SACCO & microfinance system hosting Kenya

Member savings deserve a properly locked-down server

Run Mifos X, Apache Fineract or your own loan platform on a VPS where you control the firewall, the logins, the audit trail and the backups. M-Pesa disbursements and repayments get a stable HTTPS callback, and your auditors get clear answers about who can touch member money.

Size your server Ask on WhatsApp

Active members and borrowers

5,000 members

We suggest

VPS V2 KES 5,000/mo

Eight gigabytes of RAM is a sensible floor for Fineract, giving the JVM and MySQL room to work. One core is too little for Java core banking, so VPS V1 is not recommended here.

Order VPS V2

Core systems where every record is someone's money

A SACCO's core system holds members' savings balances, loan schedules and guarantor records. Any error there is someone's money, so the questions a board and its auditors ask are different: who can post a transaction, who approved this loan, where is last month's backup, and what happens if the server dies halfway through month-end interest posting.

Many smaller SACCOs and microfinance lenders still run their core on one machine in the office, sometimes with a shared administrator password. As they add a member portal, mobile loan applications and M-Pesa disbursement, that machine has to face the internet, and that is where the risk lies. Daraja's B2C and C2B APIs post results to a public HTTPS URL, so the system needs a hardened address that never sleeps.

A VPS with full root access lets you build this properly: a firewall exposing only the web front-end, the database bound to the server itself, SSH by key, logs you control and encrypted backups stored elsewhere. Mifos X on Apache Fineract and most custom loan platforms run well on a correctly sized VPS. We set up the server and operating system; your vendor or IT team installs the platform, and our support team can advise on hardening.

The problem

Risks a SACCO server has to manage

Shared logins and no audit trail

When three officers use one admin account, nobody can say who reversed a repayment or changed a loan's interest rate. Named accounts, maker-checker approval and server logs that staff cannot edit turn every change into something you can trace.

Disbursements stuck in limbo

M-Pesa B2C sends its result to your callback URL. If the server is unreachable, the loan may have been paid out while your system still shows it pending, and a well-meaning officer sends it again. An always-on endpoint prevents that.

Month-end jobs that never finish

Interest posting, penalty accruals and dividend calculations run across every account at once. On tired office hardware they overrun into the morning and branches open to wrong balances. Proper cores and disk let batch jobs finish overnight.

Audits and inspections without evidence

External auditors and, for regulated SACCOs, SASRA inspectors expect evidence of access control, backups and change management. A server you administer yourself lets you produce access lists, backup logs and restore tests on request.

What runs on it

Core banking and loan software on a VPS

Open-source core banking has matured around Apache Fineract, and many Kenyan lenders also run systems built locally. All of these need a well-secured Linux server.

Apache Fineract

The open-source core banking engine behind Mifos X, handling clients, savings, loans, accounting and a REST API. Java on MySQL, MariaDB or PostgreSQL, so plan memory for both the JVM and the database.

Mifos X web app

The browser front-end that staff use to work with Fineract: client onboarding, loan products, repayments, approvals and reports. Served as a static web app in front of the Fineract API, usually on the same server.

Mifos Mobile

An open-source self-service app for members, built against Fineract's self-service API, so members can see balances and loan statements. It needs the API exposed over HTTPS with careful access rules.

Custom loan systems

Many digital lenders and SACCOs run a Laravel, Django or Node.js loan platform with credit scoring, M-Pesa integration and a USSD or app front-end. These need queue workers, a database and stable callback URLs.

Metabase

An open-source reporting tool that connects to your database for portfolio-at-risk, arrears and savings dashboards. A Java application that is best pointed at a read-only database user so reports cannot change data.

Sizing

Choose a server for your membership

Slide to the number of active members and borrowers. Fineract runs on Java, so even small SACCOs should start with enough memory.

100–15,000 members VPS V2 Eight gigabytes of RAM is a sensible floor for Fineract, giving the JVM and MySQL room to work. One core is too little for Java core banking, so VPS V1 is not recommended here.
15,100–50,000 members VPS V4 Six cores shorten month-end interest and penalty jobs and handle more staff and mobile users, while 480 GB of SSD holds growing transaction history and logs. Its 24 GB of RAM gives the JVM generous heap for Fineract.
50,100+ members VPS V5 Ten cores and 40 GB of RAM for large SACCOs and lenders with heavy M-Pesa volumes, reporting tools and member apps all hitting the system at once.

Use this as a starting point: transaction volume, batch jobs and how many staff and app users are active at once matter more than the member count alone.

VPS V1

KES 2,000/mo

1 Core
1 GB RAM
40 GB NVMe
1 TB transfer

Order V1

VPS V2

KES 5,000/mo

2 Cores
8 GB RAM
160 GB SSD
8 TB transfer

Order V2

VPS V3

KES 7,000/mo

4 Cores
16 GB RAM
320 GB SSD
16 TB transfer

Order V3

VPS V4

KES 15,000/mo

6 Cores
24 GB RAM
480 GB SSD
24 TB transfer

Order V4

VPS V5

KES 20,000/mo

10 Cores
40 GB RAM
800 GB SSD
40 TB transfer

Order V5

Before you go live

Hardening checklist for a SACCO server

0 of 8 done. Tick them off as you go.

Expose only port 443 publicly, restrict SSH to keys and, where possible, to your office IP address, and bind the database to the server itself.
Give every officer a named account and turn on maker-checker approval in Fineract for loans, reversals and journal entries.
Keep Daraja consumer keys, secrets and initiator credentials in environment files readable only by the application user, never in code.
Record each B2C ConversationID and check it before retrying, so a slow result callback never leads to a double disbursement.
Encrypt nightly database backups, copy them off the server and restore one onto a test machine every month.
Send authentication and application audit logs somewhere staff cannot edit or delete them.
Schedule end-of-day and month-end jobs overnight and alert someone if they fail or overrun.
Apply operating system and application security updates monthly, testing them on a staging copy first.

Built for Kenya

Regulation and payments for Kenyan SACCOs

SASRA expects sound controls

SASRA licenses and supervises deposit-taking SACCOs and sets expectations on governance and risk management. A VPS does not make a SACCO compliant by itself, but it gives you the access control, logging and backup evidence that inspections and external audits look for.

Member data and breach reporting

Members' ID numbers, phone numbers and financial records are personal data under the Data Protection Act 2019. A SACCO may need to register with the ODPC, and data breaches must be reported to the Data Commissioner within 72 hours, so detection and logging matter.

Loans land on M-Pesa

Members expect approved loans on their phone within minutes and repay by paybill. Daraja B2C and C2B calls report back to your server over HTTPS, as do USSD sessions from providers such as Africa's Talking, so the endpoint has to stay online.

Questions

SACCO & Microfinance: your questions, answered

Can a SACCO host its core banking system on a VPS?

Yes, and many do. What matters is that the server is hardened, backed up and access-controlled. If your SACCO is regulated by SASRA, check its guidance and your board's IT policy, and document where the system is hosted and how it is secured for your auditors.

Which VPS does Mifos X need?

Mifos X runs on Apache Fineract, a Java application with a MySQL, MariaDB or PostgreSQL database. Java needs memory, so start on VPS V2 with 8 GB of RAM. Move to VPS V4 for more cores during heavy batch jobs, or VPS V5 for large memberships.

How do we set up M-Pesa B2C for loan disbursement?

You apply to Safaricom for B2C on your shortcode and get Daraja API credentials, including an initiator. Your system sends payment requests and receives results at a result URL and a timeout URL, both of which must be public HTTPS addresses on your server. Test fully in the Daraja sandbox first.

Is a VPS secure enough for member financial data?

Security comes from configuration, not the hosting type. On a VPS you control the firewall, SSH access, encryption, user accounts and logs, which is usually stronger than an office PC. Keep software patched, restrict admin access, and store encrypted backups away from the server.

Does our SACCO need to register with the Data Protection Commissioner?

Many organisations that process personal data must register with the ODPC as data controllers, and SACCOs handle sensitive financial records. Check the current registration thresholds on the ODPC website. Separately, any personal data breach must be reported to the Commissioner within 72 hours of becoming aware of it.

Can members apply for loans by app or USSD through our VPS?

Yes. Mifos Mobile and custom apps talk to your system's API over HTTPS. USSD menus run through a provider such as Africa's Talking, which forwards each session to a callback URL on your server. Both need the VPS online and a firewall that allows only the endpoints they use.

Also on VPS Hosting

Ready to host your sacco & microfinance?

Plans from KES 2,000 a month, paid by M-Pesa or card.

Size your server