A familiar nightmare plays out across Nairobi every month: a growing business pays an agency KES 80,000 to design their company website. Everything looks satisfactory at launch. Two years later, the business wants to update their office address, change a phone number in the footer, or migrate to a faster server. They email the agency, only to be met with silence. When they attempt to log in to their domain registrar, they discover the terrible truth: the .co.ke domain was registered under the developer's personal Gmail address, the hosting sits in an inaccessible shared reseller account, and the agency is demanding a KES 40,000 “administrative release fee” to hand over access.
Ownership of your website is not an abstract slogan on a sales brochure. It is a technical and legal reality defined by four specific assets. If any one of those four assets is registered under someone else's name, you do not own your website — you are merely renting it from whoever holds the passwords.
The four pillars of true digital ownership
Before you pay a deposit on any web development project in Kenya, ensure that these four components are registered directly in your company's name from Day 1:
- 1. The domain name (.co.ke / .com): For Kenyan domains ending in
.co.ke, the Kenya Network Information Centre (KeNIC) governs registration. The Registrant Contact on the WHOIS record must be your company name and official email address, not the web designer's personal email. You must have direct login credentials to the domain registrar (such as Kenya Website Experts, Truehost, or Safaricom Domains) and the ability to view or unlock your domain's EPP transfer code at any time without asking permission. - 2. The complete source code repository: You must have administrative access to the Git repository (GitHub, GitLab, or Bitbucket) containing the original, human-readable source code. A zipped folder delivered on a USB drive six months after launch does not constitute code ownership. You need version history, environment documentation, and automated deployment scripts.
- 3. The cloud hosting & DNS management accounts: Your domain DNS (preferably managed through Cloudflare) and your cloud production host (Vercel, Supabase, or AWS) must be registered under your organization's billing email. Even if your development partner manages updates on your behalf, you must hold the master owner account.
- 4. Third-party API credentials: Your Safaricom Developer Portal account (for M-Pesa Daraja keys), Google Search Console, Google Analytics 4, and transactional email accounts (Resend, SendGrid) must belong to your organization. If a developer disappears, your payment rails and customer communication must continue running uninterrupted.
If you cannot log in and change your office phone number yourself, you do not own the website. You are paying rent to whoever holds the root password.
The proprietary site builder trap
Another subtle form of lock-in comes from proprietary website builders and closed agency platforms. When an agency builds your site on a proprietary CMS or a closed-source website builder, you are tethered to their platform indefinitely. You cannot export the database schema, you cannot move to a different hosting provider, and if their company shuts down or raises prices by 300%, your digital presence is wiped out.
In contrast, sites built on modern, open industry standards — such as Next.js, React, Node.js, and TypeScript — can be maintained, upgraded, or migrated by any competent software engineer in Nairobi or anywhere in the world. You retain total operational sovereignty.
The pre-launch ownership audit checklist
On the day of website handover, run through this verification checklist before authorizing the final invoice settlement:
| Asset | Verification Test | Who Must Be Listed |
|---|---|---|
| Domain Registrar | Log into the registrar dashboard; verify registrant name and email | Your business legal entity & corporate email |
| DNS Management | Verify access to nameservers (Cloudflare / Registrar DNS) | Your corporate account |
| Source Code Repo | Verify organization ownership on GitHub/GitLab; invite team members | Your organization account as Master Admin |
| Payment Gateways | Verify Safaricom Daraja Shortcode & B2C/C2B portal access | Your registered business directors |
| Google Assets | Check Google Search Console & GA4 User Management | Your business Google workspace email as Owner |
Devaltech's Zero-Lock-In Guarantee
We believe client loyalty should be earned through quality engineering and responsive service, never through technical entrapment. Every Devaltech client owns 100% of their source code, domain, and hosting accounts from Day 1. You are free to take your code anywhere at any time without fees or friction.
What to do if your site is currently held hostage
If your current web developer is refusing to release your domain or code, you have legal and regulatory remedies under Kenyan law. For .co.ke domains, KeNIC maintains a dispute resolution mechanism: if you can prove business ownership with a certificate of incorporation or CR12 from the Business Registration Service (BRS), KeNIC can reassign the registrant contact directly to your organization.
If you are planning a fresh start or rebuilding your digital asset on solid foundations, read our guide on how much a website costs in Kenya or get in touch with us to discuss building on a clean, open architecture.