Olatunde Success explains the field-level encryption architecture he uses in production Nigerian fintech systems: why AES-256-GCM, how key rotation works with JWT auth, and what NDPA 2023 actually demands from engineers.
If you build financial products in Nigeria, you will eventually hold the two most sensitive identifiers a Nigerian has: the Bank Verification Number (BVN) and the National Identification Number (NIN). I have carried that responsibility across Cirva, Resikonet, and core banking work for a microfinance bank. The pattern that has held up in production is field-level encryption with AES-256-GCM, not just disk or transport encryption.
Why field-level, not just at-rest
Full-disk encryption protects you from a stolen hard drive. TLS protects data in transit. Neither protects you from the most common real-world failure: a leaked database dump, an over-privileged internal query, or a logging middleware that faithfully records a request body containing a BVN. Field-level encryption means the sensitive value is ciphertext everywhere except the exact moment a permitted code path needs the plaintext.
Why AES-256-GCM specifically
Authenticated encryption: GCM gives you integrity for free. A tampered ciphertext fails to decrypt instead of silently returning garbage.
Per-record random IVs: the same BVN encrypted twice produces different ciphertexts, which kills equality-based inference attacks.
Hardware acceleration: AES-NI makes the overhead negligible next to a Postgres round trip.
In my NestJS services this lives in one encryption module with a narrow interface, encryptField and decryptField, so nothing else in the codebase touches crypto primitives directly. Keys come from environment-scoped secrets, never from the repository, and key IDs are stored alongside ciphertext so rotation can happen gradually without a big-bang migration.
The searchability trade-off
The first question every team asks: how do we look users up by BVN if it is encrypted? The answer is a blind index, an HMAC of the normalized value stored in its own column. You can match exact values without ever storing them in the clear. You give up LIKE queries, which for identifiers is exactly what you want.
What NDPA 2023 changes for engineers
The Nigeria Data Protection Act 2023 turned practices that used to be nice to have into legal obligations: data minimization, retention limits, consent management, and documented impact assessments when data crosses borders to processors. On Cirva, that meant writing DPIA documentation covering every third-party rail we integrate: SafeHaven MFB, Paystack, Sudo Africa, Prembly. Encryption is the technical half; the paperwork proving you thought about it is the other half regulators actually read.
Encrypt the field, index it blind, rotate keys by ID, and write the DPIA. That is the whole recipe. The discipline is doing it on every single sensitive field, not just the ones in the spec.
If you are building a Nigerian fintech product and want to compare notes on encryption architecture, reach out. I am always happy to talk shop.
