Kiwi

Company Overview

Kiwi is revolutionizing digital payments in India with their innovative RuPay credit card integrated with UPI. The platform enables users to "scan, pay and save" on everyday transactions, offering a lifetime-free credit card with 5% cashback on UPI payments - a unique value proposition in the Indian fintech market.

Operating in partnership with Yes Bank and AU Small Finance Bank, Kiwi has rapidly scaled to over 30 lakh (3 million+) customers, processing 2.3 crore (23 million+) transactions and delivering ₹18 crore in aggregate customer savings. Their premium "Neon" membership tier offers additional benefits including airport lounge access, making them a full-spectrum digital payments provider.

Based in Bangalore, Kiwi represents the new wave of Indian fintech companies that combine innovative product design with robust financial infrastructure to serve India's massive digital payments ecosystem.

The Challenge

As Kiwi experienced explosive growth in India's competitive UPI ecosystem, their engineering team faced mounting security and compliance pressures:

• RBI Compliance Requirements: Reserve Bank of India's stringent guidelines for digital lending and payment aggregators required comprehensive security controls and audit trails
• PCI-DSS for Card Operations: As a credit card issuer, Kiwi needed to maintain PCI-DSS compliance across their entire card lifecycle - from application to transaction processing
• UPI Security Standards: NPCI's UPI security framework demanded real-time fraud detection and secure transaction processing at massive scale
• Hypergrowth Security Debt: Rapid scaling from thousands to millions of users outpaced security team capacity
• Multi-Bank Integration: Secure API integrations with Yes Bank and AU Small Finance Bank required careful credential management and audit logging
• Real-Time Fraud Prevention: UPI's instant payment nature meant fraud detection had to operate in milliseconds, not minutes

"In India's UPI ecosystem, trust is everything. When a customer links their credit card to UPI and makes a payment at a local kirana store, they're trusting us with their financial identity. One security incident wouldn't just hurt Kiwi - it would damage the entire digital payments movement we're trying to build."

Head of Engineering, Kiwi

The Solution

Kiwi partnered with Gritt to build a security architecture that could scale with India's fastest-growing UPI credit card platform while meeting the complex regulatory requirements of the Indian financial system.

Phase 1: RBI & PCI-DSS Compliance Framework (Weeks 1-8)

Establishing regulatory compliance across multiple frameworks:

• Mapped RBI's Digital Lending Guidelines to implementable security controls
• Implemented PCI-DSS Level 1 controls for card data protection
• Deployed NPCI-compliant security measures for UPI transaction processing
• Created comprehensive audit logging meeting all regulatory requirements
• Established data localization controls per RBI's data storage directives

Phase 2: Real-Time Fraud Detection (Weeks 4-10)

Building fraud prevention that operates at UPI speed:

• Deployed ML-based fraud detection with sub-100ms decision latency
• Implemented device fingerprinting and behavioral analysis for transaction verification
• Created velocity checks and pattern detection across millions of daily transactions
• Built automated suspicious transaction reporting workflows
• Established 24/7 fraud operations integration with real-time alerting

Phase 3: Secure Card Infrastructure (Weeks 6-12)

Protecting the credit card lifecycle from application to transaction:

• Implemented end-to-end encryption for card data at rest and in transit
• Deployed tokenization for card numbers across all systems
• Created secure virtual card provisioning infrastructure
• Built HSM integration for cryptographic key management
• Established secure card activation and PIN management workflows

Phase 4: Bank Integration Security (Weeks 8-14)

Securing critical banking partnerships:

• Implemented mutual TLS for all bank API communications
• Deployed secrets management for Yes Bank and AU Small Finance Bank credentials
• Created secure reconciliation pipelines with tamper-proof audit trails
• Built real-time monitoring for integration health and anomalies
• Established incident response procedures coordinated with banking partners

Phase 5: Customer Data Protection (Weeks 10-16)

Comprehensive protection for 3M+ customer records:

• Implemented field-level encryption for KYC and personal data
• Deployed data classification and access control automation
• Created consent management system per India's data protection requirements
• Built secure customer data export and deletion workflows
• Established data breach detection and notification procedures

Technical Implementation

A critical innovation was the "Zero-Trust Transaction Pipeline" architecture. Every UPI transaction passes through multiple security validation layers - device verification, behavioral analysis, velocity checks, and fraud scoring - all executed in parallel to maintain sub-100ms total latency. This ensures security doesn't compromise the instant payment experience that UPI users expect.

For card data protection, Kiwi implemented a tokenization-first architecture where actual card numbers never touch application servers. Combined with HSM-backed encryption, this provides defense-in-depth that satisfies PCI-DSS requirements while enabling the seamless user experience that drives Kiwi's growth.

Results

Within six months of partnering with Gritt, Kiwi achieved comprehensive security and compliance milestones:

"Gritt helped us build security that scales with India's ambitions. When we process lakhs of transactions daily, security can't be an afterthought - it has to be invisible yet impenetrable. Our banking partners trust us, our regulators approve of us, and most importantly, our customers can scan and pay with confidence."

Head of Engineering, Kiwi

Looking Forward

Kiwi continues to expand their platform capabilities with security as a foundational pillar:

• Launching credit line products with enhanced underwriting security
• Expanding merchant acceptance network with secure onboarding automation
• Implementing biometric authentication for high-value transactions
• Building towards Account Aggregator integration with consent-based security
• Pursuing ISO 27001 certification for enterprise and government partnerships