The questions your IT and audit teams will ask. Answered plainly.
Money and personal data deserve more than a nice interface. Here is what sits behind Kiplework, what is in progress, and what we will tell you when you ask.
Who regulates the wallet?
The Kiplework e-Wallet is issued by Kiplepay Sdn Bhd, Registration No. 200001007771 (510377-P), an e-money issuer approved by Bank Negara Malaysia under the Financial Services Act 2013. That approval carries ongoing obligations on safeguarding customer funds, governance, outsourcing and reporting, and it is reviewed by the regulator, not by us. Check our listing on the Bank Negara Malaysia register ↗
In placeWhere does the prefund money sit?
Employer prefund balances and staff wallet balances are e-money held under Bank Negara Malaysia's safeguarding requirements for approved issuers. Every payout is debited against a specific approval and recorded in one ledger you can export.
In placeHow do you verify staff before money moves?
Every staff member completes an electronic Know Your Customer check (eKYC) once, inside the app, before the wallet switches on. The wallet is PIN protected. Approval tiers and prefund limits are enforced by the system, not by the person approving.
In placeWho can see what?
Portal access is by role. HR, Finance and Operations each see only the areas their role allows, and staff see only their own records. Approvals, payouts and changes are logged with who, what and when.
In placeHas it been penetration tested?
An independent Vulnerability Assessment and Penetration Test (VAPT) is being completed ahead of launch. Findings are remediated before public release. A summary letter can be shared under a non-disclosure agreement once the test closes.
In progressHow is personal data handled?
Personal data is processed under the Personal Data Protection Act 2010 as amended. Staff data inside the product is processed on the employer's behalf under the service agreement, with the employer as data user. Data is encrypted in transit. Our privacy notice for this website is published in English and Bahasa Malaysia.
In placeWhere is data hosted?
Ask us. We will tell you the hosting region, the provider and the backup arrangement in writing as part of any security questionnaire.
On requestCan it connect to what we already run?
For large groups we scope integration with your existing HR system, scheduling tool or bank file format before a pilot starts. Single sign-on and API access are discussed case by case. We would rather tell you what we cannot do than surprise you in month three.
On requestWhat happens if Kiplepay has an incident?
As an approved issuer, Kiplepay operates under Bank Negara Malaysia's requirements for business continuity and incident reporting. Where a breach affects personal data and the law requires notification, we notify the Personal Data Protection Commissioner and affected parties.
In placeWho stands behind the company?
Kiplepay Sdn Bhd is a subsidiary of Green Packet Berhad, listed on Bursa Malaysia. That means audited accounts, a board, and public disclosure obligations that a private start-up does not carry.
In placeSend us your security questionnaire.
Register your interest, tick the box for a call, and mention security. We will come back with written answers, not a deck.