its technical team, working with private partners, under its direction.
“The content-delivery provider serving the public website does not host or have administrative access to the core database,” NIPOST said.
NIPOST said AWS plays a part in serving and safeguarding the public website, yet it neither stores nor manages the master record of postcodes. That database, along with its backups, stays inside Nigeria.
What Nigeria's policy on cloud computing says
The basis for NIPOST's set-up is the National Digital Cloud Policy, which Communications Minister Bosun Tijani released in August 2026, together with the National Cloud Computing and Cloud Technical Guidelines that NITDA issued to back it up.
Under the policy, publicly available information is treated separately from sensitive government data, and each kind carries its own hosting rules.
NIPOST holds that looking up a postcode is a public service covered by the policy's “Open” data classification, which sets no restriction on where the data is held. Read that way, there is nothing improper about hosting the public website on global platforms such as AWS.
The main database is handled differently. NIPOST said its safeguards match the requirements the policy sets for “Highly Sensitive” (Level 3) data, which include holding records inside Nigeria and retaining disaster-recovery capacity in the country.
Choosing Galaxy Backbone also fits the policy's push for federal bodies to source their cloud hosting through the government-run shared services arrangement.
NIPOST added that it will nonetheless consult the Sovereign Government Cloud Governance Committee and NITDA on how the system should be formally classified, as the sovereignty framework under the policy is gradually introduced.
A formal classification exercise has yet to be completed, although NIPOST insists that its current hosting arrangement already meets the Level 3 controls that apply.
Back in July, TechCabal looked into whether the local data centre sector could cope with the Central Bank of Nigeria (CBN) rule requiring lenders, fintech companies and payment businesses to shift their transaction data from overseas cloud servers to facilities inside the country before January 1, 2027. Many observers anticipate that the rule will prompt one of the biggest cloud migrations Nigeria has seen.
The way NIPOST has arranged things is part of a broader drive to keep sensitive data on Nigerian soil.
The agency said that choosing where to host means balancing data sovereignty, security, resilience, cost and scalability, and that its core infrastructure comes from Galaxy Backbone, a Nigerian provider owned by the government. NIPOST said it would revisit the hosting arrangements as NDAPS grows in use. It did not, however, reveal the terms of the existing hybrid contract, saying these fall under public procurement rules.
See: Crypto stamp duty: Nigeria to make $75 million in 2027
Who has control of the postcode database?
Now that the core database sits within Nigeria, attention turns to who is able to reach it or hold authority over it.
According to NIPOST, NDAPS data remains its property, and it holds administrative privileges jointly with Galaxy Backbone. Both bodies also look after the encryption keys that secure the system.
NIPOST added that outside contractors and technology partners, Milsat Technologies among them, are not given free rein over the system. By its account, service providers get in only when their work demands it, and their contracts bind them to:
- confidentiality clauses and duties to safeguard personal data;
- access controls tied to each user's role;
- logging of every action for audit.
Banks, logistics firms and government agencies are to link up with NDAPS through APIs (application-programming links), which let different software platforms swap information. With such links in place, a bank might confirm where someone lives, or a courier firm might find a customer's building, with no need to depend on informal landmarks.
Agreements will govern who gets access, NIPOST said, and what is shared will be confined to the location details needed to deliver a service.
“Personal data is not shared through these interfaces,” it said.
The platform supplies location data and not personal identity records. Even so, privacy will hinge on how organisations merge that data with the customer databases they already hold.
Can local infrastructure cope with the demand?
Hosting the database inside Nigeria settles the question of where the data is stored, yet it does not automatically guarantee that the data can be reached dependably.
Galaxy Backbone is to provide support for the infrastructure underpinning a system that banks, logistics firms and government agencies are expected to use via automated queries. Demand will rise as more people adopt it.
Hosting within Nigeria comes with real-world difficulties, among them erratic electricity, severed fibre cables and network outages. Domestic providers need to prove that they can keep services running, and bring them back swiftly whenever infrastructure breaks down.
According to NIPOST, NDAPS keeps its main data stores, copies, backup files and disaster-recovery provisions inside Nigeria itself. It added that the platform is put through regular tests and monitored around the clock, so that services can be restored after hacking attacks, infrastructure failures or the loss of a hosting environment.
Still, the existence of contingency arrangements is no proof that they would hold up through a major outage. What will count most is how fast the system can bounce back when millions of people and businesses are relying on it.
The unresolved data protection question for NIPOST
A further compliance matter involves the way the privacy safeguards of the system have been assessed.
According to NIPOST, work on its Data Protection Impact Assessment (DPIA) has not yet been completed, and the agency is in talks with the Nigeria Data Protection Commission (NDPC) over how the system will handle data.
Organisations use a DPIA to spot the privacy risks that come with systems handling individuals' private details. NDAPS is built to chart buildings nationwide and produce a countrywide address register, which lenders, companies and public-sector bodies may find ever more valuable.
NIPOST says no individual-level details are passed on through its APIs. Even so, location details can reveal much more once they are joined with other datasets, especially those kept by banks and other lenders, or by state bodies.
Keeping the database on servers inside Nigeria meets data residency requirements, yet the physical location of the data is just one piece of the puzzle. The future of NDAPS will turn on whether infrastructure in the country can offer the availability, the quick handling of automated queries, and the backup and recovery capacity that lenders and logistics companies would demand before depending on it.
