Skip to content
Cloud
Scan free

Product · An option, never a requirement

Aspian Cloud governs changes wherever you deploy, so nobody has to move. Cells are for organisations whose data must stay in one jurisdiction, or who want us to run everything. Each cell holds apps, databases, logs and backups in one country, and keeps serving if our control plane is unreachable.

Book a 20-minute walkthroughCompare with other hosts

A residency report lists every volume, backup and artifact with its location. Any processing outside the jurisdiction, such as messaging providers, is named on the sub-processor list.

Aspian Cloud/Kestrel Pay/payments-api

payments-api

Stored in LagosSynthetic demo data

Card payments and refunds for merchants

VisitDeploy

Awaiting approvalProduction change: Add partial refunds to payments

T. Adeyemi and K. Okafor were notified on WhatsApp at 10:31. You asked for it, so you can’t approve it.

View deployment

Production

Healthy
Server response, p95, last hour
138 ms
Current deployment
Fix settlement CSV export, 4 Nov
Domains
payments-api.apps.example
Source
main @ 9c1e7b2
Rollback restores the previous release: app code and environment variables. It does not reverse a migration; each migration has a tested down-migration.

Recent deployments

View all

  • Add partial refunds to payments

    main @ a81d03f

    Production

    Awaiting approval0 of 2 approvals

    Today 10:31

  • Add partial refunds to payments

    feat/partial-refunds @ a81d03f

    Preview

    ReadyMasked seed data

    Today 09:58

  • Fix settlement CSV export

    main @ 9c1e7b2

    Production

    CurrentCanary passed

    4 Nov

Resources

  • payments-db

    Postgres 17, high availability

    Healthy

    Drill passed 3 days ago

  • sessions

    Valkey 8

    Healthy

    12% memory used

  • alerts

    Messaging

    Healthy

    WhatsApp, then SMS

Agents

Coding agent key owned by D. Eze, expires 28 Nov

1 blocked attempt this week: a production database change after reading logs. It went to approval instead of running.

An illustrative project overview on a dedicated cell, where production changes need two approvers. The company, app and people are fictional.

The everyday work stays one step.

A deploy to a preview, a scale within budget or a release rollback runs straight away and is logged. Nobody waits for an approval to try something out.

Deploy from GitHub
Connect a repository and push. Builds run on our servers, so a slow connection never stalls a release.
A preview for every branch
Each pull request gets its own address, seeded with masked or synthetic data. Real personal records stay in production.
Domains and certificates
Add your own domain. Certificates are issued and renewed for you.
Logs and metrics
Stream logs from the dashboard or the terminal, and watch response times and errors per release.

Deployments / dpl_8kd2

Add partial refunds to payments

Healthy

Production change with a database migration, requested by D. Eze

  1. Built

    10:32, 1 min 08 s

    • Built from main @ a81d03f on our servers, not a laptop
    • Image signed by the Aspian pipeline

  2. Checks passed

    10:33

    • Software bill of materials generated
    • Vulnerability scan: 0 critical, 0 high, 2 low
    • Secret scan clean, image signature verified
    • Migration adds one field and changes no existing rows
    • Down-migration tested; verified backup from 10:15 is the fallback

  3. Approved by 2 of 2

    10:42 and 11:05

    • T. Adeyemi, passkey on phone
    • K. Okafor, passkey on laptop
    • Both approvals bound to plan 7d3a9c…41fe

  4. Migration applied

    11:06

    • Added payments.refund_amount
    • 0 existing rows changed

  5. Rolled out

    11:06 to 11:21

    • Canary: 10% of traffic for 10 minutes, error rate 0.2% against a 2% limit
    • The canary would have rolled back the release if errors rose; the migration stays
    • Then 100% of traffic

  6. Healthy, and evidence recorded

    11:21

    • Server response p95: 142 ms
    • Change added to the Trust Page with both approvers
Audit entries 4,812 to 4,819, chain verified 11:22

Every deploy is one record, from commit to healthy.

The build, the checks, the approvals, the migration and the rollout sit on one timeline. When something goes wrong, you can see what happened without asking around.

Rollback says what it doesn’t undo

One step restores the previous release: app code and environment variables, with no approval needed. A release rollback does not reverse a database migration. Each migration ships with a tested down-migration, run as its own approved plan, and a verified backup is the fallback.

Managed Postgres and Valkey, with backups you’ve seen restore.

A database you can’t restore is a liability. So the platform tests recovery on a schedule, weekly and signed, and keeps the signed result where you, your board and your auditors can read it.

What managed databases include
High availabilityPostgres runs on CloudNativePG with a standby replica and automatic failover.
Point-in-time recoveryRestore to a chosen moment. Backups are kept in a second facility in the same country as your app.
Restore drillsWeekly and signed on dedicated cells, and on a schedule you set on shared ones. Each drill records the data loss, the restore time and whether checksums match.
Governed accessRead-only and scoped to one database by default. Writes to production go through a plan and an approval.
ValkeyFor caches, sessions and queues, in the same project, with its own tools.

payments-db

Passed

Restore drill, 3 days ago

Data lost
48 s
Time to restore
9 min 12 s
Checksums
Match
Each drill produces a signed certificate.

Only images our pipeline built and signed can run.

Every push goes through the same checks, in the same order. If a step fails, nothing reaches the cluster.

  1. 1

    Build

    On our servers, from the commit you pushed.

  2. 2

    Bill of materials

    Every package in the image is listed.

  3. 3

    Vulnerability scan

    A critical finding fails the build, unless waived with an expiry date.

  4. 4

    Secret scan

    A key or password left in the code fails the build.

  5. 5

    Sign

    The image is signed with the pipeline’s key.

  6. 6

    Admit

    The cluster refuses unsigned images and images signed by any other key.

From your terminal, or from your coding agent.

The aspian CLI covers the daily work. The MCP server lets AI coding agents do the same, under the same rules as your staff.

aspian login
Sign in to your Aspian Cloud account.
aspian deploy
Deploy the current branch. Add --prod to request production.
aspian logs
Stream logs for an app and environment.
aspian rollback
Return to an earlier release in one step.
aspian env
Set environment variables. Secret values are write-only.
aspian db
Open a scoped, read-only database session.
aspian export
Start an export of your project.

mcp session, key owned by D. Eze

Read customer content
agent read_logs payments-api --since 1h
      312 lines returned, session marked as having read logs

agent create_plan "add index on incidents.created_at"
      plan 3HX9-02LM, risk class: production change

agent apply_plan 3HX9-02LM
! refused: 403 SESSION_TAINTED
      approval requested from T. Adeyemi and K. Okafor

agent deploy --preview feat/refund-index
✓ preview ready, no approval needed

Every MCP tool has a risk class, and the class decides who must approve it. Reads and reversible changes run straight away. Database migrations and settings changes in production always need a person’s passkey.

Once an agent has read logs or customer data, anything it plans for production needs a person’s approval. Agents can use a secret but never see its value.

How risk classes and approvals work

A spend cap that never deletes your data.

At the cap, non-production apps pause and the owner is alerted on every channel. Production keeps running on a reserve of up to 20% above the cap for the rest of the billing month. If the reserve is used up, production scales down to its minimum size and new deploys wait for the owner to raise the cap. The most you can be billed for usage in a month is your cap plus 20%, and billing never deletes data.

Spend this month

82% of cap

Cap set by the account owner. The most you can be billed for usage this month is the cap plus 20%.

When the cap is reached

  • Previews and stagingPaused
  • OwnerOn every channelAlerted
  • ProductionOn a reserve of up to 20% above the cap, for the rest of the monthKeeps running
  • If the reserve is used upProduction scales to its minimum; new deploys wait for a higher capMinimum size
  • Databases and backupsNever deleted

Start an export in one step.

Your project comes out in formats other platforms and your own team can run. We test the bundle by booting it on a clean machine with no Aspian components.

Terraform
The infrastructure your apps need, as code you can apply elsewhere.
Helm charts
To install your apps on any Kubernetes cluster.
Docker Compose
To run your apps on a single machine.
Database dumps
Standard Postgres dumps you can restore with ordinary tools.

Secrets come back as a list of keys to re-enter, never as values. Credentials, DNS and third-party services still need transition work, and the bundle lists what’s left to do.

How we test the way out

Everything in one place, with nothing to bolt on.

The features teams expect from the best developer platforms, plus the controls and evidence regulated organisations need. Choose a group to see what it covers.

  • GitHub, GitLab and Docker images

    Deploy from a repository or a prebuilt image.

  • Server-side builds

    Builds run on our side with a shared cache, so a slow connection never matters.

  • Monorepos

    Point each service at its folder; only what changed rebuilds.

  • Preview for every branch

    Seeded with masked or synthetic data, asleep when nobody is using it.

  • Canary releases

    Send a slice of traffic first. If errors rise, the canary rolls back the release automatically.

  • One-step rollback

    Return to any earlier release. A release rollback does not reverse a database migration.

  • Config as code

    Describe services in a file in your repository, or manage them with Terraform.

  • Deploy hooks and webhooks

    Trigger deploys from anywhere and get told when they finish.

What cells cost

Hosting in the country you choose: shared cells billed on usage, or a dedicated cell from ₦6,500,000 / £9,500 a month on a 12-month term. Shared cells are billed on usage, by the hour:

Compute in Lagos or Abuja
₦12.50 per vCPU-hour, ₦6 per GB of memory an hour
Compute in London or the EU
₦5.50 per vCPU-hour, ₦2.75 per GB of memory an hour£0.012 per vCPU-hour, £0.006 per GB of memory an hour
Postgres storage, backups included
₦350 per GB a month£0.30 per GB a month
Volumes and object storage
₦150 per GB a month£0.10 per GB a month
Outbound data
₦60 per GB£0.04 per GB
Build minutes
₦10 a minute£0.005 a minute

Your spend cap

  • At the cap, non-production apps pause and the owner is alerted on every channel.
  • Production keeps running on a production reserve of up to 20% above the cap for the rest of the billing month, so a live app never goes down because of billing.
  • The most you can be billed for usage in a month is your cap plus 20%. Billing never deletes data.

Cells come with the change control of the tier you choose. See pricing.

Need your data to stay in one country?

Tell us where it must live and what runs on it. We’ll show you the residency report before you commit.

Ship like a startup. Prove it like a bank.

Scan my repos freeBook a 20-minute walkthrough