Solutions — hosted in Nairobi, ke-1a
Infrastructure for what Kenya actually runs
Startups, agencies, enterprise and colocation are useful shortcuts, but the thing that decides your architecture is the workload. A digital lender receiving M-Pesa callbacks, a SACCO closing its month end, a newsroom on results day and a WISP answering RADIUS requests are four different problems that need the same building blocks. All of them run in ke-1a, in Nairobi, from KES 1,389 a month, billed in shillings. What follows is how to match your workload to the right shape — and the three things that change when the machine is in Kenya rather than Europe: the round trip, the invoice, and where the personal data sits.
For startups
Launch for $13.51, pay in local currency, and scale into the full stack when you win.
For startupsFor agencies
Run every client on one platform, white-labelled, with margin you keep.
For agenciesFor enterprise
Reliability, dedicated hardware, and data that stays in-country, under SLA.
For enterpriseColocation
Bring your own hardware into our Tier III facilities.
ColocationWho runs here
Eight Kenyan workloads and what each one needs
The segments that buy infrastructure in Kenya, described by what they run rather than the industry they sit in. Find the row that looks like your week.
Digital lenders and fintechs
The largest single story in Kenyan hosting. M-Pesa integration endpoints that must accept Safaricom callbacks without a cold start, credit-scoring batch jobs over alternative data, KYC document stores, loan-book databases, USSD gateway backends and disbursement queues. The Central Bank has processed over 800 digital credit provider applications since its 2022 regulations took effect, so this is a crowded and closely watched field. The callbacks originate in Kenya and so does the regulator. A production pair usually starts around KES 8,330 with the database on its own instance.
SACCOs and microfinance
A distinctively Kenyan institution: deposit-taking SACCOs sit under SASRA and run real core banking. Member portals, USSD and mobile channels, month-end and dividend batch runs that have to finish overnight, Paybill reconciliation jobs, and a core database nobody wants sharing a disk. Steady, sizeable, long-lived — a KES 16,510 or KES 32,870 instance, or a dedicated server where an auditor or a licence requires single tenancy, with backups scheduled into object storage in the same region.
Online retail
WooCommerce and Magento stores where checkout latency is felt at the exact moment a customer hands over money, plus mobile-money callback endpoints, inventory sync against supplier feeds, order-status pages shoppers refresh, and product images served from S3-compatible storage next door to the store. Kenyan retail runs on a long tail of sellers who started on social channels, so the sensible shape is a modest instance that resizes on promotion days rather than a fixed box sized for the worst hour of the year.
Newsrooms and publishers
Nairobi has an unusually strong media sector for a market this size, with a traffic pattern most countries lack: a general election every five years in August, budget day in June, and national exam results — hard, predictable, single-day spikes on top of an ordinary load. WordPress behind a cache, live-blog infrastructure, video and podcast assets in object storage, and the ability to take a machine from 4 vCPU to 32 and back down in the same week. Fixed hardware is the wrong answer for that calendar.
ISPs, WISPs and managed service providers
The Authority's fixed-ISP table has a long tail behind the leaders — Ahadi Wireless, Vilcom, Mawingu and a further 3.5% spread across dozens of regional operators. RADIUS and AAA, Splynx-style billing and provisioning, recursive resolvers and authoritative zones, NetFlow collectors, Zabbix and LibreNMS, speedtest and looking-glass nodes, IPAM. Several small instances rather than one large one, from KES 2,195 each, with private networking between them. This buyer runs a traceroute before reading any marketing, which is the correct order.
Agencies, resellers and the .ke long tail
KENIC counts roughly 123,150 registered .ke domains across 533 accredited registrars, and Nairobi's agency and freelance scene is where most of them end up pointed. One buyer, many client sites: multi-tenant hosting, staging environments, CyberPanel or Plesk installs, Git-based deploys, client mail, and white-label DirectAdmin plans for the work you would rather not run yourself. What matters is per-client cost you can mark up cleanly and provisioning measured in minutes.
NGOs and donor programmes
Nairobi holds a very large concentration of NGO and UN regional offices, and their systems are unusually data-heavy: DHIS2 health information deployments, KoboToolbox and ODK form servers taking submissions from enumerators on mobile data, monitoring-and-evaluation dashboards, file sync for staff offline for days, and grant accounting. Two things shape the purchase — a budget cycle that wants an annual invoice, and personal data about beneficiaries that turns the residency section above into a board question.
Education and health platforms
School management and fee systems, learning platforms, clinic and EMR software, laboratory and pharmacy systems, and the county revenue platforms beside them. This is where Regulation 26 stops being abstract: basic education, primary and secondary health care, and public finance administration are three of its six named purposes, and it asks for processing through a server and data centre located in Kenya, or at minimum one serving copy held in a Kenyan data centre. ke-1a is in Nairobi. Confirm the specifics with counsel, then build to them.
Owned hardware, single-tenant databases and hybrid builds are the enterprise and colocation end of the same platform: dedicated servers, rack space, and private networking back to your cloud instances in the same region.
Network
Distance costs some workloads far more than others
A brochure site makes a handful of requests and the reader forgives all of them. A checkout makes dozens, in series, at the moment a customer is deciding whether to trust you with money. A RADIUS server answers every time a subscriber session re-keys. A payment callback endpoint has an operator's retry policy pointed at it and a reconciliation job waiting behind it. Distance is charged per round trip, and the workloads that make thousands of them are the ones where a Nairobi origin stops being a preference and becomes the design.
The Communications Authority of Kenya counted 84,090,298 active SIMs and 52,852,505 mobile broadband subscriptions in January to March 2026, alongside 2,656,653 fixed subscriptions — 941,501 of them on Safaricom, 517,270 on Jamii Telecommunications, 276,607 on Zuku and 256,517 on Poa Internet. Your users are on those networks, and those networks are inside Kenya. So is ke-1a, and Lineserve peers at KIXP, where traffic between Nairobi networks is exchanged in Nairobi. A request from a handset in Westlands and the reply to it become two events in the same city.
84.1M
Active SIMs in Kenya (CA, Q1 2026)
2.65M
Fixed broadband subscriptions (CA, Q1 2026)
136
Networks peering at KIXP, Nairobi (PeeringDB)
480 km
Mombasa cable landings to Nairobi
Some of these workloads have no meaning abroad
A RADIUS server for a Kenyan WISP, a resolver for Kenyan subscribers, a USSD gateway backend, a looking glass, a speedtest endpoint, a NetFlow collector watching Kenyan links — each is a service to a Kenyan network, measured by Kenyan users. These buyers need no persuading about location. They need an API, stable addresses and somewhere to put six small instances.
Anything leaving Kenya still starts at the coast
TEAMS, SEACOM, EASSy, LION2, DARE1 and PEACE all come ashore at Mombasa, and the traffic is hauled roughly 480 km inland. The Authority reports 28,130 Gbps of lit international capacity with 17,759 Gbps in use. International capacity arrives at the coast; domestic traffic is exchanged in the capital. Hosting in Nairobi is a decision about the second one.
Tax, invoicing and budgets
The part finance decides, not engineering
Kenya's standard VAT rate is 16%, and the Kenya Revenue Authority treats digital marketplace supplies as taxable under section 5(2)(b) of the VAT Act — its published list names cloud backup, email hosting and software subscriptions, so hosting sits squarely inside it. VAT falls due by the 20th of the month following the earlier of invoice, performance or payment, on a VAT3 return through iTax. Prices here exclude VAT and 16% is added at checkout, so the figure in your forecast is the infrastructure figure and the tax sits on its own line.
The practical question is narrower: can the business claim this? Input VAT and the expense are only safe on audit against a valid tax invoice carrying your own KRA PIN, and that turns on whether the supplier has a Kenyan tax identity at all. Lineserve Limited is registered for VAT in Kenya. Send [email protected] your PIN, your registered name as KRA holds it and any LPO reference before you order, and it is on the invoice from the first billing run rather than reconstructed in April.
Buying against a budget year
Kenya's public financial year runs 1 July to 30 June, most private companies close on 31 December, and donor programmes run to whatever the grant agreement says. Annual billing is ten months for twelve: one approval, one payment, one document in the file. Useful when money has to be committed inside a window, and useful again when an auditor asks what the line item was.
Colocation and larger dedicated builds are quoted rather than listed. Send [email protected] your rack, power and connectivity requirements and you get a written quote against them.
Data residency
Residency matters far more to some of these buyers than others
Kenya's Data Protection Act, No. 24 of 2019 is administered by the Office of the Data Protection Commissioner, and it does not treat every business alike. Section 4(b) applies the Act to a controller or processor outside Kenya processing the personal data of people in Kenya, so moving a server to Frankfurt moves the data and leaves the obligation exactly where it was. Sections 48 and 49 then make cross-border transfer conditional — safeguards demonstrated to the Data Commissioner, and for sensitive personal data the data subject's consent as well. Keep the data in ke-1a and none of that has anything to bite on.
In a restricted sector, size is no excuse
The threshold that exempts small entities from registration — under KES 5 million turnover and fewer than ten employees — is switched off for financial services, telecommunications, health, education, insurance, betting, public bodies and religious organisations. A four-person digital lender sits in the same bracket as a bank, and the Commissioner has published a Guidance Note for Digital Credit Providers.
Regulation 26 names six purposes, and only six
Section 50 lets the Cabinet Secretary require certain processing to run through a server or data centre located in Kenya, and Regulation 26 of the Data Protection (General) Regulations, 2021 exercises it for civil registration and legal identity, elections, public finance administration, protected computer systems, basic education, and primary or secondary health care. If you run a school platform or a clinic system, that list is about you. If you run a WooCommerce store, it is not.
What the region supplies is location
Data residency for Kenya's Data Protection Act, with your data held in Nairobi and moved out of Kenya only when you move it. Registration, notices and the rest of the controller's job remain yours — easier to answer when the honest answer to where the data is happens to be the name of a city.
Moving in
What changes depends on where you are now
From an overseas provider
The engineering is the easy half — provision, rsync, dump and restore, run both for a day, cut the DNS. The half that changes the business case is commercial. Today the price moves with the exchange rate and your bank's margin, the card belongs to one director, and the receipt comes from a company with no Kenyan tax identity, so finance carries it as an argument rather than a claim. Afterwards it is a shilling figure you can budget for twelve months, a Kenyan tax invoice at the end of it, and +254 119 039 063 to ring at two in the morning.
From a Kenyan shared host or reseller
A Nairobi location, a Kenyan IP and M-Pesa billing are table stakes here — every local provider advertises them and they are right to. So the reason to move is never those. It is the layer underneath: infrastructure primitives instead of a resold control panel, which means an API and a CLI, snapshots and scheduled backups, private networking, resize of a running machine up to 32 vCPU and 64 GB, a published 99.9% SLA that pays service credits, object storage and dedicated hardware on the same account, and two more regions when you need a copy outside Kenya.
Four questions are worth putting to any provider, this one included. Which building is the machine in, and in which city? What does the SLA pay when it is missed, and who claims it? Is domestic traffic exchanged inside Kenya? And does the invoice carry a KRA PIN your accountant can file against input VAT?
FAQ
Questions, answered
Pick by workload rather than by label. Shipping a product: start with a Linux VPS and resize. Many client sites: the agency route, with white-label hosting and one bill. A single-tenant database, a licensing constraint or a regulator to satisfy: dedicated hardware or colocation. Most Kenyan buyers end up with a mix, on one account.
It benefits more than most workloads do. The callback originates on a Kenyan network, your endpoint has a retry policy pointed at it, and every retry is a round trip you pay for twice. Putting the receiver, the queue behind it and the reconciliation job in ke-1a keeps the whole loop inside the country.
Yes — on a large instance or, more often, a dedicated server where single tenancy is a licensing or audit requirement, with the database on its own storage and backups scheduled into object storage in the same region. Check your own SASRA obligations on ICT outsourcing before you fix the topology, and talk to [email protected] about sizing the month-end and dividend runs, which decide the spec.
Size for the ordinary week and resize for the event. vCPU, RAM and storage scale independently up to 32 vCPU and 64 GB with minimal downtime, so a newsroom takes a machine up on Monday and back down on Thursday. Put static assets and media in object storage so the spike hits a cache rather than your origin, and rehearse the resize once before the day that matters.
Yes, and this is one of the workloads where hosting anywhere else is actively worse. RADIUS and AAA, recursive and authoritative DNS, mail relays, NetFlow collectors, Zabbix or LibreNMS, looking-glass and speedtest endpoints all run on small instances with stable public addresses and private networking between them.
One account, one bill in KES, and per-client costs you can mark up without a currency conversion sitting in your margin. White-label DirectAdmin plans cover the shared-hosting clients, cloud servers cover the ones who outgrew that, and object storage covers assets and offsite backups. Provisioning is API-driven, so a client environment is a script rather than an afternoon.
Yes. Annual billing is ten months for twelve, giving you one approval, one payment and one invoice for the grant file. Send your KRA PIN, registered name and any LPO reference to [email protected] before you order so the paperwork matches the budget line from the first billing run.
No. Compliance belongs to you as the controller in whatever country the server sits. What Nairobi gives you is residency: your personal data stays in Kenya, so the cross-border conditions in sections 48 and 49 do not arise for it, and the answer to where the customer data is held becomes the name of a city rather than a paragraph.
Regulation 26 asks for processing through a server and data centre located in Kenya, or at least one serving copy of the personal data in a Kenyan data centre, for six named purposes: civil registration and legal identity, elections, public finance administration, protected computer systems, basic education, and primary or secondary health care. ke-1a is in Nairobi. Whether your system falls inside one of those categories is a question for your counsel.
Sometimes not, and it is worth saying plainly. Put the origin where the audience is and keep tooling, backups and internal systems close to the team. Nairobi, Dar es Salaam and Lagos run on one account and one API, so a two-region layout is a deployment decision rather than a second supplier relationship. Retail FX is its own case: matching engines sit in London and New York facilities, so siting a Forex VPS is a separate conversation with sales.
Yes — that is colocation, quoted rather than listed, because rack, power and connectivity requirements vary too much for a price card. Tell [email protected] how many rack units, how much power per rack, what connectivity you need and whether you want remote hands. Colocated hardware can sit on private networking alongside cloud instances in the same region.