Sudi brought Asha an old invitation email.
He did not bring a password.
Subject: **Welcome to Hatua za Alfajiri**
Recipient name: Sam N.
The original message header contained a recovery contact using the company domain.
“Save the original header,” Asha said. “Do not click anything.”
Vendor support acknowledged the preservation case and confirmed the account had been created through a liaison invitation.
They asked a mall security supervisor for a narrow attestation, not raw browsing logs.
Could he confirm whether Grace Nderitu had been a registered corporate guest during the time window when the account was created?
With the regulator authorization, he could.
The attestation said yes.
It did not reveal her browsing history.
“That is cleaner than an IP dump,” Mariam admitted.
Vendor support later confirmed that the liaison account mapped to Grace’s corporate identifier.
That established the creation link strongly enough for the regulator packet.
It still did not prove what she had personally read on every login.
The packet was layered: public: complaint exists, no names; regulator: account metadata, invite trail, liaison mapping; restricted: worker records only with consent.
Then Grace appeared unexpectedly in the mall cafeteria.
Sudi stiffened.
“Sam?”
Asha stopped him.
Grace looked from one face to the other.
“What is Sam?”
“We have an account-identity issue under preservation,” Asha said. “The regulator will receive the evidence.”
“You’re turning a walking group into a conspiracy.”
“No. We are verifying data flow.”
Sudi was furious after Grace left.
“That was the moment.”
“The evidence does not need a viral moment.”
Minutes later, vendor confirmation arrived.
Sudi stared at the message.
“Now we know.”
“We know enough to put her name in the regulator packet.”
“And public?”
“Not necessary yet.”
Mariam surprised Asha by agreeing.
“A clip would make Grace the whole story. The case is what happened to the data.”
That same afternoon, a courier delivered a demand letter to the shop.
**Unauthorized Trademark Use.**
The company alleged that Asha’s group had used its mark publicly and caused reputational damage.
The claimed amount was more than several months of shop income.
Mariam said, “They made the poster.”
“Yes.”
“Then this is ridiculous.”
“Maybe. Defending ridiculous things still costs money.”
Asha called her accountant.
The shop had no meaningful legal reserve. If the dispute escalated, she might have to cut stock or close overnight hours.
Elias arrived with chapati and found Asha and Mariam doing worst-case calculations.
“You’re about to lose money over people who don’t even buy enough tea from you.”
“Some buy tea.”
“That is not the point.”
He was right.
The case was no longer costing Asha only sleep and time.
Njeri advised them not to request full IP histories merely because the technology made it possible. The invite trail, recovery domain, vendor liaison mapping, and narrow guest attestation were enough to establish account creation without collecting a person’s movement history.
Sudi disliked that restraint.
“If she entered the group under a fake name, why protect her privacy?”
“Because standards do not become optional when the person is someone we distrust,” Asha said.
The sentence sounded like something Njeri would say, and Asha noticed it.
When the trademark claim arrived, the same principle became expensive. The group’s brief repost of the poster had indeed reproduced the company logo, even though the underlying poster came from the company/vendor side.
Asha could not simply say the claim was wholly invented.
Context favored her. Legal cost could still hurt her.
That was why she agreed to mediation rather than treating any negotiation as surrender.
It had reached the business that paid her rent.