Terms of Service

1. Parties & Definitions

In these Terms of Service:

• "PesaStack," "we," "us," "our" — PesaStack Limited, a private limited company registered in the Republic of Kenya, trading as Risiti. Contact: hello@getrisiti.com.
• "Risiti" — The web application and associated services available at getrisiti.com.
• "User," "you," "your" — Any individual or business entity that registers for and uses the Service.
• "API Customer" — A software provider, platform, marketplace, integrator, or other organization that accesses the Service through an API key.
• "Connected Business" — A merchant, supplier, buyer, or other business whose information or tax records an API Customer submits through the Service.
• "KRA" — Kenya Revenue Authority, the government body responsible for tax administration in Kenya.
• "eTIMS" — The electronic Tax Invoice Management System operated by KRA for real-time electronic tax invoice generation and transmission.
• "OSCU" — Online Sales Control Unit, the system-to-system API through which Risiti transmits invoices to KRA's eTIMS on your behalf.
• "Compliance Data" — All information submitted through Risiti, including invoices, credit notes, buyer-initiated invoices, item catalogues, supplier purchases, stock movements, identities, quantities, prices, tax classifications, consent records, and supporting transaction data.
• "Subscription" — Your paid access to the Service, billed monthly via M-Pesa.
• "Service" — Everything Risiti provides, including the web app, APIs, invoice generation, KRA transmission, SMS notifications, and customer support.

2. About Risiti

Risiti is a software platform that provides user interfaces and APIs for transmitting electronic tax and business records to KRA's eTIMS system. Risiti supplies technical infrastructure, validation, delivery, status tracking, and audit records. The person or business identified in a submission remains the issuer, buyer, seller, stock owner, or responsible taxpayer as applicable. Using an API, sandbox, dashboard, SDK, or other part of the Service constitutes acceptance of these Terms.

3. Eligibility

To use Risiti, you must:

• Be at least 18 years of age, or a duly registered business entity in Kenya acting through an authorized representative who is at least 18 years old.
• Hold a valid KRA Personal Identification Number (PIN).
• Provide accurate, complete, and current information during registration and keep it updated.
• Be legally authorized to conduct business in Kenya and to issue tax invoices.

By registering, you confirm that you meet these requirements. PesaStack reserves the right to verify your details and suspend access if eligibility cannot be confirmed.

4. Account Registration & Security

You are responsible for:

• Providing accurate business information including your KRA PIN, business name, and contact details.
• Keeping your login credentials confidential. Do not share your password with anyone.
• All activities that occur under your account, whether or not authorized by you.
• Notifying us immediately at hello@getrisiti.com if you suspect unauthorized access to your account.
• Protecting API keys as secrets, restricting them to authorized systems, assigning the minimum necessary scopes, rotating exposed keys, and revoking keys that are no longer required.
• Ensuring every Connected Business has authorized you to create, transmit, retrieve, or manage its Compliance Data and that your use complies with applicable tax, consumer, privacy, and data protection law.
• Maintaining appropriate controls over your employees, contractors, software, integrations, and end users. Actions performed with your credentials or API keys are treated as actions of your account unless caused by a security failure for which PesaStack is legally responsible.

Each KRA PIN may be associated with only one active Risiti account.

5. KRA eTIMS Liability — Please Read Carefully

PesaStack facilitates eTIMS record generation and transmission but does not determine whether the underlying transaction occurred, whether the submitter had authority, or whether a tax treatment is correct. To the maximum extent permitted by law, you accept responsibility for Compliance Data submitted by you, your systems, your users, and your Connected Businesses. Specifically:

• Not tax advice. Risiti is software. PesaStack is not a licensed tax consultant, accountant, or auditor. Nothing in the Service constitutes tax advice. Consult a qualified tax professional for compliance guidance.
• You own commercial truth and data accuracy. You must verify that each transaction is genuine and that identities, KRA PINs, invoice references, item classifications, quantities, prices, discounts, tax codes, credit-note reasons, purchase details, and stock movements are complete and correct. PesaStack is not responsible for consequences caused by Compliance Data supplied or approved by you or your Connected Businesses.
• Validation is not approval. A successful schema check, sandbox response, Risiti status, or KRA acknowledgement does not mean Risiti has audited the transaction, confirmed legal entitlement, or approved its tax treatment.
• Credit notes and corrections. You may issue a credit note only for a genuine correction, cancellation, return, or refund and must reference the correct original invoice. You are responsible for the legal and accounting basis of the correction.
• Purchases, suppliers, items, and stock. You are responsible for the existence of each supplier and item, the authenticity of supplier documents, and the accuracy of purchase and stock records. Risiti does not certify a supplier merely because its data can be stored or transmitted.
• Buyer-initiated invoicing. You may use buyer-initiated invoicing only where KRA permits it, the buyer is authorized, the seller is eligible, required declarations are accepted, and seller consent is obtained and recorded. You must not use this workflow to bypass seller, VAT, or eTIMS requirements.
• KRA acceptance is not guaranteed. KRA's eTIMS system may reject invoices for reasons entirely outside our control — system downtime, API changes, policy updates, or data validation failures on KRA's side. We automatically retry failed submissions, but cannot guarantee ultimate acceptance.
• KRA system availability is outside our control. Downtime, maintenance, or outages of KRA's eTIMS infrastructure are beyond PesaStack's control. We are not liable for any loss arising from KRA system unavailability.
• API and policy changes. KRA may change its eTIMS API specifications, integration requirements, or revoke vendor licenses. If this happens, we will work to restore functionality as quickly as possible, but we are not liable for any period during which the Service is affected.
• Maintain independent records. Do not rely on Risiti as your sole record-keeping system. Maintain your own copies of invoices, receipts, and financial records as required by the Tax Procedures Act, 2015.

6. Subscription & Payment

6.1 Plans

Risiti offers the following subscription plan:

• Risiti — the current price on the pricing page (unlimited invoices)

Plan features and prices may change. We will give you 30 days' notice of any price increases before they apply to your subscription.

6.2 Billing period

Billing timing, payment methods, and any promotional terms are the terms shown in the published catalogue and on the invoice presented before payment. Historical invoices retain the terms applied when they were issued.

6.3 Billing via M-Pesa

All subscription payments are processed via Safaricom's M-Pesa Daraja API (STK Push). By subscribing, you authorize PesaStack to initiate M-Pesa payment prompts to your registered phone number. We do not store your M-Pesa PIN or access your M-Pesa balance at any time.

Subscriptions do not renew automatically. Near expiry, Risiti may send an SMS reminder and you can choose whether to renew by completing a new M-Pesa STK Push payment.

6.4 M-Pesa Disclaimer

M-Pesa is a product of Safaricom PLC. PesaStack is not affiliated with, endorsed by, or a subsidiary of Safaricom. Payment processing is subject to Safaricom's own terms and conditions, network availability, transaction limits, and applicable fees. PesaStack is not responsible for:

• M-Pesa network downtime or failed transactions caused by Safaricom's infrastructure.
• M-Pesa transaction limits that prevent a payment from completing.
• Delays in payment confirmation caused by Safaricom's systems.
• Safaricom transaction charges, which apply as per Safaricom's published rates.

6.5 Failed Payments & Grace Period

If a payment fails, your account enters a 3-day grace period during which you retain full access. If payment is not completed within 3 days, your account will be set to read-only mode — you can view and export your existing invoices but cannot create new ones. Full access is restored immediately upon successful payment.

6.6 Refunds

Monthly subscriptions are non-refundable once the billing period has started. To request a refund or billing review, email hello@getrisiti.com.

7. Service Availability

PesaStack targets 99.5% uptime for the Risiti platform but does not guarantee uninterrupted service. Planned maintenance windows will be communicated in advance where practicable.

PesaStack is not liable for service interruptions caused by:

• KRA eTIMS system outages or maintenance.
• Safaricom M-Pesa network outages.
• Celcom Africa SMS infrastructure issues.
• Internet infrastructure failures beyond our control.
• Government regulatory orders, force majeure events, or acts of God.
• Outages of our cloud infrastructure provider (Convex).

8. Data Ownership & License

You retain full ownership of your Invoice Data and all business data you input into Risiti. PesaStack claims no intellectual property rights over your data.

By using the Service, you grant PesaStack a limited, non-exclusive, worldwide license to store, process, and transmit your data solely for the purpose of providing the Service — including transmitting invoices to KRA on your behalf. This license ends when you close your account.

Upon account closure, you have 30 days to export your data. See our Privacy Policy for full details on data retention and deletion.

9. Intellectual Property

The Risiti platform, including its software, source code, interfaces, branding, logos, and documentation, is the property of PesaStack Limited and is protected under Kenyan and international intellectual property law.

You receive a limited, non-exclusive, non-transferable, revocable license to use the Service for the purpose of managing your business invoicing. You may not copy, modify, distribute, sublicense, sell, reverse-engineer, or create derivative works from any part of the Service.

10. Prohibited Use

You agree not to use Risiti to:

• Issue fraudulent, fictitious, or inflated invoices.
• Facilitate tax evasion, money laundering, or any other illegal activity.
• Create invoices for transactions that did not occur.
• Create false or misleading credit notes, purchases, supplier records, item records, stock movements, consent records, or buyer-initiated invoices.
• Use a KRA PIN, business identity, personal data, or seller authorization without a lawful basis and appropriate authority.
• Use sandbox data as if it were a live KRA record, or attempt to bypass production approval, subscription, API scope, rate-limit, idempotency, security, or compliance controls.
• Share your account credentials with unauthorized third parties.
• Attempt to hack, reverse-engineer, or exploit the platform.
• Transmit malware, viruses, or conduct cyberattacks via the platform.
• Resell or sublicense access to Risiti without PesaStack's written consent.

Violation of these prohibitions may result, without prior notice where reasonably necessary, in request blocking, API-key revocation, suspension of the account and all Connected Businesses, permanent termination without refund, preservation of relevant audit records, reporting to KRA or law enforcement where required or permitted, and civil legal action. See our Acceptable Use Policy for more detail.

11. Limitation of Liability

To the maximum extent permitted under the laws of Kenya:

• PesaStack's total aggregate liability to you for all claims arising from or related to the Service shall not exceed the total subscription fees paid by you in the 12 months immediately preceding the event giving rise to the claim.
• PesaStack shall not be liable for any indirect, incidental, special, consequential, or punitive damages — including loss of profits, revenue, data, business opportunity, or goodwill.
• PesaStack shall not be liable for KRA tax penalties, audit costs, disallowed expenses, rejected tax returns, or any financial loss resulting from incorrect Invoice Data you submitted through the Service.
• PesaStack shall not be liable for claims arising from a transaction that did not occur, a submission made without authority or consent, an incorrect credit note or stock adjustment, a false supplier purchase, misuse of a Connected Business's data, or tax classifications and decisions made by you.
• PesaStack shall not be liable for losses caused by KRA system failures, changes to eTIMS specifications, or government regulatory actions.

Nothing in these Terms excludes or limits liability that cannot lawfully be excluded or limited, including liability arising from fraud, wilful misconduct, gross negligence, or a breach of a non-excludable statutory duty.

12. Termination

• By you: You may cancel your subscription and close your account at any time via the Settings page in the app, or by emailing hello@getrisiti.com. Upon closure, you have 30 days to export your data.
• By PesaStack: We may block a request, revoke one or all API keys, suspend a Connected Business, restrict live access, or terminate your account immediately where we reasonably believe the Service is being misused, Compliance Data is false or unauthorized, security controls are being bypassed, these Terms are materially breached, payment remains outstanding, or action is required by law or a competent authority.
• Effect of termination: Upon account closure, your data is preserved in read-only form for 30 days to allow export. After 30 days your account is soft-deleted. Tax and invoice records are retained for the applicable statutory period—ordinarily at least five years from the end of the relevant reporting period, and longer where another tax law, an amended assessment, investigation, or proceeding requires it—even if your account is closed. See our Privacy Policy.

13. Indemnity for Customer-Controlled Submissions

To the extent permitted by Kenyan law, you will indemnify and hold PesaStack, its directors, employees, and contractors harmless from third-party claims, regulatory demands, penalties, and reasonable costs arising from: Compliance Data you or your Connected Businesses supplied; transactions you represented as genuine; your lack of authority or consent; your tax treatment or record-keeping decisions; your breach of these Terms or applicable law; or misuse of your account or API keys. This indemnity does not apply to the extent a claim was caused by PesaStack's fraud, wilful misconduct, gross negligence, or breach of a non-excludable statutory duty.

14. Governing Law & Dispute Resolution

These Terms are governed by and construed in accordance with the laws of the Republic of Kenya.

Any dispute arising from or relating to these Terms or the Service shall first be attempted to be resolved through good-faith negotiation. If unresolved within 30 days, disputes shall be referred to arbitration in Nairobi under the rules of the Nairobi Centre for International Arbitration (NCIA). The language of arbitration shall be English. The arbitral award shall be final and binding.

Nothing in this clause prevents either party from seeking urgent interim relief from a Kenyan court.

15. Changes to These Terms

We may update these Terms from time to time. When we make material changes, we will notify you via email and in-app notification at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes your acceptance of the updated Terms. If you do not agree to the changes, you must stop using the Service before they take effect.

16. Contact

For questions about these Terms, contact us:

• Email: hello@getrisiti.com
• Website: getrisiti.com
• Company: PesaStack Limited, Nairobi, Kenya