File note · Kuching
Runtime Grid Core audits fintech applications — wallets, remittance, lending, and merchant payments — by walking the same paths your customers and operations teams walk. The output is a findings pack, not a slide about transformation.
Request a review
A payment journey review is the usual starting point. We enrol, top up, send, fail, refund, and then ask operations to reconstruct the same transfer. Where the customer balance and the back office disagree, we write it down with steps someone else can repeat.
You leave with a severity-ordered pack and a walkthrough. Fees are scoped after a short intake; a typical payment journey review starts from RM 18,000. There is no checkout on this site.
Each engagement is a named pass over part of the application. We do not sell retainers as a default, and we do not run a scanner and call it an audit.
A screen-by-screen walk of how money moves in your app — from first tap to settlement — with gaps written down in plain language.
We enrol as a new customer, then as a blocked one, and record where identity checks help, stall, or leak more data than they need.
A structured read of how your application lines up with Bank Negara expectations and the Personal Data Protection Act — tied to screens, not to a policy binder.
We sample balances, holds, and reconciling jobs to see whether the wallet the customer sees can be explained by the books you keep.
A review of how your app talks to banks, KYC vendors, and payment partners — including what happens when those talks fail.
A time-boxed pass over a build that is about to go live, focused on the journeys you will be judged on in the first ninety days.
They sat with our refund screen until they could break it on purpose, then wrote the steps so engineering did not have to guess. The walkthrough was blunt in a useful way.
Operations lead, Kuala Lumpur e-money issuer
We had policy papers. We did not have a map of where PDPA duties actually live in the app. Runtime Grid Core gave us that map with screen names we could hand to counsel.
Programme manager, Digital lending team, Penang
The pre-launch pass told us which two journeys were not ready. We delayed those, shipped the rest, and came back for a re-check. No theatre.
Founder, Remittance app, Kuching
Not a pentest, not a policy review. A record of how we spend the first week inside a wallet or payments product.
Consent banners are easy to screenshot. Retention of IC images and the path to withdraw consent are harder — and that is where we spend time.
Expired IC retries, silent vendor timeouts, and rejection screens that strand people with no next step.