Help & contact

Using SCPL Cloud means you accept our Terms of Service: you decide what to run here and are responsible for it, payments are non-refundable (a failed setup is redone free), and SCPL Africa is not liable for losses from using the platform.

Getting help

• Live chat (bottom right of every page): Ade, our virtual support agent, knows the platform and prices, can check your services when you’re logged in, and can log a ticket for you.
• Support tickets at Support: for anything that needs a person. Our team replies on the ticket.

How buying works

1. Choose an item, pick a size and billing period, and add it to your cart.
2. Check out and pay. You'll need an SCPL Cloud account.
3. We set up your service straight away. Most are ready in a few minutes.
4. Find your IP address, login key and passwords under My business.

How pricing works

You pay for the size you allocate, nothing else:

• ₦3,292.00 per processor, ₦3,397.00 per GB of memory and ₦140.00 per GB of storage, each month.
• ₦3,600.00 per public IP address per month. Every system bought on its own includes one.
• ₦7,650.00 per month for internet access (up to 50 Mbps), once for all your systems, or once per Virtual Data Centre.
• Ready-made software (databases, WordPress, GitLab and so on) adds a service charge of 5% to 25% of the system's price, for setting it up and supporting it.
• Virtual Data Centres add a 10% service charge on their systems and capacity (not on public IPs or internet access), for managing the network, firewall and systems as one.

There are no charges for data transfer, speed, disk operations (IOPS), connections or how much you use your system.

Payments

Pay securely in Naira by card, bank transfer or USSD. Your service is set up as soon as your payment is confirmed.

Billing periods and VAT

You pay in advance for the period you choose. Longer periods cost less:

• 1 month: standard price
• 3 months: save 1%
• 6 months: save 2%
• 12 months: save 3%

Prices on the site exclude VAT. 7.5% VAT is added at checkout.

If something doesn’t get set up

• Before taking any payment, we check the cloud can set up what you’re buying. If it can’t, you aren’t charged.
• If you paid and the setup then fails, the service’s page offers Set it up again at no charge, as many times as needed until it works. A paid resize that fails can be tried again the same way. Payments are not refunded.
• Your paid period starts when the service is delivered working, so time lost to a failed setup is never charged.

How we know your system is working (the SCPL agent)

Every system tells us when its setup has finished, and whether it worked. After that, a small SCPL agent on it reports every 5 minutes: whether it is up, how busy and how full it is (percentages only), which system services or containers have stopped, and sign-ins (time, user name and address only). It never reads your files, databases or what anyone types. We also check each system’s status with the cloud. You see all of this in the system’s History, and our team sees when a system stops reporting.

• It also carries out what you ask on the system’s page: updates, a software reset, unlocking or locking encrypted data, and My CTO’s time-limited access. Because it checks in every 5 minutes, these start within about 5 minutes.
• It keeps itself up to date. Servers set up before the agent existed, or with a very old one, show a one-line command on their page to run once over SSH; it changes nothing in your software.
• If a system stops reporting (for example its firewall was changed, or it was switched off from inside), the system’s page says so. Updates, resets and the assistant wait until it reports again.

Safety updates: security fixes and improvements

We publish updates for the software we installed on your systems: security fixes (operating system packages, the app’s containers) and improvements that new systems get. They appear on My business and in each system’s Updates section, with how serious each one is. Updates keep your data.

For each update, you choose:

• Apply with SCPL: tick the box to accept responsibility, then choose Apply now (starts within about 5 minutes) or Apply tonight at 2:00 in your own time zone (you can cancel until then). The system backs up what the update changes, applies it, checks the app still works, and puts the backup back by itself if it doesn’t. You can roll it back yourself for 14 days from the same section.
• Apply it yourself: the page shows the steps; confirm you’ll handle it and it stops being listed as waiting.

• During an update the app keeps running while it’s backed up (it pauses for a few seconds), then restarts, usually for a minute or two. Pick a quiet time, or tonight at 2:00.
• Older systems: systems set up before late October 2026 may first need updates turned on: run the one-time command shown in the Updates section, or press Turn on updates for me, and SCPL logs in once with the system’s own key to run it (the login is recorded in its history).
• You stay responsible for your systems’ software, including anything you installed yourself, which we don’t update (Terms, section 11).
• In a team, applying updates needs a role that includes them.

Start fresh: resetting or replacing a system

Three ways to start again, from the system’s page. Back up anything you need first: the first two erase data.

Reset the software (free)

Under Reset to a clean setup on the system’s page, type the system’s name to confirm and press Reset the software, or run sudo scpl-reset on the system. The software we installed is erased and installed again with our latest setup for it (including any improvements since it was delivered), with the same passwords. To keep your data and only bring in fixes, use Updates instead.

• Not for plain systems with only an operating system (nothing of ours to reset: replace the system instead), or for two-location clusters, load balancers and VPN gateways.
• The system must be running and reporting to us; if it isn’t, the page shows a one-time command to turn it on.

Replace the whole system (paid)

In the same section, type the system’s name and press Pay and replace the system. We replace it with a fresh system of the same size, operating system, software and passwords, as it was delivered. Your paid period doesn’t change, and extra disks are detached and kept.

• Why it costs something: the cloud provider bills a new system in advance. The price is 30 days of the system and its public IP, plus a ₦1,000 handling fee, plus VAT; the exact amount is on the button.
• It gets a new public IP address: update your domain’s DNS and any firewall rules that used the old one.
• A locked system must be unlocked first. Up to 3 replacements a day per system. Two-location databases can’t be replaced this way: contact support, so the other system keeps the data.

When setup fails: set it up again, free

If a system you paid for doesn’t set up, its page says so and offers Set it up again at no charge, as many times as needed until it works (a Starter-plan app says Relaunch). If it still doesn’t work, contact support and we get it running for you; a paid setup isn’t cancelled or refunded. A failed paid upgrade can likewise be tried again at no charge.

How it’s doing, and when to move up a size

Every business system’s page has a How it’s doing card: how busy it is, whether it has room for more people at once, and how much space is left for your records, in plain words, with a week of the busiest hours. Green is healthy, amber means keep an eye on it, red means it needs more room.

Sizes go by your business. Starter is a shared system for small businesses; Just me, Small team, Growing business, Several branches, Large business are each a system of your own. A guide, not a limit. My CTO watches how busy your system gets and tells you before you need to move up; moving up keeps everything. When a system needs more room, My CTO suggests the next size up on its page, with the price difference and a button to move up. Your system restarts once (a few minutes) and everything on it is kept. The numbers behind the words are under “Technical details” for your IT person.

Your own web address Coming soon

Soon you’ll be able to open your system at your own address. This is how it will work:

1. Buy an address from any domain company, for example yourbusiness.ng or yourbusiness.com.ng.
2. On your system’s page, under Your web address, type the address you want it to open at, such as books.yourbusiness.ng.
3. The page shows one line to add where you bought the address (a record of type A pointing to your system). Add it, or send that line to whoever looks after your address.
4. We check every few minutes. As soon as it points to your system we switch over and get its secure padlock for you, free, and renew it by itself.

It can take up to an hour for a new record to be seen. Offered for ready-made business systems; ask My CTO or open a ticket for others.

My CTO, your AI technical officer

Ask for a change on one of your systems in your own words, for example “install Redis”, “why is my website slow?” or “free up disk space”. Find it on the system’s page under My CTO. It works on running systems bought on their own (not yet on Virtual Data Centre systems).

1. It looks first. For a limited time it runs read-only checks on the system. Nothing is changed.
2. It shows you a plan with the exact commands it would run, and may ask you questions.
3. You decide. Approve the plan, reject it, or stop the task at any time. Nothing changes unless you approve.
4. It takes a snapshot, then runs only those commands. Its access to the system ends when the task does.

• Price: free while in preview, 3 tasks a month per account. If it becomes paid, you’ll see the price before you approve.
• Read the plan before approving. Approving it is your instruction to run those commands, and you stay responsible for your system and its data, including your own backups (Terms, section 22). The assistant can be wrong; if a change causes a problem, the snapshot puts the system back as it was.
• If it can’t start: the server’s page says why. If the server’s SCPL agent isn’t reporting or is old, run the one-line command shown there once over SSH; if it’s updating, try again in about 10 minutes. An encrypted server must be unlocked first. One task at a time per server.

Locked records: your data under your own secret phrase

Free, on single systems with ready-made software. When you order, tick Encrypt my data with my own passphrase under “Encryption with your own key”. It can’t be added to a system later, and isn’t offered with two locations, a warm standby or several systems.

• What it protects: your software, its files and its databases are kept encrypted on the system’s disk. Without your passphrase nobody can read them from the disk, its snapshots or backups: not the cloud provider, not SCPL. While it’s unlocked, your app and website run as normal.
• What it can’t do: it doesn’t hide your software or data from the cloud provider while the system is running. And if you lose the passphrase, the data can’t be recovered by anyone, SCPL included. Keep it somewhere safe, such as a password manager.

Where the key goes

1. Once the system is ready, open it in My business and go to Your encryption key.
2. Set your passphrase: at least 12 characters (four or more unrelated words are easy to remember and hard to guess).
3. After each restart, the data stays locked and your app is offline until you unlock it there. Lock now locks it straight away.

Or do it over SSH, so the passphrase never passes through SCPL: sudo scpl-vault set, sudo scpl-vault unlock and sudo scpl-vault change. A passphrase typed on the page goes to your system once and is never stored. The page allows 10 tries a day; after that, use SSH. Never send your passphrase in the live chat or a ticket.

Unlocking automatically after restarts

So your app comes back by itself, turn on automatic unlocking in the same section. After a restart the system asks a key service for help: the key service holds half of what’s needed and the system’s disk the other half, so neither can open the data alone, and a copy of the disk started anywhere else is refused. Your passphrase keeps working.

• SCPL’s key service: the simplest.
• Your own key service: a small machine you control (sudo apt install tang); the page shows what to enter.
• Both must agree: the strongest.
• Block now: if a copy of the disk may be in use somewhere, it stops the key service helping anyone unlock it; only your passphrase opens it then. The page lists refused attempts, and lets you allow an address that’s yours.

Only your team can open it (Private access)

Security beyond passwords and two-step sign-in. With Private access on, only your office network and the people you give VPN access can reach your app. Everyone else gets no answer at all, so outsiders can’t even tell anything runs there. It’s free, and on the app system’s page under Private access.

1. Add your office’s internet address (up to 10): everyone on that network gets in with nothing to install. Use your office’s fixed address; home and mobile addresses change, so they don’t work for this. The page shows the address you’re connecting from.
2. For people outside the office, set up the VPN (it works while Private access is still off; the system starts it in about 5 minutes), then add each person by name (up to 50). Each gets a settings file for the free WireGuard app (Windows, Mac, iPhone, Android, Linux). It’s shown once: download it and send it to them privately. The system runs the VPN itself, so there’s no extra system or cost.
3. Test that they can connect, then tick Private access and save. With only VPN users, no office address is needed.

• Opening the app: from the office or the VPN, people open it by its usual name. If you use your own domain (for example erp.example.com), add it on the page too.
• Odoo: you can make only the staff side private. Your customer portal (invoices and quotes sent by email), website, shop and payment notifications stay public, while the back office and its API answer only your offices and VPN users. Check your portal after turning it on.
• Apps in two locations, or with a warm standby: one setting covers all the linked systems. VPN users get one settings file per system: import them all and use any one.
• What stays open: for HTTPS apps, port 80 stays open so the certificate can renew; it only sends visitors on to HTTPS, which outsiders can’t reach. SSH is limited the same way.
• You can’t lock yourself out: turn it off on the system’s page at any time (your offices and VPN users are kept for next time), and the last way in can’t be removed while it’s on.
• When someone leaves: remove their VPN user on the page; their settings file stops working within a minute.
• On the Starter plan (a shared system): add your office’s fixed addresses under Only your team can open it on its page. Outsiders see a short “not allowed” page instead of no answer, because the system is shared. Odoo packs can keep their website and portal public as above. VPN users need a system of your own: Move up keeps everything. On Fleet and Dispatch, the address drivers’ phones report to stays open, since phones use mobile data.
• Not for Virtual Data Centre systems: a VDC uses its own firewall rules, and the SCPL Firewall has VPN users too.

Two-step sign-in

With two-step sign-in on, signing in needs your password and a 6-digit code from an app on your phone, so someone who learns your password still can’t get in. It’s free. Every new account sets it up when signing up, and keeps it on; it’s also required for working in someone else’s team. Accounts made earlier can turn it on below, and we strongly recommend it.

Signing up and signing in

1. Sign-up: fill in the form, then click the link we email you to confirm the address is yours (it works for 24 hours).
2. Then set up two-step sign-in with an app on your phone, save your recovery codes, and your account opens.
3. Sign-in: your email and password, then the code from your app. Both forms have an “I’m not a robot” check that ticks itself after a second or two while you type; wait for the tick. It keeps out programs that try passwords by the thousand, and nothing about you is sent to another company for it.

Turning it on

1. Install an authenticator app on your phone: Google Authenticator, Microsoft Authenticator, Authy or 1Password.
2. Go to Account security and choose to set up two-step sign-in.
3. In the app, add an account and scan the code shown (or type the key under it), then enter the 6-digit code the app shows.
4. Save your recovery codes somewhere safe, away from your phone (printed, or in a password manager). Each works once, if you lose your phone.

Using it

• After your password, enter the code your app shows. It changes every 30 seconds, and each code works only once.
• After 5 wrong codes in a row, codes are paused for 15 minutes; after 10 wrong passwords, sign-in pauses for 15 minutes too.
• Running low on recovery codes or lost them? Make a new set on Account security: the old ones stop working.
• New phone? While you still have the old one, turn two-step sign-in off and on again to scan a new code, or use a recovery code to sign in on the new phone first.
• Signed in somewhere you no longer use, or lost a device? On Account security, sign out everywhere except here.

Lost your phone and your recovery codes?

Contact us through Help & contact from your account’s email. Our team confirms who you are (for example by a call to your registered number, ID, or proof of payment) before turning it off, so that nobody else can do it for you. Then sign in and turn it on again with your new phone.

Never share a code, even with someone saying they’re from SCPL: we never ask for one. Ade, the live chat, never asks for codes or passwords either.

Working as a team

Let colleagues, your IT contractor or your accountant work in your account, each with only what they need. Everyone signs in as themselves, so you can see who did what, and remove anyone at any time.

1. Go to Team and enter the person’s email.
2. Pick a role (below). If they should only work on some systems, choose Only these and tick them; a VDC includes its systems. To give access for a job, choose how long: it ends by itself.
3. Press Make invitation link, copy the link and send it to them yourself, for example by WhatsApp or email. It works once, only for that email address, within 7 days.
4. They open the link, sign in or create an SCPL Cloud account with that email, accept, and turn on two-step sign-in. They then switch to your account from the Account menu at the top.

• Your own roles: on the Team page’s Roles tab, make a role from checkboxes, one per thing to see or do. Risky ones (deleting or resetting systems, seeing passwords, inviting people) are marked.
• Nobody can give more than they have: a role, or systems, wider than their own. You always keep full control of your account.
• Activity: the Team page shows team changes and every change a member made.
• When someone leaves: remove them on the Team page and their access stops at once. Then change any server passwords, SSH keys and VPN settings they had, because we can’t take back what they already saw or downloaded.
• Responsibility: team members act for you within their role, and you are responsible for what they do (Terms, section 23).
• In someone else’s team? Use the Account menu to switch between your own account and theirs, and the Team page to leave. If a button you need isn’t there, your role doesn’t include it: ask the account’s owner. Ade, the live chat, only sees your own account.

Keeps running if a datacentre fails (high availability)

We run in two Lagos datacentres (Nigeria 1 and Nigeria 2), 34.7 km apart and run by different companies. High availability products use both, so if one datacentre goes down, your website, app or database keeps going from the other. There are four ways, depending on what you run:

How it works

• Choosing what’s in charge: for databases, SCPL’s platform decides which datacentre leads, and a copy that loses touch with both the other copy and the platform stops taking changes, so the two copies never both think they’re in charge.
• Moving visitors: apps and live copies come with a global load balancer. Enter your domain when you buy, then point it at the load balancer’s two DNS servers. High Availability websites (WordPress, Odoo, Ghost) get HTTPS by themselves once the domain points there.
• Your apps connect to the database on its router port (PostgreSQL 5433, MySQL and MariaDB 3307, MongoDB 27018, Redis 6380), which always reaches the one in charge. The database’s page shows the addresses, and you can switch which location leads with one click.
• Whole environments: build a Virtual Data Centre in both Lagos datacentres and tick High Availability: its database and cache systems become two-location clusters.
• Warm standby: a second server of the same size in the other datacentre gets a copy every 5 minutes (settings, home folders, /srv, /opt, /var/www and all of Docker). Taking over is your choice; the standby has its own address, so point your domain at it, or put both behind a global load balancer. Keep databases in a High Availability database where you can.

Testing it

Every two-location product has Failover tests on its page. Each month we check, without changing anything, that it’s ready to fail over (both sides reporting, the copy up to date, backups and the witness), and you can test now. A failover drill, only when you start it, really moves the database to the other datacentre and back and shows how long each move took. Nothing is lost, but saving pauses for a few seconds each way, so run it at a quiet time. Results stay on the page, for your records and audits.

Good to know

• Files on a system’s own disk aren’t copied between live copies or VDC locations. Keep uploads in the database or object storage.
• People connected when a location fails may need to refresh or sign in again.
• Two-location services count as down for service level credits only when both locations are down at once.
• Whether a setup meets a regulator’s requirements is for you and your regulator to decide; we provide the setup and the test results.

Your business cloud (Virtual Data Centre)

A Virtual Data Centre (VDC) is a set of systems built together on your own private network, isolated from other customers, with a router, firewall and public addresses only where you want them. Up to 20 systems each. Build one at Virtual Data Centre.

Building one, step by step

1. Start from a template (Starter web app, Production, Secured web app, Dev team) or from scratch.
2. Choose how to pay (below).
3. Network: a name, one or more locations (our two Lagos datacentres, Nigeria 1 and Nigeria 2, and Kenya) and the private address range.
4. Systems: each has a role (bastion, web, app, database, cache, monitoring and more), a size and optional ready-made software. Give public addresses only to systems that face the internet; the rest reach the internet for updates through the router.
5. Storage: disks for systems (or spares) and object storage buckets for backups, images and files.
6. Firewall: rules are made for you by role (databases only accept your app servers, SSH only through the bastion); add your own. You can also put the SCPL Firewall in front.
7. Global load balancer (optional), to spread visitors across locations and move them if one fails.

Two ways to pay

• Pay per item: each system at its shop price, plus ₦3,600.00 a month for each public address and ₦7,650.00 a month for internet access.
• A resource pool: buy capacity (₦3,292.00 per processor, ₦3,397.00 per GB of memory and ₦140.00 per GB of storage a month) and carve it into systems as you need; systems can be resized within the pool.
• Both add a 10% service charge on systems and capacity (not on public addresses or internet access), for managing the network, firewall and systems as one. Prices exclude VAT.

Using it

• Reaching private systems: through the bastion (or the VPN), for example ssh -J ubuntu@<bastion-ip> ubuntu@<private-ip>. Each system’s page shows the exact command.
• On the VDC’s page: see it as a diagram, add systems (paid like a new order), remove systems (their disks are kept as spares), resize systems in a pool, change firewall rules (up to 50), and set up the load balancer and its certificates.
• Deleting the VDC deletes every system, disk, public address, firewall rule and the private network. It can’t be undone.

Two locations and High Availability

Build in both Lagos datacentres with the global load balancer to get a copy in each. Tick High Availability and each database and cache system (PostgreSQL, MySQL, MariaDB, MongoDB or Redis) becomes a two-location cluster: if a datacentre fails, SCPL is alerted and switches it to the other, without losing saved changes. Files saved on a system’s own disk aren’t copied between locations: keep uploads in the database or object storage. Monthly failover tests run without changing anything, and you can run a real failover drill when you choose.

• Not on VDC systems yet: My CTO and Private access. A VDC uses its own firewall rules instead, and the SCPL Firewall has VPN users.
• In a team: give someone a VDC and they work on all its systems (see Working as a team).

The SCPL Firewall: a security guard for your systems

A next-generation firewall on its own system, in front of the websites and services you publish (from ₦41,259 a month, plus VAT). Visitors reach your services through the firewall’s address and only clean traffic gets through to the system behind it. It works from first boot: set everything on its page, in your browser. See the product

Getting started

1. Buy it in the same location as the systems it protects (or choose it as the Firewall in a Virtual Data Centre).
2. On its page, under the policy, add a forwarded service for each thing you publish: the port, and the system’s address behind it (a VDC system’s private address, or any public address). The port is opened in the cloud’s firewall for you.
3. Point your domain at the firewall’s address, not the system’s. Changes apply within a minute.

What it protects with

• Intrusion prevention up to layer 7 (HTTP, TLS, DNS, SSH and more), with attack signatures updated daily. Choose block or only report.
• Threat intelligence blocklists of known-bad addresses, refreshed daily.
• Countries: block some, or allow only the ones you choose.
• Flood protection (new connections per address), and a cap on open connections per address.
• Automatic bans: an address that sets off a serious alert, or several, is banned from everything for a while; the page lists who’s banned. Switch on Under attack to tighten the limits during an attack, and off afterwards.
• Blocking sites by name (HTTPS, HTTP and DNS), and default deny: anything not forwarded is closed.

Inspecting HTTPS for your websites

Add a website on the firewall’s page: its name, the system’s address and port, and whether the system uses HTTPS. The firewall gets a free certificate (the name must already point at the firewall; it keeps trying every 30 minutes and renews by itself), checks each request against the OWASP Core Rule Set (SQL injection, cross-site scripting and more), then passes it on.

• Start on “only report” (new websites do) and watch the alerts for a few days. If something normal is flagged, add its rule number to that website’s rules to skip, then switch to block. Choosing the website’s software (WordPress, Nextcloud, Drupal and others) avoids common false alarms.
• These websites use ports 80 and 443, so those can’t also be forwarded. Three web attacks in a minute get an address banned.

VPN for your staff

Add a person by name (up to 50) and download their settings file for the free WireGuard app (Windows, Mac, iPhone, Android, Linux). It’s shown once and we keep no copy of its private key: if it’s lost, remove that person and add them again. By default only your private network goes through the VPN; you can choose to send all internet traffic through it. The page shows when each person last connected.

Two locations

Buy the firewall in both Lagos datacentres with a global load balancer (or use a VDC in both locations). The two firewalls share one policy, the same VPN users and their bans, and each sends traffic to the systems in its own location. If a datacentre, firewall or system fails, visitors move to the other location within about a minute. VPN users get one settings file per location.

What it can’t do

• Very large DDoS attacks fill the internet link before they reach any system; they need protection further upstream.
• HTTPS is decrypted only for your own websites listed under HTTPS inspection; other HTTPS traffic is checked by its site name only. Your staff’s browsing is never decrypted.
• It protects what you publish; it doesn’t filter your systems’ own outgoing internet traffic.
• If intrusion prevention ever stops, traffic keeps flowing (so your services stay up) and the page tells you.

Words we use

We talk about what things do for your business. If your IT person uses the technical word, here is what we call it.