Aspian Cloud keeps your systems in one jurisdiction, keeps secret values away from people and agents, and records every change in an audit trail you can verify without asking us.
Each cell is a self-contained cluster in one jurisdiction.
Your apps, databases, logs, backups and audit records stay inside the cell you choose. The cell holds everything it needs to keep running, so if our central control plane is unreachable, your apps keep serving. Only new deploys pause.
| Cell | For | Backups go to |
|---|---|---|
| LagosFor Nigerian data. | For Nigerian data. | A second Lagos facility |
| AbujaFor Nigerian data, close to federal government. | For Nigerian data, close to federal government. | A second facility in Nigeria |
| LondonFor UK data. | For UK data. | A second UK provider |
| European UnionFor workloads with no residency requirement. | For workloads with no residency requirement. | Separate storage in the EU |
| Your data centreThe same platform on your hardware, run by Aspian. | The same platform on your hardware, run by Aspian. | Storage you choose, in your jurisdiction |
Control plane
UnreachableDeploys, plans and dashboards
Lagos cell
Self-contained cluster, one jurisdiction
- AppsServing traffic
- Databases and backupsRunning
- Logs and audit recordsWritten locally
- New deploysPaused until the link returns
Every store is listed, including the ones outside the country.
Data is stored where you agreed. Some services process it elsewhere, and we name each one rather than leave it out.
WhatsApp and email providers process messages outside Nigeria. For Nigerian organisations, those messages carry only an alert code and a secure link, never the details. If you connect an AI coding agent, what it reads goes to its model provider.
Where guard-roster’s data is stored and processed
Kings Guards, production
| Data | Location | Placement |
|---|---|---|
| App and databases | Lagos cell, primary facility | ObservedToday 10:00 |
| Backups | Second Lagos facility | ObservedToday 06:00 |
| Logs and build artefacts | Lagos cell | ObservedToday 10:00 |
| Audit records | Lagos cell, anchored to write-once storage | ObservedToday 10:00 |
| SMS alerts | Nigerian SMS provider | ConfiguredAwaiting verification |
| WhatsApp and email alerts | Providers outside Nigeria | DisclosedAlert code and link only |
| AI coding agent via MCP | Model provider, outside Nigeria | DisclosedLogs it reads leave the cell |
Secrets go in. Their values don’t come back out.
Secrets are stored in OpenBao with a write-only policy. No dashboard, API, CLI command, MCP tool, log or export shows a stored value.
AI agents get a handle they can pass to a deploy, not the value. Only the running app receives it, scoped to its own environment.
DATABASE_URL
Write-only- Dashboard, CLI and API
- Name, version 3, updated by D. Eze on 2 Nov. Replace or delete only.
- AI agent through MCP
- A handle it can pass to a deploy: secret://guard-roster/production/DATABASE_URL
- Logs and exports
- The key name, never the value
- The running app
- The value, at runtime, scoped to this app and environment
Other customers can’t reach your apps or your rows.
Isolation doesn’t rest on one control. Each layer assumes the one above it might fail.
- Sandboxed runtimes
- Every app runs in a gVisor or Kata sandbox, so code that escapes its container still meets another boundary before the host.
- Dedicated nodes
- Regulated organisations get machines of their own inside the cluster. Their workloads don’t share a node with another tenant.
- Row-level security
- In the platform’s database, every tenant-owned table carries a policy that limits each request to one tenant’s rows.
- Signed images only
- The cluster admits only images built and signed by our pipeline. Unsigned images, or images signed by another key, are refused.
An audit trail that shows if anyone has changed it.
Each tenant has its own chain. Every entry carries the hash of the entry before it and an Ed25519 signature from a key held outside the app.
The database refuses edits and deletes. A database administrator could still try, so every hour the chain head is copied to write-once storage outside the database, and the verifier checks against it.
Entry 4,817
SignedApproval by T. Adeyemi
Person, passkey
- previous
- 9f2c…a41e
- this entry
- 1b7d…03c9
Entry 4,818
SignedApproval by K. Okafor
Person, passkey
- previous
- 1b7d…03c9
- this entry
- e45a…7f10
Entry 4,819
SignedMigration applied
System, plan 7Q2F
- previous
- e45a…7f10
- this entry
- 6c08…d2b4
Chain head 6c08…d2b4 anchored to write-once storage
11:00, next anchor 12:00
The riskiest actions need more than one person.
That includes us. Aspian staff go through the same plans, approvals and audit trail as your own team.
- Passkeys bound to the plan
- An approval is a passkey signature over the exact plan the approver reviewed. If the plan changes, the approval no longer counts.
- Two-person control
- Regulated work needs two named approvers. Neither can be the person who asked, and one person can’t approve twice.
- Operators work through runbooks
- Our staff and your trained operators act through named runbooks and narrow grants, scoped to a tenant, app and environment.
- Break-glass is the exception
- Direct access to a cluster needs two approvals, expires on a timer and is recorded in full.
A way out that we test.
We run export drills: the bundle is booted on a clean machine and a clean cluster with no Aspian components. The date and result of the last drill appear on your Trust Page.
The bundle includes
- Your apps as Terraform, Helm charts and Docker Compose
- Database dumps you can restore with standard tools
- Your runbooks, operator training and authorisation records
- Your incident and change history
Secrets come back as a list of keys to re-enter. Credentials, DNS and third-party services still need transition work, and the bundle lists it.
Bring us the system you can't afford to get wrong.
We are opening Aspian Cloud to organisations in stages. Create an account and we will set up your workspace, or talk to us about the systems you run today.