XFQ/Platforms/MediSMS
MediSMS — reach thousands of people, and prove exactly what you sent.
Built so that a large organisation could stop emailing spreadsheets to a bulk-SMS reseller. Every branch is its own tenant with its own contacts, templates, sender ID and prepaid credit. Consent is recorded against every contact and enforced before a message is queued, and every action leaves a record that cannot be edited afterwards.
A hospital problem, with hospital-grade constraints.
The platform was commissioned by a private hospital group that needed to send appointment reminders, result notifications, follow-ups and billing notices to patients across multiple sites. That setting imposed the hard parts up front: personal-data consent under PDPA, identity numbers that must never appear in full on screen, an approval step before a junior member of staff can message thousands of people, quiet hours that are actually respected, and an audit trail that survives the question "who sent this, and when?"
Those constraints turned out to be exactly what any regulated or reputation-sensitive sender needs. The same engine now handles ordinary transactional and campaign messaging for retail, logistics, education and services — the rigour just comes as standard.
- Tenant isolation — each site has its own contacts, templates, sender ID, quiet hours, credit and users.
- Approval workflow — sends above a configurable threshold wait for an administrator.
- Identity masking — national identity numbers are stored masked and never rendered in full.
- Immutable activity log — who did what, from where, at what time; append-only.
Everything between "here is a spreadsheet" and "it was delivered".
Import wizard
Drag in an .xlsx or .csv export, columns are mapped automatically, every row is validated before anything is written, and matching is by reference then phone — so a re-import updates records instead of duplicating them.
Compose with real feedback
Pick recipients by name, by filter or by pasted numbers. Templates with placeholders, a live phone preview, a GSM-7 versus Unicode segment counter, and a cost estimate against available credit — before you press send.
Campaigns you can steer
Every send becomes a campaign with live progress and per-recipient status. Approve, reject, pause, resume, cancel or retry only the failures — and export a delivery report when it's done.
Automatic reminders
Rules such as "one day before" plus "two hours before", set per appointment type. Quiet hours are respected, and the same person is never reminded twice for the same event.
Per-recipient delivery status
Every message carries its own state — queued, sent, delivered or failed with the gateway's reason — so a "they never got it" can be answered from the record rather than argued about.
Reports that answer questions
Delivery rate, daily volume, breakdowns by campaign, department or sender, failure reasons, and the credit ledger — each exportable.
Not tied to one carrier.
Gateways sit behind a driver layer, so switching provider — or running a different one for a particular tenant — is a setting, not a rebuild.
| Driver | Typical use | Delivery receipts |
|---|---|---|
| iSMS Malaysia | Local sender IDs and domestic volume | Webhook |
| MoceanAPI | Regional coverage, transactional traffic | Webhook |
| Twilio | International recipients | Webhook |
| Generic HTTP | Any URL-based provider, or an on-premise GSM router | Webhook or polled |
| Simulator | Training and testing — nothing leaves the building | Simulated |
Credit control
Prepaid credit per tenant, one credit per message segment, with a top-up ledger, low-balance alerts and a balance check before any campaign is released — so a department cannot quietly spend the whole organisation's allocation.
Security posture
Hashed credentials, CSRF protection on every form, lockout after repeated failed logins, forced password change on first use, idle session timeout, and secrets held only in the environment — never in the database or the repository.
MediSMS
Messaging that has outgrown a reseller portal?
If you are sending at volume, to people whose consent matters, and you need to answer for it afterwards — tell us the scenario and we'll show you how it maps onto the platform.