Infrastructure for emerging markets
The infrastructure layer for Africa's digital economy
Korvix gives your product its foundations on day one: sign-in, teams and permissions, payments, and AI. Built for how business works here, and hosted here too.
- Cape Town
- Where we host, close to your users
- Under 400ms
- Sign-in speed, measured under load
- Separate by default
- Each customer's data, kept apart
Accounts and sign-in
One account system for every product you build. People sign up with an email or a phone number, and you get two-factor authentication and session control without writing any of it.
- Two-factor authentication with backup codes
- Sessions you can end instantly, on any device
- Suspicious re-use of a session is detected
The problem
Every company builds the same four things
Sign-in and accounts. Access to AI. Payments across banks, cards, and mobile money. APIs for your developers. Most teams build all four themselves before they can start on the product their customers actually asked for.
Accounts and teams
Months of work, before your product starts.
AI access
Wired up again for every product.
Payments
Three integrations, reconciled by hand.
Developer APIs
Added last, when customers are already waiting.
Korvix builds these once and runs them for you, so your product starts with them already working, and gets every improvement we make to them.
Who this is for
Built for teams shipping into Africa
Not a general-purpose cloud. A platform that knows exactly where it is at home.
Software teams building for African businesses
Fintechs, marketplaces, logistics and health platforms whose customers are companies rather than individuals: the ones who need accounts, teams and permissions on day one because their customer is an organisation with staff, not a single user.
Teams small enough that a year of plumbing hurts
Between roughly three and thirty engineers: past a prototype, not yet with a platform team. Large enough to need multi-tenancy and payments done properly, small enough that building them yourself is the year you do not spend on the product.
Anyone who has to answer for where the data lives
Selling into regulated buyers, or working under POPIA, the NDPR or Kenya's Data Protection Act. Everything runs in Cape Town, and tenant separation is enforced by the database rather than promised by the application.
Where the fit is strongest
Products whose customers are companies with staff, permissions and money to account for, hosted in Africa for users in Africa. Each product below says plainly what it does today and what is coming next, so a buyer never has to guess which is which.
What's included
Six things you no longer have to build
Each one is a finished service you call, not a template you copy and then maintain forever.
Accounts and sign-in
One account system for every product you build.
- Sign up by email or phone, with verification
- Two-factor authentication and backup codes
- Password reset that works properly
- Sessions you can end instantly, on any device
One key. Every service.
A single credential works across accounts, teams, payments, workflow, and AI, so there is one thing to issue, rotate, and revoke.
curl https://api.korvixsystems.com/organizations \
-H "Authorization: Bearer kx_live_<organization>.<secret>"Security
Security you can point to
Shared systems fail in two ways: a check somebody forgot to write, or records nobody can prove weren't altered. We handle both where they cannot be skipped: in the database, and in tests that read every route on every change.
- Encrypted in transit (TLS 1.2 and 1.3) and at rest
- Hosted in Cape Town, af-south-1
- Two-factor sign-in with backup codes
- Every read of a patient record logged
Customers cannot see each other
The database itself decides which rows a request may read. If a query does not say which customer it is for, it returns nothing rather than quietly returning somebody else's data. Automated tests check this on every change.
Records that show tampering
Every entry in the activity log is linked to the one before it. Change or delete a record and the chain no longer matches, so tampering shows up instead of passing unnoticed.
Sensitive fields are encrypted
Personal and financial details are encrypted one value at a time, with keys held in a managed key service. A value copied out of one place cannot be read anywhere else.
Abuse is limited from the first request
Sign-in, verification codes, password resets, webhooks and API keys all have their own limits, and ten wrong passwords lock an account for fifteen minutes. A test reads every route in the API and fails the build if one can be reached without a limit.
Signing out actually signs you out
Ending a session stops its access token within thirty seconds, everywhere it was used, rather than leaving it working until it expires. Passwords are hashed with Argon2, and a reused refresh token ends the whole session chain.
Payments that cannot be faked
A payment notice is accepted only if the provider that took the money signed it, and only for a charge started through that same provider. An amount or currency that does not match what was asked for is refused rather than credited.
Why here
Built for how business works here
Most platforms assume fast, constant internet, one currency, and card payments. None of that matches the reality on the ground, and working around it later is where the cost lands.
Hosted close to your users
We run in Cape Town rather than Europe or the US, because that is where the people using your product are. Sign-in stays under 400 milliseconds even under heavy load.
Every way people pay
Cards, bank transfer, and mobile money are recorded in one place instead of three systems joined together at reporting time. Reconciliation stays simple as you grow.
More than one currency
Amounts are stored exactly and always with their currency, so nothing drifts through rounding. It matters the first time you reconcile real money.
Works on a bad connection
If a request times out and the app tries again, it still only happens once. A duplicate never becomes a second charge.
Our products
We build on it too
Our own products use exactly the same APIs you get, with no private access and no shortcuts. It is the clearest evidence we can offer that the platform is real.
Korvix Finance
AvailableLending, from assessing an application through to repayments and collections, built entirely on the accounts, teams, and payment services described above.
For businesses already taking payments here, waiting on cash they have earned.
Read about Korvix FinanceKorvix Health
Ready for onboardingA clinic's whole day, from booking and the till to the ward, the theatre and the payroll, on the same accounts and permissions as everything above. Encrypted value by value, with every read of a record logged, including the refused ones. Reviewed by Nigerian data protection counsel.
For clinics, hospitals and digital health teams answerable under POPIA, the NDPR or Kenya's DPA.
Read about Korvix HealthKorvix Trade
AvailableSend money across borders from the same wallet, at the rate you were quoted. Built on the same accounts, permissions and ledger as everything above, with its own dashboard to book and track a payout.
For African businesses paying suppliers, contractors or staff across a border.
Read about Korvix TradeTell us what you're building
Whether you are choosing infrastructure for the first time or maintaining a version of it you would rather not, the conversation starts the same way.
Or email sales@korvixsystems.com