Trust is what we can show you.
A regulated-lending vendor is judged on what regulators, auditors, and counsel can verify without our help. This page is what they read first.
Custody posture
Bolehlah is not an e-money issuer. We do not hold customer funds.
The lender pays each borrower from its own bank account and records the bank's receipt on the loan. Bolehlah prepares the disbursement checklist and, where the lender's bank takes one, a bulk-payment file that the lender uploads and releases under its own signers. Repayments, ANGKASA salary deductions included, are paid to the lender. The money never passes through a Bolehlah account at any point.
Audit trail
Every action written to an evidence trail a regulator can read without our help.
Consent capture, AKAD signature, disbursement instruction, eKYC outcome, and any manual override are logged with timestamp, actor, prior state, and resulting state. Records are append-only and tamper-evident. PDPA 2010 retention and subject-access obligations are written into the schema, not bolted on. The expectation: a regulator, internal auditor, or external counsel can reconstruct any decision without contacting us.
Consent architecture
Per-loan consent plus a member-owned catalogue of standing permissions.
The Malaysian loan form captures per-loan consent at AKAD signing — a binding, snapshot-encrypted record of exactly what the borrower agreed to, for that loan. A separate standing catalogue at /member/profile/consents lets the borrower see and revoke ongoing permissions (monthly monitoring, research retention, channel preferences). Any non-AKAD pull from a credit bureau requires explicit, logged consent.
Identity & access
Two-tier authentication, uniform across every lender.
Tier-1 is .com SSO — Google, Facebook, Apple, with MyDigitalID coming soon — bound to a verified NRIC. Tier-2 is dashboard step-up — password plus TOTP — required for any Member granted /client/* or /admin/* access, with no per-lender opt-out. NRIC is stored encrypted at rest. Member and User remain separate data models, linked only by foreign key, so a borrower's identity is never co-mingled with operator credentials.
Regulatory posture
Compliance is written into the platform's spine, not bolted on after the fact.
The platform was designed against Akta Pemberi Pinjam Wang 1951, BNM AMLA, PDPA 2010, and Shariah AKAD requirements — not adapted to them later. Bolehlah is operated by Lunar Flame Sdn Bhd, a Malaysian incorporated company. The product is currently in founder-led pilot stage; we do not list reference customers we have not earned. Due-diligence packs are available on request.
Data sovereignty
Private by architecture, honest by policy.
Every tenant is isolated at the database layer with row-level security, and every consequential action is hash-chained into a tamper-evident audit trail. Account records are stored in Malaysia (ap-southeast-5); documents you upload and documents we file for you are held in our hosting provider's encrypted storage in the United States. AI inference is served by a sophisticated AI model through a third-party processing provider and, because it uses cross-region inference profiles, may be served from a region outside Malaysia — under contractual no-training, no-retention terms: prompts and outputs are not stored and are never used to train third-party models. Your data is never sold or shared. What we keep, and what is removed automatically today, is set out in the retention policy below.
Retention policy
What we keep, for how long, and what is actually removed today.
We keep records rather than scrub them: closing an account stops sign-in and keeps its records. Loan records are kept for at least the loan tenure plus seven years after the final instalment. B conversation logs are kept for servicing and audit — no job anonymises or deletes them today. Vaulted documents are retained for legal and AML record-keeping. You can withdraw marketing consent at any time from your consent settings. Two scheduled jobs remove data today: a daily sweep deletes expired matching-profile personal data that is no longer part of an active match, and a job that runs once a year deletes audit-log entries older than seven years and research snapshots older than twelve months (records captured at signing are never deleted). An automatic purge of raw eKYC images is built but switched off pending legal review. On termination, the data-processing agreement commits us to return or delete a lender's data within 30 days — a step a person carries out, not an automated one.
Sub-processors
The third parties that process personal data on our behalf.
Our Privacy Policy names every sub-processor we use. This register restates the same parties in one place — each operates under a contractual data-processing agreement with protections equivalent to our Privacy Policy.
| Sub-processor | Role | Region |
|---|---|---|
| Innov8tif (the EMAS eKYC platform) | Licensed eKYC provider — one-time face / liveness identity verification. Lenders never receive the facial image; only the pass/fail result. | Singapore region (stored encrypted) |
| AI model processing provider (cloud infrastructure) | AI processing — generates B's replies and document intelligence from the messages you send and the minimum account context needed; under the provider's service terms the data is not stored, not used to train models, and the model's own provider has no access to it. | Stored in Malaysia; inference may be routed outside Malaysia |
| AI model provider (direct processing path) | AI processing — the same B replies, generated by the model's own provider reached directly rather than through a cloud-infrastructure host, under contractual no-training / data-protection terms. | United States |
| Twilio Inc. | SMS one-time passcodes, and a one-line SMS notice when a financing application is approved — receives your mobile number and the code or that notice (the notice names your lender, never an amount or a link). No other account data. | United States |
| Vercel Inc. | Hosting and encrypted file storage — serves the platform and stores documents you upload (payslips, bank statements) as private blobs. | Documents stored in the United States; global edge network |
| Google LLC (Places API · Workspace mail) | Address autocomplete — receives the address text you type so we can complete it. Separately, Google Workspace delivers our email to you, so it carries whatever those messages contain (for example a statement notice or a document link). Where your koperasi has switched on its email channel, mail you send to that koperasi's Bolehlah address is received and read through Google Workspace, and the original email is kept in Bolehlah's mailbox. Places receives only the address text. | United States / global |
| Telegram FZ-LLC | Telegram chat channel for members who choose it, and our own internal operations alerts. Those alerts can reference a loan or a member record, so Telegram may carry that information even for a member who never uses Telegram themselves. | United Arab Emirates / global |
| Meta Platforms, Inc. (WhatsApp Business) | WhatsApp channel — carries the messages exchanged with members who use WhatsApp, and the phone number they are sent to. | United States / global |
| Stripe, Inc. | Payment processing — receives the billing email and payment details needed to take a subscription or card payment. Card numbers go to Stripe directly and are never stored by us. | United States / global |
| Upstash, Inc. | Request-rate counters — short-lived counts that stop any one device or connection flooding the service. Each count sits under a one-way keyed hash made from a session or network address; it never holds a name, IC number, phone number or message, and it expires on its own when its time window ends, within minutes. | Singapore region |
Aggregate visit counts and page-performance metrics use Vercel Web Analytics and Speed Insights (Vercel Inc., our hosting provider) — cookieless, with no advertising cookies and no cross-site tracking (see the Privacy Policy's Cookies + tracking section).
This register is also reflected in the data-processing agreements (DPAs) we sign with customers.
Shariah trading rails
Every Shariah-flagged loan will ride the same DMCC TradeFlow Tawarruq rails Malaysia's Islamic banks use.
When a loan is structured as Tawarruq, Bolehlah submits a commodity-trade order over licensed Shariah-compliant Tawarruq trading rails (integration UAT-complete; live at go-live). The trading platform behind those rails is used by the country's leading Islamic banks (CIMB Islamic, Maybank Islamic, RHB Islamic, Public Islamic, Affin Islamic, MBSB, Kuwait Finance House, Bank Pembangunan, Agrobank, MIDF Amanah, Kenanga, Exim). Every Tawarruq AKAD produces three e-certificates (Purchase · Murabahah · Sale) evidenced on DMCC TradeFlow, attached verbatim to the loan's hash-chained audit trail. Borrowers and regulators get the same paper trail an Affin or Maybank Islamic customer would receive.
Investor access
Access to Bolehlah's investor materials
Behind this gate sits a one-page briefing book and a short product walkthrough deck. Requests are reviewed manually. We respond within one business day, Kuala Lumpur time.