I build software people can trust.
Co-founder and CTO of Mula Technologies, a market data platform for Ghana-listed stocks. A full-stack engineer who owns systems from idea to production. Security is part of the design from the first line, not a patch at the end. I have also shipped for a bank, an investment firm, and apps used by thousands of people.
Trusted by teams across Ghana and beyond
Fidelity Bank
OrangeTech
Zomujo
Beistand Tech
Dayout
Most systems are secure until someone checks. I build the ones that are still secure when they do.
TLS and HSTS · Content Security Policy · CSRF protection · OAuth 2.0 and OIDC with PKCE · Session tokens and session binding · Server hardening · Role-based access · Audit trails · Rate limiting
OAuth 2.0 and OpenID Connect with PKCE, nonce and state. Tokens are verified on the server, redirects are locked to an exact allowlist, and secrets are compared in constant time.
Opaque session tokens that are stored only as hashes and can be revoked, with idle and absolute expiry. Cookies are HttpOnly, Secure and SameSite, and every session is bound to the browser that created it, so a stolen cookie alone gets an attacker nowhere.
CSRF protection on every state-changing request, a strict Content Security Policy, and server-side sanitization and validation as the real boundary, because the client is always assumed to be hostile.
TLS everywhere with HSTS, strict security headers, rate limiting against brute force and abuse, and servers closed to everything they do not need to serve.
I provision and run the servers myself. SSH is key-only with root and passwords switched off, firewalls at the host and at the provider allow only web and SSH, repeated bad logins get banned, security updates install automatically, and the cloud account itself is protected with two-factor. Admin tools are never left on a public port, and databases never are.
Role-based access enforced in the API and the database, deny by default. Every sensitive action goes into an audit trail, so there is always an answer to who did what and when.
Access rules, CSRF checks and security headers are covered by automated tests that try to break them. I also built my own tool to catch unsafe sign-in flows (OAuthGuard, below).
I do not only write software. I buy, build and run the infrastructure it lives on.
I chose, set up, secured and now look after the servers for two companies, from the first login to the ongoing patching and upkeep.
I weigh a dedicated server against AWS against managed hosting on cost, risk and who has to maintain it. Internal tools went on a self-hosted server to keep running costs low, while other workloads stay on AWS.
Everything runs in containers behind HTTPS with certificates that renew on their own. A push to the main branch deploys it, DNS and domains are managed, and release pipelines take new versions to users automatically.
AWS Certified Cloud Practitioner, with hands-on time across AWS, Docker, CI/CD pipelines and Firebase.
Sign-in request→Proxy inspects→Policy decides→Log, warn or block→Report
- Sits in front of an app as a proxy and inspects OAuth and OpenID Connect authorization requests in real time.
- Policy decides the response for each finding: log it, warn, or block it. Findings export in a format teams can feed into their own tools.
- Also works offline against saved requests, and ships with a secure and a deliberately insecure demo app so the difference is visible.
- Built as a defensive tool for systems you own, with a documented threat model and clear limits.
Outcome Manual payment processing time cut by 70%, at 100+ requests a day.
Request→Approval flow→Escalation→Core banking posting→Audit trail
- Approval flow with role-based routing, a full audit trail and automatic escalation to executives, handling 100+ requests a day.
- Posts to the bank's core banking system, which cut manual payment processing time by 70%.
- Built so nothing moves without the right person approving it, and every step can be traced afterwards.
- Session-bound sign-in and CSRF protection on every state-changing request, because it moves real payments.
Exchange sources→Collectors→Data API→DataHub app→Alerts
- DataHub: a web app with company profiles, annual and quarterly reports, a live market table, company comparisons over several years, and beginner guides.
- A documented data API behind it that is aware of the exchange calendar, with live quotes, price and index history, market movers and technical indicators.
- Collectors and importers that keep the data fresh during market hours, plus a watcher that alerts on new exchange press releases.
Outcome Ran a live public offer end to end on self-hosted, hardened infrastructure.
Onboarding→Identity checks→Review→Subscription→CRM
- Investor onboarding with identity checks, staff review, and role-based access to every record.
- A subscription platform that ran a live public offer, self-hosted on a hardened server with strict database rules.
- A CRM for the investment banking team, with assignments, priorities and email alerts.
- Hardened throughout: OAuth with PKCE, CSRF protection, a strict Content Security Policy, HSTS and rate limiting.
Outcome Won a GH¢20,000 innovation prize at the 3i Africa Summit with the AkuaTrust Labs team from KNUST.
Payment link→Escrow hold→Delivery→Release→Trust score
- Payment links, held funds, delivery confirmation and automatic release.
- A rules-based trust score built from on-time delivery, dispute-free sales, repeat buyers and identity strength. No black box.
- Dispute handling with evidence windows and a fairness rule that weighs seller history.
Outcome Release cycles 60% shorter for 10,000+ active users.
Prompt→Fan out→Compare→Release pipeline
- Concurrent queries across models with side-by-side comparison and multimodal output.
- Automated release pipeline that shortened release cycles by 60% for 10,000+ active users.
- Critical flows covered by automated tests.
Outcome API parsing time halved, memory down 40%, and 5,000+ student merchants onboarded.
Design system→Offline-first data→Real-time→Release
- Superstars: rebuilt for speed, halving API response parsing time and cutting memory use by 40% on long lists.
- Zomujo: three connected mental health apps with encrypted real-time chat between clients and therapists.
- STUDEX: offline-first shopping and a peer-to-peer marketplace that brought on 5,000+ student merchants.
- Dayout: a calendar app for finding things to do, from events to food spots, and adding them to your day.
We agree what done looks like before any code is written, including what is out of scope, so there are no surprises on either side.
Work ships in short increments you can try, with a plain-language update at a regular rhythm, not one big reveal at the end.
Access rules, logging and hardening are part of the plan and the estimate from day one.
Everything is documented, with tests and deployment steps included, so your team or the next engineer can run it without me.
I put my work in front of expert judges, and it placed.
The 3i Africa Summit is convened by the Bank of Ghana and Development Bank Ghana and brings together Africa's fintech and innovation community. Our KNUST team, AkuaTrust Labs, won a GH¢20,000 innovation prize for AkuaTrust, an escrow and trust-score platform for people who sell through WhatsApp and Instagram.
A global competition where a student team plays the equity analyst for a listed company: value the stock, write a full research report ending in a buy, sell or hold recommendation, and defend it live in front of finance professionals. Our KNUST team, 360 Insights, analysed MTN Group and finished third in the Ghana final in Accra, against teams from five universities.