XFQ Innovation PLT · Malaysia
Production software,
built and operated
end to end.
We design, write, deploy and maintain the systems our clients depend on daily — a grid-compliance forecasting service for large-scale solar, an all-in-one business platform, and a multi-tenant messaging platform. Same team from first commit to production incident.
Three products, each solving a problem someone was doing by hand.
Every one of them started as a real operational requirement, was built from scratch rather than assembled from templates, and runs today on infrastructure we provision and harden ourselves.
WebGSO
Energy · Grid complianceForecast delivery for large-scale solar, in the grid operator's exact schema.
A complete forecasting service for a 50 MW solar plant: numerical weather forecasts ingested every cycle into a time-series database, reshaped into the national grid system operator's required JSON, and served over HTTPS as eight documented REST endpoints — rolling, day-ahead, week-ahead, four-months-ahead and live meteorological data. A separate branded dashboard gives the plant owner the same numbers with confidence bands and exports.
- Time-series pipeline
- REST · HTTPS
- Client dashboard
- P10/P90 bands
- 15-min resolution
- 4-month horizon
OrbitOne
Business operationsOne platform for invoicing, stock, accounts, people and pipeline.
Built for Malaysian SMEs that have outgrown spreadsheets but do not want five disconnected subscriptions. Quotations flow into invoices, invoices post themselves into a double-entry ledger, every stock movement is recorded rather than guessed, and payroll carries EPF, SOCSO and EIS. Modular — a company switches on only what it actually uses, inside a workspace isolated at the database level.
- Stock ledger
- Double-entry GL
- Statutory payroll
- MyInvois e-invoice
- Multi-tenant
- Modular
MediSMS
Messaging at scaleMulti-tenant SMS with consent, approval, delivery tracking and audit.
Originally built so a private hospital group could send appointment reminders, result alerts and follow-ups without handing a spreadsheet to a bulk-SMS reseller. Each site is its own tenant with its own contacts, templates, sender ID, quiet hours and prepaid credit. Consent is recorded against every contact and checked before anything is queued, and every send leaves an immutable trail.
- Multi-tenant
- xlsx/csv import
- Delivery tracking
- iSMS · Mocean · Twilio
- PDPA consent
- Audit log
Small team. Whole stack. No handoff to anyone who wasn't there.
We read the specification the way an auditor would
WebGSO's endpoints match the grid operator's rev4 document exactly — including the places where that document is inconsistent with itself between sections. We replicated the inconsistency rather than "correcting" it, because the party consuming the feed is the one whose spec counts. Getting this right is the difference between an integration that passes on the first submission and one that spends a month in email.
We pick the boring technology on purpose
Server-rendered and dependency-light where a business platform has to still run in five years with no build step. A modern framework only where a dashboard genuinely needs one. An editable flow engine where a data pipeline needs changing by an engineer rather than redeployed. The stack follows the problem, and we do not rewrite a working system to chase a framework.
We run the infrastructure, not just the code
Our own dedicated servers, provisioned from a script so any environment can be rebuilt from scratch: non-root operating account, key-only authentication, firewall, automated brute-force protection, automatic TLS, and databases that are never reachable from the public internet. The same ops model across every product, so there is one thing to learn and one thing to operate.
We write the document you'd need if we disappeared
Every project ships with a build and migration guide covering the decisions and the reasons behind them — why a host was dropped, why a forecast horizon was reduced, what still needs verifying before go-live. Honest documentation, including the parts that are not finished yet.
What we actually do all day.
Time-series & data pipelines
Ingesting forecast, telemetry and sensor data at scale — deduplicated upserts, partitioning, gap backfill, and reconciliation against the source system.
Web platforms
Multi-tenant business applications with role-based access, workspace isolation, audit trails and reporting — server-rendered, fast, and maintainable without a front-end team.
Integrations
REST and MQTT services, industrial protocol reads, SMS and payment gateway drivers, and Malaysian e-invoicing — written to somebody else's specification, tested against it.
Infrastructure & hardening
Server provisioning, containerised deployment, automatic TLS, firewalling, brute-force protection, secret handling and backup strategy — done once, scripted, repeatable.
Get in touch
Tell us what you're trying to run.
Whether it's a compliance feed with a hard deadline, a business drowning in spreadsheets, or messaging that has outgrown a reseller portal — describe the operational problem and we'll tell you honestly whether we're the right people for it.