Cloud & DevOps Company in Kigali

Kigali platform engagements are quoted as a foundation or as a production build, and the two are not close: a scoped Kigali cloud and DevOps engagement as an eight to twelve week foundation, or a production-scale build with EKS, AKS, or GKE Kubernetes, GitOps through ArgoCD or Flux, full FinOps tooling, NCSA-aligned breach response runbooks, and a documented BNR Directive 03/2017 posture for financial services scope. Scope drivers include an AWS or Azure landing zone, Terraform infrastructure-as-code, GitHub Actions or GitLab CI pipelines, a baseline observability stack, and a Rwanda Data Protection Law gap analysis. Managed DevOps and 24/7 platform operations sit on a fixed monthly fee structured around the workload class. We do not run open time-and-materials engagements because Rwanda Revenue Authority withholding tax and BNR offsite supervision audits require predictable invoicing.

The honest answer depends on the workload. For most SaaS, e-commerce, and donor-funded platforms, AWS af-south-1 in Cape Town at 90 to 150 milliseconds round trip from Kigali is acceptable and gives full access to managed services like RDS, Aurora, EKS, S3, and Bedrock. For latency-sensitive workloads (gaming, real-time video, interactive analytics) and for workloads where the NCSA, BNR Directive 03/2017, or donor data residency clauses explicitly require Rwandan soil, we deploy to the Rwanda National Data Center or Liquid Intelligent Technologies' Kigali facility, typically as a Kubernetes platform with managed object storage tiering back to af-south-1 for cost. Cloudflare's Kigali edge POP and the Rwanda Internet Exchange Point (RINEX) cut hot-path read latency to sub-30 milliseconds regardless of origin location. We document the residency decision in the platform's Records of Processing Activities and revisit it annually as African hyperscaler footprints evolve.

BNR Directive No 03/2017 on data protection in financial institutions and the BNR cybersecurity guidelines aligned with the National Cyber Security Authority framework set the floor. We build EKS, AKS, or sovereign on-premises Kubernetes clusters with private control planes, IRSA or Workload Identity for least-privilege pod permissions, network policies enforced through Calico or Cilium, runtime security through Falco, vulnerability scanning through Trivy or Snyk on every image, and audit logging streamed to a tamper-evident store with BNR-aligned retention. For BK Group and I&M Bank Rwanda scope we typically split workloads between an internet-facing zone (customer-facing apps) and a BNR-restricted zone (core banking adjuncts, RTGS interfaces) with strict east-west segmentation. PCI DSS scope follows the same hardening pattern. Cluster operations are handed back to the client's platform team with a documented runbook, not retained as a vendor lock-in.

The Rwanda Internet Exchange Point (RINEX) operated by RICTA, the SEACOM and EASSy submarine cable landings, and the Liquid Intelligent Technologies, MTN, Airtel, and BSC Rwanda fibre networks together define Kigali's connectivity reality. We peer client infrastructure into RINEX where it makes sense for traffic to local users, route Cloudflare and AWS Global Accelerator traffic through the closest edge POPs for international visitors, and design redundancy across at least two upstream providers so a SEACOM cable cut does not take a Kigali SaaS offline. For RwandAir and Kigali Aerotropolis aviation workloads we coordinate with Rwanda Civil Aviation Authority and IATA SITA messaging requirements. For BNR-regulated workloads we maintain dedicated MPLS or IPSec tunnels into the Rwanda Integrated Payments Processing System (RIPPS) rather than transiting open internet for RTGS messaging.

The National Cyber Security Authority (NCSA) operates under MINICT and has issued progressively stricter expectations on cloud workloads processing Rwandan personal data, financial data, and government records. In practice our NCSA-aligned baseline covers eight controls. Encryption at rest using AWS KMS, Azure Key Vault, or GCP KMS with customer-managed keys. Encryption in transit using TLS 1.2 or 1.3 only. Identity and access management through SSO with hardware MFA for privileged roles. Network segmentation through VPC subnets, security groups, and Calico or Cilium policies on Kubernetes. Centralised audit logging streamed to a tamper-evident store with at least 12 months retention. Vulnerability scanning on every image and every infrastructure-as-code change. A documented 72-hour breach notification runbook with NCSA contact paths. Quarterly disaster recovery drills with RPO and RTO targets. We map every control to specific Law N° 058/2021 articles and BNR Directive 03/2017 paragraphs where applicable.

Most Kigali clients book hyperscaler spend in US dollars but report budgets in Rwandan francs (RWF), and the Rwanda Revenue Authority has tightened its view on cross-border software spend through both VAT and withholding tax. Our FinOps practice produces monthly cost reports denominated in both RWF (at the prevailing BNR rate, currently around 1,200 RWF per USD) and USD, with month-over-month variance analysis, AWS Cost Explorer or Azure Cost Management drilldowns by tag, and Karpenter or Cluster Autoscaler tuning that targets the night-time idle window most Kigali workloads have. We default to Reserved Instances or Savings Plans for stable workloads, Spot for batch and CI, and S3 Intelligent-Tiering for object storage. For donor-funded programmes we structure cost reports against the donor's reporting cadence (USAID, FCDO, World Bank, GIZ, JICA) and produce the supporting evidence the grant manager actually needs.

Yes. Our default disaster recovery design pairs AWS af-south-1 (Cape Town) as the primary with AWS eu-west-1 (Ireland) or eu-west-2 (London) as the secondary, with RPO typically targeted at 15 minutes and RTO at one to four hours depending on workload tier. For BNR-supervised banking workloads we layer in a local Kigali warm standby at the Rwanda National Data Center or Liquid Intelligent Technologies Kigali so that a regional South Africa outage does not interrupt critical domestic services. Replication uses AWS DRS, Aurora Global Database, S3 Cross-Region Replication, and Karpenter cluster bootstrap automation. We run quarterly game days where the engineering team actually fails over to the secondary site rather than relying on documented runbooks alone, and we maintain a documented evidence trail suitable for BNR offsite supervision and NCSA audit.

Kigali sits in Central Africa Time (CAT, UTC+2). Our Dubai office is one hour ahead in Gulf Standard Time (UTC+4), giving overlapping working hours for the Kigali morning standup. Edmonton (Mountain Time, UTC-7 standard) and Chandigarh (India Standard Time, UTC+5:30) absorb overnight on-call so Kigali engineers do not have to wake up for a 02:00 PagerDuty alert. The on-call schedule rotates across the three hubs with primary, secondary, and escalation tiers, and every alert path includes a documented runbook. Incident retrospectives happen on Kigali working hours, never in a hand-off queue. For BNR-supervised banking clients we additionally maintain a cleared local responder relationship so that BNR or NCSA requests for on-site evidence can be handled within statutory timeframes. The whole arrangement is documented in the platform's service description and aligned with the client's data processing agreement.