Five domains between the fibre and the invoice

Replacing a billing platform at a broadband company is less about the rating engine than about everything subscribers have already arranged: auto-debit mandates, payment dates, discounts promised in writing and the look of the bill. Before a migration I list those arrangements and decide, for each, whether it moves untouched, moves with notice or ends with consent. At Kemaruna Fibre that list drove the card-token transfer and our decision to keep every billing date unchanged at cutover. I test billing changes by parallel running on a sample large enough to include awkward accounts, such as a household with three services and a disputed charge. I also insist that payment portability, data export and control of the bill format are written into the vendor contract. Those clauses cost little at selection and a great deal later.

Fourteen contractor firms carry out most of our installations, so our operations support systems must serve people who are not our employees. I connect three things: network inventory that knows which fibre port is free, an installers' app that records what was actually done, and automatic provisioning of the subscriber's terminal once the installer scans it. When the three agree, the household is online on installation day and billing starts on the correct date. When they disagree, the exception goes to a named planner rather than a shared queue. I review order-to-activation time, repeat visits and inventory mismatches weekly. Each contractor receives its own figures, because a crew that sees its repeat-visit rate usually corrects it faster than one that hears about it at a contract review.

The safest subscriber record is one we never kept. Since amendments to Malaysia's personal data law introduced breach notification and a formal data protection officer role, I have treated our data inventory as a list of liabilities, each needing a reason. For every category I ask what current purpose it serves, who can see it and when it will be destroyed. Identity-card images were the largest example, but call recordings, router diagnostics and marketing preferences receive the same treatment. Contractors are part of the estate: an installer's phone counts if it holds subscriber details. Our data protection officer works through my team day to day and has direct access to the chair of the audit and risk committee. Legal colleagues interpret the law; the operating decision stays with us.

I do not begin a hosting decision with cost per server. I begin with what a household would experience if a given system became unreachable for four hours on the worst evening of the year. Systems that subscribers meet only when they log in, such as billing or the self-service portal, can sit in a public-cloud region. Systems every router needs in order to reconnect stay near the network, on equipment we control across two sites. That split costs more than a single model, and I say so in the paper. I also check that the routes between the parts do not quietly rely on one provider. Our July 2025 incident showed that the connection can fail even when both ends are sound, and that a cheaper single contract had hidden the weakness.

A regional broadband provider relies on a few suppliers it cannot replace quickly: a billing platform, a cloud provider, two payment processors, the host operator that carries our resold mobile lines and the firms that install our fibre. I keep a register of those dependencies with a frank estimate of the time and cost to leave each one, and the audit and risk committee reviews it every year. My years at a hosted mobile platform taught me that clients often discover their dependence only during an outage. I therefore ask for data-export rights, documented interfaces and exit assistance in contracts, and we rehearse one exit plan a year on paper. None of this removes dependence. It turns the board's acceptance of it into a recorded decision rather than an accident of procurement.