Managed IT · Cybersecurity · Fractional CTO · East and West Africa
We run 24×7 IT operations for regulated banks and fintechs, institutions on a data-residency clock, operators whose stack has outgrown their team, and hospitals, insurers and export-led agribusiness. Bank-grade NOC from Bangalore, Fractional CTO leadership from Nairobi.
Auto-plays all four demos in sequence · tap a tab to explore · sound off · data-residency and agritech demos are indicative wireframes
Five one-tap questions. Your score appears on screen before you share anything.
Each level is bought on its own and judged on its own deliverable. Most institutions start at P0 or P1. A best practice found with one client ships to every client we run.
Always-on, BOU-grade IT operations for regulated financial institutions. Your IT team, without building one.
Regulated workloads, and their recovery, now have to live in-country. We move the workload with zero customer-visible downtime and hand your regulator the evidence.
Grade A is built to be submitted to your supervisor; Grade B is built to be fixed fast. Manually validated penetration testing in both.
Benchmarked to BOU, CBK BS-SOC, BOT, BNR, BoG CISD 2026 and BOM, cross-mapped to NIST CSF and ISO/IEC 27001 Annex A.
Clinical systems that stay up, departments that see their margins daily, claims desks with evidence attached, and one export trail your EU buyer and your funder can both read.
Export & Funder Compliance Desk: E0 map → E1 evidence pipeline → E2 sustain. EUDR binds large and medium operators from 30 Dec 2026, SMEs from 30 Jun 2027.
Regulated Institutions for banks, payment operators, hospitals, insurers and agribusiness; Enterprise & Investors for telcos, acquirers and funds.
Regulators now require regulated workloads, and their recovery, to live in-country. The deadline is the trigger; the migration itself is the risk, and we engineer it for zero downtime.
In-country hosting for regulated workloads; board-level cyber expertise; quarterly penetration testing. FICSOC oversight extends to savings & loans, microfinance and fintechs.
Payment-system data localisation with supervisory sanctions stated.
Mission-critical systems hosted in-country; foreign data centres prohibited for them. Board-commissioned independent cyber audits are on the way under the draft guidelines.
Banks keep primary data inside Rwanda and run a documented cybersecurity programme.
Data-flow map and workload inventory, gap analysis against your regulator’s instrument, in-country hosting options paper, dual-run budget and board scorecard. Read-only, approvable at CIO discretion.
In-country landing zone, runbook with rehearsed rollback, 24/7 dual-run monitoring from our Bangalore NOC, zero-downtime cutover, DR in-country from day one.
Regulator-mapped attestation pack, hosting and DR-in-country proof, audit trail structured for direct submission, board sign-off deck.
Fast to answers. Proven under a regulator’s gaze.
95%+ transaction success held through migration-grade change on Bank of Uganda–licensed payment infrastructure serving a 50+ institution network, under a completed contract with a penalty-backed SLA. One 30-minute conversation places your institution on the clock.
Banking made us rigorous. The same discipline now runs telco stacks, hospital wards and export trails.
Central-bank oversight, legacy modernisation, BOU / CBK / BoT compliance filing.
Rapid growth with small IT teams: core upgrades, MDI regulatory alignment, licence-renewal evidence, member protection and cooperative-bank oversight.
24/7 operations, settlement risk, security hardening, BOU PSO standard; agent onboarding, KYC/AML integration and transaction monitoring.
Building on regulated rails: central-bank API integration, compliance-as-code, Fractional CTO leadership.
Telecom, logistics, SaaS, manufacturing: runbook IT on Day 1, refactoring where the ticket data says.
EMR / HMIS uptime is patient safety; margins per department; claims evidence the IRA now expects. Patient-data protection built in: Kenya DPA 2019, Digital Health Act 2025 and regional equivalents.
EUDR due-diligence statements backed by plot-level geolocation, and funder evidence from the same trail.
Technology due diligence before you commit, fractional CTO or CPO cover after. LP and pipeline work lives on our Capital & Corridor desk.
Aarthi Ramasubramanian’s Setuya Afrika connects impact investors with operators across East and West Africa. aarthi@dtalpha.co
Through our signed channel partnership with EVAD Africa and the BluScout platform, selected to satisfy BOU, BOT, BNR, CBK, CBN and BoG mandates, run from our 24/7 NOC.
Logs, network traffic and endpoints correlated; your VPC or fully on-premise, air-gapped if needed. RBAC, audit trails and retention controls built in.
Maps to: residency and continuous monitoring: BNR residency, BOU FHC local accountability, Ghana CISD, CBN localisation
Just-in-time access, vaulting and full session recording: the evidence auditors ask for.
Maps to: privileged-access control in every central-bank framework
SSO, adaptive MFA and lifecycle governance, least-privilege access enforced and evidenced from joiner to leaver.
Maps to: BOU / BNR / CBK identity controls
Persistent file-level encryption, information-rights management, OS-level screen watermarking and zero-trust file sharing across cloud and on-premise.
Maps to: customer-data confidentiality, FATF AML evidence
EDR, deep-file malware analysis, AI-assisted SOC layer and internet-exposure visibility.
Maps to: SEV-1 detection and regulator reporting windows
Breach-and-attack simulation, vulnerability and patch management, application testing.
Maps to: control-effectiveness evidence for the board
EVAD Africa (signed channel partner, Dubai and Nairobi) · BluScout (SIEM with native NDR, 100+ MITRE ATT&CK rules) · documentation available for procurement due diligence on request.
Approved affiliate partner: ManageEngine IT management and Zoho One, Mail and CRM, configured and run under the same runbook discipline.
The monthly board pack format we ran for a Bank of Uganda–licensed operator, and the day-10 scorecard every residency programme starts with. Illustrative data.
Monthly pack for the board risk committee · 30-day window
R0 assessment · Ghana and Tanzania subsidiaries · every workload and its recovery
| Workload | Runs today | Recovery | Against BoG CISD / BOT Cloud | Plan |
|---|---|---|---|---|
| Core banking | Offshore cloud | Offshore | Gap | R1 cluster 1, weeks 1–8 |
| Payments switch | In-country DC | In-country | Compliant | Evidence only (R2) |
| Mobile and internet banking | Hybrid | Offshore | Partial | R1 cluster 2 |
| DR and backups | Offshore | — | Gap | DR in-country with cluster 1 |
| Data warehouse | Offshore SaaS | Vendor | Review | Options paper: two local hosts |
We served as Fractional CTO and managed IT partner to a Bank of Uganda–licensed payment system operator: platform operations, security and regulatory compliance across a 50+ institution network. The runbooks written for payment switches now run telco and platform stacks, and the same NOC standard extends to hospital clinical systems.
Founder & Fractional CTO · named accountable CTO on every engagement
For managed IT, data residency, cybersecurity, runbook IT, hospital and insurer IT, and digital transformation. Venkatram replies within one business day.