The Tech Stack and Infrastructure

In a land transaction, a lawyer can draft without being a bricklayer. The asset follows rules you can walk around. Software does not. If you paste a boilerplate technology contract over a system you cannot describe, you are guessing about liability, ownership, and what “done” means.

A chief technology officer will not open with liquidated damages. They will say the backend deployment failed because a payments API returned a server error during user acceptance testing. If that sentence is noise, you are not yet useful in the room.

What a stack is

A tech stack is the set of languages, frameworks, and machines used to run one product. Picture three tiers.

Frontend. Everything a person touches: layout, buttons, forms. Common tools include HTML, CSS, JavaScript, React, and Flutter. This is where a privacy notice is presented and where a cookie banner is drawn. If someone tells you the user consented, ask to see the screen. Consent that depends on a hidden control, a pre-ticked box, or a label that bundles three decisions is a design fact before it is a legal conclusion.

Backend. The part the user does not see. It receives the instruction (“transfer”), applies the rules, and answers. Python, Node.js, PHP, Java, and Go are typical. A regulatory limit — a transaction cap, an eligibility rule — is only real if this layer enforces it. A sentence in a policy that the product “does not allow” a thing is a claim about code.

Database. The store for profiles, logs, and secrets. PostgreSQL, MySQL, and MongoDB are common names. Under the Nigeria Data Protection Act, this is where a breach becomes concrete. “We store personal data securely” is a claim about encryption, access, and who can read the rows.

Where it lives

Software sits on a computer that stays connected. That arrangement is hosting.

Cloud hosting — Amazon Web Services, Microsoft Azure, Google Cloud, and similar — means the company rents capacity. The machines may stand in Northern Virginia, Frankfurt, or somewhere else. The curriculum source treats section 41 of the NDPA as the cross-border transfer question: if the data centre is outside Nigeria, a transfer has happened, and the storage choice has to be defensible. Confirm the current text of that section before you rely on a number in a live matter. The literacy point does not depend on the numeral. It depends on asking where the bytes sit.

On-premise hosting means the company owns the machines, often in its building or in a local facility. Government and older banking contracts still do this. The clauses that matter are physical: who holds the key, who maintains the hardware, who carries fire and flood. Those clauses are almost irrelevant to a pure cloud deployment, and essential in an on-premise one.