Kiwi

About Kiwi

Kiwi lets customers use a RuPay credit card for everyday UPI payments. The Bengaluru-based company works with banking partners including Yes Bank and AU Small Finance Bank.

As the product grew to millions of customers, Kiwi had to keep instant payments fast while meeting the security expectations that come with card data, bank integrations, and regulated financial infrastructure.

What needed fixing

UPI leaves very little time to make a decision. Fraud checks, bank integrations, and audit logging all had to work without making a payment feel slow.

• RBI Compliance Requirements: Reserve Bank of India's stringent guidelines for digital lending and payment aggregators required comprehensive security controls and audit trails
• PCI-DSS for Card Operations: As a credit card issuer, Kiwi needed to maintain PCI-DSS compliance across their entire card lifecycle - from application to transaction processing
• UPI Security Standards: NPCI's UPI security framework demanded real-time fraud detection and secure transaction processing at massive scale
• Hypergrowth Security Debt: Rapid scaling from thousands to millions of users outpaced security team capacity
• Multi-Bank Integration: Secure API integrations with Yes Bank and AU Small Finance Bank required careful credential management and audit logging
• Real-Time Fraud Prevention: UPI's instant payment nature meant fraud detection had to operate in milliseconds, not minutes

What we changed

Kiwi partnered with Gritt to build a security architecture that could scale with India's fastest-growing UPI credit card platform while meeting the complex regulatory requirements of the Indian financial system.

Phase 1: RBI & PCI-DSS Compliance Framework (Weeks 1-8)

Establishing regulatory compliance across multiple frameworks:

• Mapped RBI's Digital Lending Guidelines to implementable security controls
• Implemented PCI-DSS Level 1 controls for card data protection
• Deployed NPCI-compliant security measures for UPI transaction processing
• Created comprehensive audit logging meeting all regulatory requirements
• Established data localization controls per RBI's data storage directives

Phase 2: Real-Time Fraud Detection (Weeks 4-10)

Building fraud prevention that operates at UPI speed:

• Deployed ML-based fraud detection with sub-100ms decision latency
• Implemented device fingerprinting and behavioral analysis for transaction verification
• Created velocity checks and pattern detection across millions of daily transactions
• Built automated suspicious transaction reporting workflows
• Established 24/7 fraud operations integration with real-time alerting

Phase 3: Secure Card Infrastructure (Weeks 6-12)

Protecting the credit card lifecycle from application to transaction:

• Implemented end-to-end encryption for card data at rest and in transit
• Deployed tokenization for card numbers across all systems
• Created secure virtual card provisioning infrastructure
• Built HSM integration for cryptographic key management
• Established secure card activation and PIN management workflows

Phase 4: Bank Integration Security (Weeks 8-14)

Securing critical banking partnerships:

• Implemented mutual TLS for all bank API communications
• Deployed secrets management for Yes Bank and AU Small Finance Bank credentials
• Created secure reconciliation pipelines with tamper-proof audit trails
• Built real-time monitoring for integration health and anomalies
• Established incident response procedures coordinated with banking partners

Phase 5: Customer Data Protection (Weeks 10-16)

Comprehensive protection for 3M+ customer records:

• Implemented field-level encryption for KYC and personal data
• Deployed data classification and access control automation
• Created consent management system per India's data protection requirements
• Built secure customer data export and deletion workflows
• Established data breach detection and notification procedures

Technical Implementation

A critical innovation was the "Zero-Trust Transaction Pipeline" architecture. Every UPI transaction passes through multiple security validation layers - device verification, behavioral analysis, velocity checks, and fraud scoring - all executed in parallel to maintain sub-100ms total latency. This ensures security doesn't compromise the instant payment experience that UPI users expect.

For card data protection, Kiwi implemented a tokenization-first architecture where actual card numbers never touch application servers. Combined with HSM-backed encryption, this provides defense-in-depth that satisfies PCI-DSS requirements while enabling the seamless user experience that drives Kiwi's growth.

What changed

Six months into the work, the main payment and card flows were covered by a consistent set of controls.

Looking Forward

Kiwi continues to expand their platform capabilities with security as a foundational pillar:

• Launching credit line products with enhanced underwriting security
• Expanding merchant acceptance network with secure onboarding automation
• Implementing biometric authentication for high-value transactions
• Building towards Account Aggregator integration with consent-based security
• Pursuing ISO 27001 certification for enterprise and government partnerships