How to Choose a Web Development Agency in Kenya: 12 Questions

# How to Choose a Web Development Agency in Kenya: 12 Questions

Summary: To choose a reputable web development agency in Kenya, verify Business Registration Service (BRS) incorporation, KRA PIN with eTIMS compliance, and registration with the Office of the Data Protection Commissioner (ODPC). Require milestone-based payments via corporate banking, secure an explicit written intellectual property assignment distinguishing foreground code under Kenya's Copyright Act, and confirm production engineering capabilities for local Safaricom M-Pesa integration and high-latency mobile networks.

---

The digital economy across Nairobi, Mombasa, and the wider East African region has matured beyond basic brochure websites. Kenyan enterprises, mid-market commercial firms, and high-growth startups rely on web platforms to process high volumes of financial transactions, collect customer data under strict regulatory oversight, and serve users accessing digital services primarily over mobile broadband.

Selecting the wrong digital partner leads to delayed timelines, security vulnerabilities, tax non-compliance penalties from the Kenya Revenue Authority (KRA), regulatory fines from the Office of the Data Protection Commissioner (ODPC), and proprietary code lock-in. When seeking to hire a web developer in Kenya or onboarding an established technical firm, your evaluation framework must assess engineering rigor, legal compliance, and regional operational viability.

Here are the 12 essential questions every executive, product manager, and procurement team must ask before signing a web development contract in Kenya.

---

12 Critical Questions to Ask Before You Hire a Web Development Agency in Kenya

1. Are You a Formally Registered Business Entity on eCitizen (BRS) with a Valid KRA PIN?

Before assessing design portfolios or technical stacks, establish the legal identity of the vendor. In Kenya, informal freelancers frequently present themselves as full-service agencies without formal corporate incorporation.

Require the prospective agency to furnish:

• A Certificate of Incorporation or Business Registration Certificate from the Business Registration Service (BRS) via the eCitizen portal.
• An official CR12 form (the official certificate from the Registrar of Companies detailing current directors, shareholders, and registered physical offices). While the Companies Act 2015 does not impose a statutory 90-day expiry period on CR12 forms, procuring a search certificate generated within the past 30 to 90 days is standard procurement and banking due diligence in Kenya to confirm that directorship and shareholding records remain current.
• A valid Kenya Revenue Authority (KRA) PIN certificate and a current Tax Compliance Certificate (TCC).

While Kenyan commercial and civil courts hear disputes against natural persons and unregistered sole proprietorships under the Law of Contract Act (Cap 23) and common law tort principles, litigating against an informal, unregistered vendor introduces severe operational and legal friction. Serving legal process, establishing personal liability, freezing disputed assets, and obtaining enforceable judgments against individuals lacking verifiable corporate identity or traceable assets is notoriously difficult, costly, and time-consuming. Formal incorporation under the Business Registration Service (BRS) ensures the entity possesses distinct legal personality, traceable directors, and verifiable physical jurisdiction.

2. How Do You Ensure Compliance with Kenya's Data Protection Act (ODPC)?

Enacted under the Data Protection Act (DPA) of 2019 and regulated by the Office of the Data Protection Commissioner (ODPC), Kenya enforces strict data privacy standards. If your web application captures names, phone numbers, national IDs, delivery addresses, or payment records, both your business and your technical agency face statutory obligations.

Confirm the agency:

• Holds active registration with the ODPC as a Data Processor or Data Controller in accordance with the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021.
• Implements data protection by design and default, including database encryption at rest (AES-256) and TLS 1.3 in transit.
• Complies with cross-border data transfer limitations outlined in Sections 48, 49, and 50 of the DPA and the Data Protection (General) Regulations, 2021 when provisioning cloud hosting outside Kenya.

Under Section 63(1) of the Data Protection Act, non-compliance exposes entities to administrative penalty notices of up to KES 5 million or up to 1% of the annual gross turnover of the preceding financial year, whichever is lower.

3. Who Legally Owns the Code, Database Schemas, and IP Under Kenyan Law?

A common pitfall in Kenya involves agencies claiming ownership of underlying source code after project completion, withholding repository access when clients decline expensive maintenance retainers.

Under Section 31(1)(a) of Kenya’s Copyright Act (Cap 130), when a work is commissioned for valuable consideration, statutory copyright is deemed transferred to the commissioning party as the first owner, subject to any agreement to the contrary. Commercial assignments and licenses are governed by Section 33, which requires assignments to be in writing signed by the assignor, while Section 32 governs the author's moral rights.

However, agency contracts frequently subvert this presumption through contrary boilerplate terms. Vendors may insert proprietary licensing restrictions, retain ownership over foundational components, or blur the boundary between client deliverables (foreground IP) and pre-existing agency libraries (background IP). Without explicit contractual precision, an agency can attempt to restrict code modifications or hold repositories hostage during scope or billing disputes.

Ensure your contract includes an unequivocal Intellectual Property Assignment clause:

• Clear separation between foreground IP (custom code, bespoke database schemas, UI design assets, and workflows created for your project) and background IP (open-source libraries or pre-existing agency modules).
• An explicit written assignment under Section 33 confirming that full, unencumbered ownership of all custom foreground code and assets vests in your company upon milestone settlement.
• Clarification and waiver of moral rights under Section 32 to the extent permitted by law, ensuring your internal engineering team can freely refactor, adapt, and maintain the codebase.
• Source repositories (GitHub, GitLab, or Bitbucket) provisioned directly within your corporate organizational accounts from day one, rather than hosted on agency-owned personal accounts.

4. What Are Your Milestone-Based Payment Terms and Do You Issue eTIMS Invoices?

Financial discipline and tax compliance distinguish professional engineering agencies from unstable operations. In line with standard software engineering contracting and commercial procurement models, payments should be structured into phased milestone disbursements linked to verifiable acceptance criteria rather than calendar dates.

A recommended enterprise milestone framework includes:

• Milestone 1 (Discovery, System Architecture, & UI/UX Signoff): 20% to 25% initial disbursement upon approval of technical specifications, wireframes, and database schema designs.
• Milestone 2 (Core Backend Architecture & Staging Integration): 30% to 35% disbursed upon deployment of core API endpoints and data models to an isolated private staging environment.
• Milestone 3 (Feature Completion & User Acceptance Testing): 25% to 30% disbursed upon complete feature implementation, automated integration testing, and formal User Acceptance Testing (UAT) signoff.
• Milestone 4 (Final Production Deployment & Warranty Retention): 10% to 15% held as retention for a 30 to 60-day post-launch warranty period to guarantee remediation of any latent production defects.

Demand an electronic Tax Invoice Management System (eTIMS) compliant invoice for every disbursement. Under Section 16 of the Income Tax Act, expenses without valid eTIMS invoices are disallowed as deductible business expenses for corporate income tax. Furthermore, if your organization is an appointed Withholding Tax (WHT) agent, ensure the agency accounts for the 5% professional services withholding tax deducted under Section 35 of the Income Tax Act. Disburse project funds exclusively via corporate bank transfers (EFT/RTGS) or verified business accounts, never to personal M-Pesa phone lines.

5. How Do You Architect and Test for Kenyan Network Realities and Mobile Latency?

Kenya is a mobile-first digital market. According to quarterly Sector Statistics Reports published by the Communications Authority of Kenya (CA), mobile broadband data subscriptions account for over 98% of total internet subscriptions nationwide. Domestic traffic is overwhelmingly routed across mobile carriers—primarily Safaricom and Airtel Kenya—making mobile network latency, packet loss, and cellular bandwidth the primary real-world performance constraints for end users. A web application that performs well on high-speed corporate fiber in Westlands or Upper Hill can suffer severe load-time degradation on 3G or congested 4G connections in Nakuru, Kisumu, or Eldoret.

Confirm the agency’s performance protocols:

• Adherence to Core Web Vitals thresholds: Largest Contentful Paint (LCP) under 2.5 seconds, Cumulative Layout Shift (CLS) under 0.1, and Interaction to Next Paint (INP) under 200 milliseconds benchmarked over simulated mid-tier 4G mobile conditions.
• Asset optimization pipelines, including modern image compression (AVIF, WebP), asset minification, critical CSS inlining, and code-splitting.
• Utilization of Content Delivery Networks (CDNs) with regional edge points of presence (PoPs) connected to the Kenya Internet Exchange Point (KIXP) in Nairobi to minimize round-trip latency.

6. Which Local Payment Gateways (M-Pesa Daraja, Pesapal, Flutterwave) Do You Integrate?

Digital portals in Kenya must support local payment instruments. Relying solely on international processors like Stripe or PayPal triggers substantial cart abandonment due to domestic preference for mobile money.

Verify direct implementation experience with:

• Safaricom Daraja 2.0 API: STK Push (Lipa na M-Pesa Online), Customer-to-Business (C2B) validation and confirmation callbacks, Business-to-Customer (B2C) payouts, and automated transaction status queries.
• Regional Aggregators: Production configuration with Pesapal, Flutterwave, or Paystack for multi-currency card and mobile money acceptance.
• Interbank Rails: Instant settlements via PesaLink (IPSL) for high-value business-to-business transactions.
• Security controls: Webhook signature verification (HMAC-SHA256), cryptographic replay prevention, and idempotency keys to stop duplicate billing during network timeouts.

The following TypeScript implementation demonstrates how a modern backend service structures a production-grade Safaricom Daraja STK Push request with cryptographic password generation and strict payload validation:

import axios from "axios";

interface DarajaStkPushParams {
  businessShortCode: string;
  passkey: string;
  amount: number;
  phoneNumber: string; // Format: 2547XXXXXXXX
  callBackUrl: string;
  accountReference: string;
  transactionDesc: string;
  accessToken: string;
}

interface StkPushResponse {
  MerchantRequestID: string;
  CheckoutRequestID: string;
  ResponseCode: string;
  ResponseDescription: string;
  CustomerMessage: string;
}

/**
 * Initiates an M-Pesa Daraja STK Push (Lipa na M-Pesa Online)
 */
export async function initiateDarajaStkPush({
  businessShortCode,
  passkey,
  amount,
  phoneNumber,
  callBackUrl,
  accountReference,
  transactionDesc,
  accessToken,
}: DarajaStkPushParams): Promise<StkPushResponse> {
  // Format current timestamp: YYYYMMDDHHmmss
  const date = new Date();
  const timestamp = [
    date.getFullYear(),
    String(date.getMonth() + 1).padStart(2, "0"),
    String(date.getDate()).padStart(2, "0"),
    String(date.getHours()).padStart(2, "0"),
    String(date.getMinutes()).padStart(2, "0"),
    String(date.getSeconds()).padStart(2, "0"),
  ].join("");

  // Daraja STK password is Base64(BusinessShortCode + Passkey + Timestamp)
  const password = Buffer.from(
    `${businessShortCode}${passkey}${timestamp}`
  ).toString("base64");

  const endpoint = "https://api.safaricom.co.ke/mpesa/stkpush/v1/processrequest";

  const payload = {
    BusinessShortCode: businessShortCode,
    Password: password,
    Timestamp: timestamp,
    TransactionType: "CustomerPayBillOnline",
    Amount: Math.round(amount),
    PartyA: phoneNumber,
    PartyB: businessShortCode,
    PhoneNumber: phoneNumber,
    CallBackURL: callBackUrl,
    AccountReference: accountReference.substring(0, 12),
    TransactionDesc: transactionDesc.substring(0, 13),
  };

  const response = await axios.post<StkPushResponse>(endpoint, payload, {
    headers: {
      Authorization: `Bearer ${accessToken}`,
      "Content-Type": "application/json",
    },
    timeout: 10000,
  });

  return response.data;
}

7. Can You Walk Us Through a Production Architecture Case Study in East Africa?

A polished portfolio screenshot does not verify production reliability. Request the agency's lead architect to present an in-depth review of a live platform deployed for an East African enterprise.

Examine:

• Architectural Pattern: Did they build a monolithic application, a modular service architecture, or a headless decoupled stack?
• Traffic Scaling: How does the system handle concurrent user spikes during marketing promotions, salary cycles, or seasonal sales?
• Database Indexing & Caching: How are relational queries indexed and cached (e.g., Redis, memcached) to prevent connection pool exhaustion?
• Direct References: Request contact details for the technical lead or CTO of three corporate deployments completed in Kenya.

8. Do You Build Custom Software or Rely on Pre-Packaged Templates?

Many vendors marketing themselves as custom web agencies in Nairobi purchase inexpensive pre-fabricated WordPress or Shopify templates, tweak styles, and mark up the price. Off-the-shelf templates frequently bundle bloated third-party dependencies, slow down page speeds, and introduce security vulnerabilities through outdated plugins.

Clarify their approach:

• For content platforms: Do they author clean, custom themes or deploy modern headless architectures (Strapi, Sanity, Payload)?
• For web applications: What modern frameworks do they employ (Next.js, React, Vue, Python/Django, Go, or Laravel)?
• When your commercial roadmap requires expanding digital touchpoints beyond web browsers into mobile ecosystems, partner with teams equipped for custom web engineering and app development in Kenya using unified APIs and shared backend services.

9. Who Controls Hosting, DNS Records, and .ke Domain Registration?

Administrative authority over your digital infrastructure must remain with your internal team. Agencies sometimes register client domains under agency-owned accounts at registrars accredited by KeNIC (Kenya Network Information Centre), using administrative access as bargaining pressure during invoice disputes.

Enforce clear parameters:

• The corporate .co.ke or .ke domain must be registered under your organization's official account with a KeNIC-accredited registrar, with your organization listed as the primary Registrant and Administrative Contact.
• Cloud hosting environments (AWS, Google Cloud, DigitalOcean, Hetzner, or local data centers) must reside in your company's billing tenancy, with agency access managed through delegated Identity and Access Management (IAM) credentials adhering to the principle of least privilege.
• DNS control (Cloudflare, Route 53) and SSL/TLS certificates must remain under your sole administrative authority.

10. What Post-Deployment SLA and Maintenance Guarantees Do You Provide?

Web platforms require continuous patching, database optimization, and security monitoring. Without an explicit Service Level Agreement (SLA), critical defects post-launch may go unaddressed for days.

Define expectations upfront:

• Response Windows: Contractual response times for critical outages (Severity 1: under 2 hours with 4-hour target remediation) versus minor cosmetic issues (Severity 3: within 24 to 48 hours).
• Patching Cadence: Scheduled updates for runtime environments, dependencies, and security patches addressing Common Vulnerabilities and Exposures (CVEs).
• Disaster Recovery: Automated daily off-site database backups with documented Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).

11. What Is Your Testing Protocol for Cross-Browser and Cross-Device Compatibility in Kenya?

Smartphone usage across Kenya features a wide spectrum of hardware capabilities. While project stakeholders often review applications on flagship iPhones and premium Samsung devices, target consumers widely use entry-level and mid-range Android devices from brands such as Tecno, Infinix, and Itel.

Verify testing procedures:

• Compatibility across browsers prevalent in Kenya, including Google Chrome Mobile, Opera Mini, Phoenix Browser, and Safari.
• Performance auditing on devices with constrained RAM (2GB to 3GB) and low processing throughput.
• Automated end-to-end testing (Playwright, Cypress) paired with physical device usability reviews.

12. How Do You Implement SEO Architecture and Local Schema Markup?

A well-engineered web application delivers negligible commercial return if it remains invisible to search engines across the Kenyan market. Technical SEO must be integrated directly into the core codebase during development.

Verify implementation of:

• Semantic Code Structure: Clean HTML5 hierarchy, comprehensive accessibility standards (WCAG 2.1), and responsive viewport definitions.
• Schema.org Structured Data: Valid JSON-LD graphs (Organization, LocalBusiness, Product, BreadcrumbList) configured with precise Kenyan location attributes, avoiding deprecated schemas.
• Search Engine Crawlability: Clean dynamic XML sitemaps, canonical tags, automated Open Graph social cards, and server-side rendering (SSR) or static site generation (SSG) for dynamic JavaScript frameworks.

---

Kenya-Specific Red Flags to Watch Out For

Evaluating agencies requires vigilance against common local operational risks:

---

Web Development Cost in Kenya: 2026 Market Pricing Guide

Understanding fair market rates prevents procurement teams from overpaying or selecting unrealistically low bids that result in abandoned codebases. The following price ranges reflect prevailing commercial market estimates compiled from Nairobi agency proposals, procurement bids, and regional engineering scoping frameworks in 2026. While Kenya has no statutory tariff for software engineering, these ranges provide realistic budgetary parameters for executive planning:

Key cost drivers across Kenyan engagements include senior engineering day rates, the depth of custom architectural scoping, compliance audits for ODPC standards, and the requirement for automated financial reconciliation pipelines.

---

Web Agency Checklist Nairobi: Technical Due Diligence

Before awarding a contract to a development firm in Nairobi, verify these core technical benchmarks:

• [ ] Corporate Registration: Validated BRS certificate of incorporation and recent CR12 form.
• [ ] Tax Compliance: Verified KRA Tax Compliance Certificate and registered eTIMS invoice generation.
• [ ] Data Protection: Documented registration with the ODPC as a Data Controller or Data Processor.
• [ ] Unconditional IP Transfer: Explicit contract clause assigning complete copyright and code ownership upon payment under Section 33.
• [ ] Payment Integration: Proven production deployments of Safaricom Daraja M-Pesa, Pesapal, or PesaLink.
• [ ] Infrastructure Control: Sole administrative ownership of KeNIC domain records and corporate cloud hosting tenancies.
• [ ] Mobile Performance: Documented Core Web Vitals compliance benchmarked over domestic 3G and 4G connections.
• [ ] Structured SLA: Legally binding support terms defining incident response times, patching cadences, and backup protocols.

---

Frequently Asked Questions (FAQ)

How much does it cost to hire a web development agency in Kenya?

Web development costs in Kenya vary significantly based on architectural complexity, integrations, and compliance requirements. Based on 2026 market estimates across Nairobi agencies, corporate brochure platforms typically range from KES 60,000 to KES 150,000; transactional e-commerce platforms with automated M-Pesa Daraja and payment gateway integrations range from KES 180,000 to KES 550,000; and custom web applications or SaaS portals range from KES 600,000 to over KES 2,500,000. Enterprise deployments requiring high-concurrency microservices, core banking/ERP connectivity, and rigorous ODPC compliance can exceed KES 8,000,000. Budgets are driven primarily by senior engineering hours, third-party integrations, and post-launch SLAs.

Can a Kenyan web agency legally hold my source code hostage?

Under Section 31(1)(a) of Kenya’s Copyright Act (Cap 130), copyright in commissioned works is presumed transferred to the commissioning party, subject to any agreement to the contrary. However, agencies often insert boilerplate clauses in Master Services Agreements that explicitly reserve proprietary rights, license code conditionally, or blur ownership between custom deliverables and pre-existing tooling. Furthermore, Section 33 mandates that copyright assignments must be in writing. If your agreement lacks an explicit IP assignment clause and repo handover schedule, an agency can exploit contractual loopholes or physical repository access to withhold source code during commercial disputes. Always establish corporate repository ownership and execute a written IP assignment before releasing project deposits.

Why is ODPC compliance mandatory for corporate websites in Kenya?

Under the Kenya Data Protection Act of 2019, any website collecting personal data from Kenyan citizens—including names, phone numbers, delivery addresses, and payment references—must adhere to statutory data protection principles. The Office of the Data Protection Commissioner (ODPC) regulates data handlers, and under Section 63(1), non-compliance carries administrative fines of up to KES 5 million or up to 1% of the annual gross turnover of the preceding financial year, whichever is lower.

What payment structure is safest when contracting a web agency in Nairobi?

The safest structure is milestone-based billing linked to verified technical deliverables: 20% to 25% upon contract execution and technical scoping, 30% to 35% upon staging deployment, 25% to 30% upon completing User Acceptance Testing (UAT), and 10% to 15% held as retention for 30 to 60 days following production launch. Disburse payments to a registered corporate bank account with official eTIMS invoices, avoiding personal M-Pesa transfers.

---

Sources

• Kenya Law: Data Protection Act, 2019 (ODPC)
• Office of the Data Protection Commissioner (ODPC) Kenya
• Business Registration Service (BRS) Kenya - eCitizen
• Kenya Revenue Authority (KRA) eTIMS Guidelines
• Kenya Copyright Board (KECOBO) - Copyright Act Cap 130
• Safaricom Developer Portal - Daraja 2.0 API
• Communications Authority of Kenya (CA) - Quarterly Sector Statistics Reports