Price list · concierge launch
Prices you can see before you talk to anyone.
A penetration test from a Nairobi consultancy — a different service from this one, which we do not sell — starts around KES 100,000 and can reach KES 1,000,000. Managed security runs from KES 200,000 a month. Both are the right answer for a large organisation and the wrong one for a 40-room hotel or a six-bed clinic. Everything below is fixed price and fixed scope.
01 The ladder
Six things you can buy, five of which have a price on them
The free snapshot is the whole of the free tier and it is complete in itself. Every paid row exists because somebody read a snapshot and asked us to do the work rather than do it themselves. Nothing renews without you agreeing to it, and the only thing here you could forget to cancel is Watch, which you can stop at any time.
| Tier | What it is | Price | In shillings | Who does the work |
|---|---|---|---|---|
| Free snapshot A domain and a work email address | One domain, read from public records, written up by a person | Free | KES 0 | A person reads the records and writes the report |
| Watch Domain verification, which takes about ten minutes | The same public records re-read every month, with a written note on what changed | USD 19 / monthor USD 190 a year | ≈ KES 2,450≈ KES 24,500 | A person re-reads the records each month and writes the note |
| Fix sprint: Email & Domain Shield Access to your DNS, or an introduction to whoever has it | Email spoofing protection set up properly, stray DNS records cleared, re-checked after | USD 199 once | ≈ KES 25,700 | Done with you by a person, over email or a call |
| Fix sprint: Breach Response Someone on your side who can reset accounts | Staff credentials in a public breach: work out the blast radius, reset in the right order | USD 299 once | ≈ KES 38,600 | Done with you by a person, over email or a call |
| Fix sprint: Website Cleanup Domain verification or written authorisation — this one connects to your systems | Close what should not be reachable from the public internet; fix TLS and configuration | USD 399 once | ≈ KES 51,500 | Done with you by a person, over email or a call |
| Managed protection A short scoping conversation | Ongoing protection and a documented trail for a regulated business | Request a quote | — | Scoped and delivered by people, after a conversation |
Shillings are converted at about 129 to the dollar (July 2026) and move with the rate; the dollar figure is the price and the invoice is in shillings. At launch every row is delivered by a person — there is no dashboard, no login and no automated delivery.
02 What each one is
In full, so you can decide without a call
-
Free
Free snapshot
One domain, one report. We read your public DNS records, the mail posture those records describe (SPF, DKIM, DMARC), public certificate transparency logs and the public domain registry entry. You get an A to E rating with its reasons, a stated confidence level, the three issues that matter most in plain language, what is already working, and a 30-day plan. One free snapshot per domain every 30 days.
Before we start: A domain and a work email address. Done by: a person reads the records and writes the report.
-
USD 19 a month
Watch
Once a month we read the same public records again for a domain you have verified, and email you a short written note on what changed since last time. It is a monthly re-read by a person, not a watching service: nothing alerts you between notes, and there is no response-time commitment. Cancel any time.
Before we start: Domain verification, which takes about ten minutes. Done by: a person re-reads the records each month and writes the note.
-
USD 199 once
Fix sprint: Email & Domain Shield
We set up SPF, DKIM and DMARC properly for your domain, clear out stray DNS records left behind by old suppliers, and read the records again afterwards so you can see the change took effect. This is the fix most businesses need, and it is the one that makes it hard for a criminal to email your guests, patients or suppliers in your name.
Before we start: Access to your DNS, or an introduction to whoever has it. Done by: done with you by a person, over email or a call.
-
USD 299 once
Fix sprint: Breach Response
Staff credentials have turned up in a public breach. We work out which accounts are affected and which of them matter, walk your team through resetting them in an order that does not lock you out of your own systems, and harden what let it happen.
Before we start: Someone on your side who can reset accounts. Done by: done with you by a person, over email or a call.
-
USD 399 once
Fix sprint: Website Cleanup
Close down the panels and services that should not be reachable from the public internet, and fix TLS and configuration problems. This sprint involves connecting to your systems, so it cannot start until you have verified domain control or signed the written authorisation.
Before we start: Domain verification or written authorisation — this one connects to your systems. Done by: done with you by a person, over email or a call.
-
Quoted after scoping
Managed protection
Ongoing protection and a documented trail for a regulated business, priced on what is actually in scope: sites, domains, staff identities, devices and systems. We quote after a short scoping conversation, because a single clinic and a five-property hotel group are not the same job and a list price for both would be a guess at your expense.
Before we start: A short scoping conversation. Done by: scoped and delivered by people, after a conversation.
03 Paying us
No card is stored, so there is nothing to forget about. Nothing on this site charges you automatically, and no price here renews without an invoice you see first.
M-Pesa, on an invoice, from a person
You are billed in Kenyan shillings, and M-Pesa is the payment route — because that is how Kenyan businesses actually pay. Mobile money reaches effectively every adult in the country, and more than 800,000 businesses already collect through Lipa na M-Pesa. Card payment is available if you ask for it.
There is no online checkout. When you decide to go ahead, a person sends you an invoice with the payment details on it, and the work starts once it is settled. We would rather tell you that plainly than have you look for a payment button that does not exist yet.
Watch can be paid monthly or a year at a time. A year is USD 190, which is two months free, and it saves you eleven M-Pesa transaction fees.
04 What no price buys
Everything paid here is delivered by people. That caps how many customers we can take in the first months, and it is why we would rather turn work away than sell an automated service we have not built.
The limits, stated before you pay rather than after
-
Not a penetration test, and not an audit
Nothing on this page includes attempting to break into anything. The free snapshot reads public records; the fix sprints change your configuration for the better and then check the change took effect.
-
No monitoring, alerting or incident response
Watch is a monthly re-read and a written note. Nothing here watches your systems continuously, nothing pages anybody at 3am, and no tier carries a response-time commitment. If a supplier tells you a KES 2,450 subscription buys round-the-clock response, ask them who is awake.
-
No compliance outcome
None of this makes your business compliant with the Data Protection Act. It gives you documented evidence relating to one technical control — external exposure — which is one part of what the Act expects. Compliance is broader, and it remains yours.
-
Shilling prices are conversions
They are indicative, calculated at about 129 shillings to the dollar, and they move. The invoice you receive is the number that counts.
05 Questions about price
What people ask before they pay
- Is the free snapshot really free? What is the catch?
- It is free, it is complete in itself, and there is no card to enter and no account to create. You can take the report to your own IT provider and never speak to us again — we would rather you did that than pay us for something you do not need. We earn money only when someone reads the report and would rather we did the fixing.
- How do I pay, and can I use M-Pesa?
- Yes. You are billed in Kenyan shillings and M-Pesa is the payment route. At launch a person sends you an invoice with the payment details on it: there is no online checkout yet, and we would rather say so than have you hunt for a card field that does not exist. Card payment is available on request.
- Why are the prices in dollars?
- Because the work is priced against costs quoted in dollars. You are billed in shillings, and every shilling figure on this page is converted at about 129 shillings to the dollar as of July 2026. Rates move, so treat the shilling figures as indicative and the dollar figures as the price.
- What does Watch actually do? Is it monitoring?
- No, and it is worth being precise. Once a month a person reads the same public records again for a domain you have verified, and emails you a short written note on what changed since the last one. Nothing watches your domain between those notes, nothing alerts you if something changes, and there is no response-time commitment. If you need genuine round-the-clock detection and response, we will tell you so and point you at a firm that sells it.
- Why is there no price for managed protection?
- Because we do not yet have one we can stand behind. A single clinic and a five-property hotel group are not the same job, and a list price covering both would be a guess made at your expense. We scope it in a short conversation and then quote a number. We would rather publish no price than an invented one.
- Do I have to verify my domain to buy something?
- Not for the free snapshot, which reads public records only. Watch and the Website Cleanup sprint do require it, because they involve either repeated work on a domain we need to know is yours, or checks that connect to your systems. Verification takes about ten minutes: a DNS record, a file on your web server, or a code sent to an address at your own domain.
- Does buying a fix sprint make my business compliant with the Data Protection Act?
- No, and be careful of anyone who says otherwise. Compliance covers how you collect data, what you tell people, how you store it, who you share it with, your supplier contracts and your staff training. What a sprint gives you is a dated record that you reviewed one part of your external exposure and what you did about it. That is a real piece of the picture, and it is not the whole of it.
One free snapshot per domain every 30 days. We read public records — DNS, mail records, certificate transparency logs and the domain registry. We never connect to your website or servers, never log in, and never test your defences. This is not a penetration test.
Start with the free one
Read the snapshot before you consider paying us for anything. It is written for an owner rather than an IT department, and it says plainly what we could not see.