Your business already has a public record.

The law already applies to you. Being small is not the exemption most owners think it is.

• Registration is mandatory for two of our three sectors, at any size

  Under the Third Schedule of the 2021 Registration Regulations, health administration and the provision of patient care and hospitality must register with the Office of the Data Protection Commissioner regardless of size. A six-room guest house is covered on the same basis as a chain.

  Outside those sectors a business is exempt only if its annual turnover is below KES 5 million and it employs fewer than 10 people — both conditions, not either. Registration costs KES 4,000 for a micro or small business up to KES 40,000 for a large one, and the certificate runs for 24 months.

• The fine has a ceiling and a cap, and the cap is the part that matters

  An infringement can cost up to KES 5,000,000 or 1% of annual turnover, whichever is lower, per infringement.

  Read that qualifier carefully, because most people quoting this number at you will leave it off. For a business turning over KES 40 million a year, 1% is KES 400,000 — a tenth of the headline. The ceiling is real and so is the cap, and a supplier who only tells you the frightening half is telling you the half that sells.

  Administrative penalties issued by the ODPC

  Date	Organisation	Sector	Penalty issued
  Dec 2022	Oppo Kenya	Consumer electronics	KES 5,000,000
  Sep 2023	Casa Vera Lounge	Hospitality	KES 1,850,000

  These are amounts actually issued, not the statutory maximum. The regulator has since announced inspections of the hospitality sector.

• The duties are technical, and they do not end

  The Act expects security safeguards, audit trails and event monitoring, regular testing of your software for weaknesses, and notification of a breach within 72 hours. Hospitals carry the Digital Health Act 2023 on top of that, and health services can be designated critical information infrastructure, which raises the stakes again.

  A dated report on your external exposure, and a record of what you changed after it, is evidence for one of those duties. It is not compliance, and we will not sell it as compliance. Compliance covers what you collect, what you tell people, how you store it, who you share it with and how your staff are trained. This is one technical control out of many, documented.

• The volume behind it is not aimed at you, which is the problem

  KE-CIRT, Kenya’s national cyber response team, detected 4.56 billion threat events in the fourth quarter of 2025, a 441% rise on the quarter before, and 3.37 billion in the first quarter of 2026. Serianu puts Kenyan cybercrime losses at roughly USD 230 million — about KES 29.9 billion — across 2024 and 2025.

  Almost none of that traffic chose you. It is automated, it is indiscriminate, and it does not check how many rooms you have first.

Four steps. The third one is a human being, and that is the point.

1. 01

   You send us a domain and a work email

   That is the whole form. Under a minute, nothing to install, no payment details and no account to create.

   You also confirm two things on the record: that you are authorised to request this for the domain, and that you understand it is not a penetration test. Both are stored with the exact wording you agreed to and the time you agreed to it, because an attestation nobody can reproduce is not a record.

2. 02

   We read the four public records

   Your DNS records and the mail posture derived from them, the certificate transparency logs, and the public domain registry. We never connect to your website or servers, never log in, and never test your defences.

   This part is quick. It is also the part that requires no permission from you, which is exactly why the free tier stops here.

3. 03

   A person reads the result and writes the report

   This is the slow part, and it is deliberate. Automated security tools are famous for producing pages of alarming findings that turn out to be wrong, and a hotel owner has no way to tell which is which.

   Nothing goes out until someone has checked that each finding is real, that the severity is honest, and that a non-technical reader can act on it. At launch that person is one of the founders. It costs us time, and it is the reason the report is worth reading.

4. 04

   It reaches you in one to two business days

   By email, from a person. You get an A to E rating with the reasoning behind it, an honest confidence level, your top three issues ranked by what they would actually cost you, what is already working, and a 30-day plan naming who should do each thing — you, your IT provider, your host, or us.

   Then nothing happens unless you ask. No sales sequence, no calls you did not request. If the report is useful and you want nothing else from us, that is a fine outcome.

Prices you can read before you talk to anyone.

• Prices are set in US dollars and shown with the Kenyan shilling equivalent at about 129 shillings to the dollar (July 2026). You are billed in shillings, and the conversion moves with the rate.
• There is no online checkout. We invoice you and you pay by M-Pesa, or by card on request. All paid work is delivered by people at launch.
• Managed protection and deeper authorised assessments are quoted after a scoping conversation. We do not publish a figure for them, because we have not yet validated one and an unvalidated price is a number you would find out was wrong.

Full pricing, scope and what each sprint includes