Digital government programmes tend to spend their effort on the application layer — the registry, the portal, the payment integration — and to treat hosting as a procurement detail settled late. That ordering is backwards, because hosting is where sovereignty is actually decided, and it is the one decision that is expensive to reverse.

The four questions

A contract clause stating that data will be held in a particular way answers none of these. They are questions about physical reality.

Where is the equipment, physically? Not the company’s registered address — the building. Country, city, facility.

Who holds the keys to the room? Physical access is the most absolute form of access there is. Every other control sits on top of it.

Which company employs the engineer with administrative access? And under which country’s employment law and legal process.

Whose law applies to the building? This is the question that determines what happens when a third party makes a legal demand of your hosting provider, in their jurisdiction, about your citizens’ data.

An institution that can answer all four with “Somalia” has a sovereignty position. One that answers them with a platform name has a supplier relationship and a hope.

Why this was not a fair fight until recently

It is worth being honest about the history, because the choices ministries made were rational given what existed.

For most of the past two decades, hosting in Somalia meant a server in a ministry building — single power path, a split air conditioner, access controlled by whoever had a key. That is not a safeguard anyone can evidence, and the people running it knew that perfectly well. The alternative was a data centre on another continent: genuinely resilient, genuinely well run, and answering all four questions above with a country that is not Somalia.

Choosing the second was defensible. It was also a decision to place citizen records outside the state’s own jurisdiction, usually without that being the thing anyone thought they were deciding.

What changed

Carrier-neutral data centre capacity now exists in Mogadishu with 2N power distribution, N+1 cooling, controlled and logged access, and cross-connect to international submarine capacity in the same building. The technical characteristics are no longer the reason to host abroad.

Separately, the Data Protection Act of 2023 established a supervisory authority with a mandate over personal data in Somali territory. There is now both a regulator who may ask the four questions and an in-country answer that satisfies them.

What a ministry should actually specify

Three things, written into the requirement rather than discovered afterwards.

A named facility and jurisdiction. Not “in-country hosting” as an aspiration — the facility, with a right to inspect it. Data centres are one of the few things in procurement where a site visit tells you most of what you need.

Documented resilience, not asserted. Power topology, cooling topology, access procedure. A serious operator hands these over; it is a normal request.

An exit. How the data comes back, in what format, on what notice. Sovereignty includes the ability to leave — and a programme that cannot describe its exit has not really chosen its host, it has been absorbed by it.

What we do not do

We are an infrastructure operator. We run the facility, the connectivity and the ground segment underneath government systems; we do not build the registries, the portals or the applications, and we work alongside whoever does.

Saying so matters here more than elsewhere, because public-sector procurement rewards suppliers who claim the whole scope, and the programmes that stall are usually the ones where somebody did.