Data Residency
Where AfriScore data lives, and how on-premise deployment works.
Data residency is the single most important trust concern for financial institutions in the CEMAC region. Under BEAC regulations and national data protection frameworks, borrower data cannot always leave the jurisdiction where it was collected.
AfriScore is designed to accommodate this constraint from day one.
Two deployment models
AfriScore supports two deployment models. Institutions choose the one that aligns with their regulatory obligations, internal policy, and risk appetite.
Model 1: Cloud deployment (default)
The AfriScore engine runs on managed cloud infrastructure.
- Application hosting: Vercel (global edge network)
- Database: Neon (serverless PostgreSQL, US East region by default)
- Data location: United States
- Suitable for: Institutions without strict data residency requirements, or where the institution's own regulator permits cross-border processing under an appropriate DPA.
Model 2: On-premise deployment
The AfriScore engine runs entirely inside the institution's own infrastructure.
- Deployment: Docker container, deployed on the institution's own servers
- Data location: 100% inside the institution's environment
- Network: No outbound calls to AfriScore or any third party
- Suitable for: Institutions subject to BEAC data residency requirements, OHADA compliance regimes, or internal policies prohibiting cross-border data processing.
On-premise deployment is not a paid upgrade or enterprise-only feature. It is a first-class deployment model, documented in full at developer.afriscore.africa. Any pilot institution can choose it.
What happens on-premise
When AfriScore is deployed on-premise, the engine:
- Reads input data from the institution's internal API calls
- Scores the applicant locally, on the institution's own hardware
- Returns the score and SHAP explanation to the institution's internal systems
- Writes an audit log to the institution's own filesystem
- Never transmits borrower data over the network
The institution retains complete control over the data. AfriScore has no visibility into individual applications.
On-premise model retraining
Institutions can retrain the AfriScore model on their own repayment outcomes without any data leaving their environment.
The training pipeline is included in the container. To retrain:
- Prepare a labeled dataset of historical applications and repayment outcomes
- Run the training command locally, on the institution's own infrastructure
- The updated model replaces the previous one, still inside the institution's environment
- The institution controls when and whether to deploy the updated model
No data is shared with AfriScore. No calibration data leaves the institution.
Compliance with regional frameworks
The on-premise deployment model was designed to align with the regulatory frameworks that govern financial institutions across Central and West Africa.
- OHADA Uniform Act — data handling and audit trail requirements
- CEMAC / BEAC — cross-border data flow restrictions
- National data protection frameworks — right to explanation, data minimization, breach notification
Detailed compliance alignment is documented on the Compliance page.
Cloud deployment safeguards
When an institution chooses cloud deployment, the following safeguards apply.
- Encryption in transit: TLS 1.3
- Encryption at rest: AES-256 via Neon
- Access controls: Least-privilege, 2FA-enforced, audited
- Data Processing Agreement: Available on the DPA page
- Subprocessors: Fully disclosed on the Subprocessors page
Choosing a deployment model
We recommend on-premise deployment for any institution with strict data residency requirements. When in doubt, on-premise eliminates the entire category of cross-border data risk.
The choice is made during pilot onboarding and can be revised at any time as the institution's regulatory environment or internal policy evolves.
Questions
For questions about data residency, deployment models, or regulatory alignment, contact security@afriscore.africa.
For technical deployment questions, see the self-hosting documentation or contact contact@afriscore.africa.