Cloud & DevOps Company in Accra

Regulatory reporting obligations dominate an Accra cloud budget ahead of instance counts, because the Bank of Ghana 72-hour incident timeline has to be engineered for rather than documented afterwards. Engagements come in three sizes: a scoped Accra cloud landing zone (AWS af-south-1 or Azure South Africa North, Terraform or Bicep IaC, BoG and DPC control mapping, baseline observability) over eight to twelve weeks, a production platform with EKS or AKS, GitOps pipelines, secrets management on Vault or Key Vault, a full Bank of Ghana cloud risk register, and a Cyber Security Authority Act 1038 incident playbook, or ongoing managed SRE keyed to the Bank of Ghana 72-hour incident timeline, with on-call rotation across Chandigarh and Edmonton plus Dubai-office daytime leads. Cedi devaluation from roughly 6 to 15 GHS per USD between 2022 and 2025 means every contract carries explicit GHS-USD hedging. Fixed fee, no daily rates.

Yes, and it is the single most-asked-about regulation in any Accra banking cloud engagement. The Bank of Ghana Cyber and Information Security Directive (BG/GOV/SEC/2018/02, with the substantive 2023 update) requires regulated institutions — GCB Bank, Ecobank Ghana, Stanbic, Absa Ghana, Fidelity, Access Bank Ghana, CalBank, Republic Bank, the savings and loans tier, and licensed payment service providers — to evidence cloud risk management, third-party concentration risk, data residency choices, incident notification within 72 hours of detection of a major incident, and board-level cyber governance attestation. We deliver a BoG-aligned cloud risk register at landing-zone delivery, control mappings on every Terraform or Bicep module, and a runbook that connects AWS GuardDuty or Microsoft Defender for Cloud findings directly to the BoG Financial Stability Department reporting template. For payment service providers we additionally cover the Payment Systems and Services Act 2019 (Act 987) and the BoG Fintech and Innovation Office's sandbox notification expectations. The output is what your internal audit and the BoG inspectorate each need.

Every Accra cloud architecture we ship assumes the submarine cable layer will fail. MainOne (now Equinix MN1) cut on 14 March 2024 affecting most of West Africa for over a week, ACE has had multiple cuts in the last five years, and WACS, SAT-3/WASC, and ACE all share landing constraints that create correlated risk during storm or anchor-drag events. We address this at three layers. First, multi-path egress from Accra so traffic to af-south-1 or Azure South Africa North can take MainOne, CSquared, or a backup via Lagos (WACS Lagos landing) and 2Africa or PEACE onward to Cape Town or Marseille. Second, application-layer resilience — quorum-tolerant databases, idempotent payment APIs, and DNS-driven failover with health checks at the regional cloud edge, not just the Accra perimeter. Third, a documented incident playbook that names the specific cable IDs, the Ghana cable consortium contacts, and the BoG and Cyber Security Authority notification triggers if the outage rises to a critical information infrastructure event under Act 1038.

Yes. There is no hyperscaler region in Ghana — AWS, Azure, and Oracle all run their nearest African footprint from Cape Town (AWS af-south-1) or Johannesburg (Azure South Africa North, Oracle Cloud JHB). For Ghana Data Protection Act 2012 compliance, that means every production cloud workload is a cross-border transfer under Section 47 and requires either DPC consent, adequacy reliance, or contractual safeguards. We deliver a documented Section 47 transfer assessment as part of landing-zone scope, controller-processor agreements aligned with Section 30 of Act 843, and where the workload is sensitive (Bank of Ghana directive Tier 1 or 2 data, health data under the Public Health Act 2012) we additionally architect local data staging — Africa Data Centres ACC1 in Accra, the MainOne data centre at Tema, or the NITA government data centre — with only the processing horizon crossing to af-south-1 or Azure South Africa North. The DPC has been issuing notices on this since 2022, so the documentation matters.

The Cybersecurity Act 2020 (Act 1038) gave the Cyber Security Authority licensing powers over cybersecurity service providers, cybersecurity practitioners, and operators of critical information infrastructure (CII). The CSA published practitioner and provider accreditation regulations in 2022-2023 and has been operationalising them since. We ship our Accra cloud engagements with a clear delineation — Codazz delivers the platform engineering, IaC, GitOps, observability, and FinOps; CSA-accredited local cybersecurity service providers (we maintain working relationships with several Accra firms) handle the licensed activities including security operations centre work, penetration testing, and CII risk assessment where the engagement requires them. The split is documented in the SoW, the CSA notification (where the workload touches CII) is filed in advance, and the deliverable map shows which artefacts are produced by which party. This avoids the situation where a non-licensed vendor finds itself on the wrong side of CSA enforcement halfway through a banking cloud migration.

Yes. Codazz runs SRE rotations across three hubs — Chandigarh (UTC+5:30), Edmonton (UTC-7), and our Dubai office (UTC+4) — which gives full 24-hour cover with the Dubai office at a 1-3 hour offset from Accra during the synchronous client window. For Bank of Ghana regulated workloads we staff on-call rotations that include an Accra-aware incident commander on every shift, a documented escalation tree that names the client's BoG Designated Officer and Cyber Security Authority Point of Contact, and Slack or Teams bridges that open within five minutes of a P1. Mean time to acknowledge sits under ten minutes across all three hubs. Monthly SRE reports cover SLO attainment, BoG and DPC incident counts, MainOne and CSquared link health, ECG power continuity events affecting on-prem dependencies, and a forecast of the next month's risk posture. Fixed-fee monthly retainer, with cedi-USD hedging in every contract.

Accra's grid is more reliable than Lagos or Johannesburg today, but dumsor (load-shedding) returned in measurable stretches in 2024, and the Electricity Company of Ghana publishes rolling timetables when capacity tightens. For pure cloud-native workloads on af-south-1 or Azure South Africa North this is a non-issue at the workload tier. For hybrid workloads — banks with on-prem core systems still anchored at head office (typical for GCB, Ecobank Ghana, Stanbic), oil and gas operators with onshore data centres, telcos with edge POPs — we architect explicit power-failure runbooks. UPS sizing and diesel runtime covering ECG worst-case schedules, an Active Directory and identity replication topology that survives a head-office outage, DNS and BGP advertisements that withdraw cleanly so traffic does not blackhole, and a documented quorum quorum-loss recovery procedure for clustered databases. We have run this for clients through multiple dumsor cycles and ECG planned-maintenance windows.

Yes. Every fintech and mobile money cloud platform we ship in Accra integrates with the Ghana Interbank Payment and Settlement Systems (GhIPSS) rails — GhanaPay, gh-link, GHIPSS Instant Pay, the Cheque Codeline Clearing system, and the e-zwich biometric platform. For payment workloads that fall under the e-Levy (the 1 percent electronic transaction levy introduced in 2022 and amended in subsequent budget cycles), our platforms maintain an immutable audit log keyed to the Ghana Revenue Authority transaction reconciliation feed, with retention aligned to the Income Tax Act 2015 (Act 896) record-keeping requirements. The GRA Integrated Tax Application and Preparation System (ITaPS) and the e-Levy collection workflow are documented in the platform runbook so a tax audit or a BoG concurrent supervision exercise finds the right artefact in the right place. For mobile money settlement specifically, we have built reconciliation pipelines against MTN MoMo, AirtelTigo Money, and Telecel Cash patterns at the GSMA-documented scale.