Walk into the server room of a well-run Somali institution and you will usually find the same arrangement: a rack or two in a converted office, a split air conditioner working harder than it was designed to, a UPS of uncertain age, and a door with a lock that several people have a key to. Nobody chose that. It is what you get when the only two options are this or a data centre on another continent.

That constraint has lifted, and it is worth being precise about what actually changed — because “there is a data centre now” is not by itself an argument for moving anything.

What the office room genuinely costs you

The equipment usually works. That is what makes the risk easy to defer: nothing has gone wrong yet, so the arrangement appears adequate. Four things are quietly true anyway.

Power is a single path. A UPS covers minutes and a generator covers a grid failure, but the distribution between them is almost always one route. Anything that interrupts that route — a board, a breaker, a cable, maintenance — takes the room down. There is no version of this where planned electrical work does not mean planned downtime.

Cooling is a single unit. When the split fails, and it fails in the hottest part of the year because that is when it is working hardest, the room’s temperature curve is steep. Most organisations discover their thermal shutdown threshold empirically.

Access is social rather than controlled. Who can enter that room is a matter of who has a key and who knows the arrangement, which is fine until you are asked to evidence it.

Connectivity is whatever the building has. Usually one circuit, on one path, to one provider, because that is what the office needed for email.

None of these are negligence. They are the honest consequence of hosting production systems in a space designed as an office.

What a facility changes, concretely

The difference is not that the equipment is better. It is that the failure modes have been designed for.

2N power means two independent distribution paths, so the facility is concurrently maintainable — work can be done on one path while the other carries the load. Planned maintenance stops being an outage.

N+1 cooling means a unit can fail or be serviced without the hall temperature rising.

Controlled, logged access means the answer to “who entered that room and when” is a record rather than a recollection.

Cross-connect to international capacity in the same building means your connectivity is a choice among carriers present in the meet-me room rather than whatever the landlord arranged.

The residency argument, stated properly

Somalia’s Data Protection Act came into force in March 2023, with a supervisory authority established under it. That does not, by itself, require anyone to move anything. What it does is make “where is the data, and can you evidence how it is protected” a question with a regulator behind it.

Before an in-country facility existed, an institution answering that question had two bad options: name the office room, which is hard to describe as a safeguard in writing, or name a facility in a jurisdiction the regulator has no reach into. Now there is a third answer — in Somalia, in a facility with a documented power and cooling topology, under Somali jurisdiction — and it is the only one that satisfies both halves of the question at once.

What not to move

We would rather say this than sell it.

If a system is already running well in a global cloud region, has no residency obligation attached, and its users are distributed internationally, moving it to Mogadishu will make it slower for those users and cost you a migration. Do not.

What genuinely belongs here is data with an obligation attached, systems whose users are in Somalia, content that would otherwise cross an ocean once per viewer, and restore points that need to exist in the country. That is usually a subset of the estate, not all of it — and a provider who tells you to move everything is selling racks rather than solving a problem.

The question to start from

Not “should we colocate” but “what would we say if the Data Protection Authority asked where our customer records are, and could we evidence it”. Most organisations find the answer takes an afternoon to establish and produces a short list of things nobody deliberately decided. Those are the cheapest problems you will ever fix.