IoT software development in Malaysia: what the platform behind the sensors involves

What does the software side of an IoT project include?

Five parts: ingestion of device messages over MQTT or HTTP, a device registry and time-stamped storage, dashboards for operators and managers, alert rules with a record of who responded, and integration with the systems that need the data. Hardware, gateways and site wiring are a separate scope, usually handled by the device supplier or a systems integrator.

Most IoT disappointments in Malaysian SMEs come from the gap between those two scopes. The meter vendor delivers meters and its own app; the business wanted the readings in its billing system. Nobody quoted the piece in between. Write the software scope down first, then ask the hardware supplier to confirm what each device can send and how.

The platform does not need to be exotic. The same web stack that runs a CRM or an admin dashboard handles device data well at SME scale: an ingestion endpoint, PostgreSQL for storage, a web application for dashboards and a queue for alerts. What changes is the volume and the fact that the data keeps arriving whether or not anyone is logged in.

• IngestionA broker or endpoint that authenticates each device, accepts its messages and rejects anything unknown.
• Storage and registryEvery reading stamped with the device, site and time, plus a list of devices with their status, firmware and location.
• DashboardsPer site, per machine and per metric, on web and phone, with the right view for an operator and a different one for a manager.
• AlertsThresholds, repeat rules, who is notified on WhatsApp, email or push, and how an acknowledgement is recorded.
• IntegrationReadings and events into ERP, CRM, billing, ticketing or maintenance, and exports for finance and regulators.

How do devices send data to the platform?

Most modern devices publish messages over MQTT, a lightweight protocol designed for exactly this, or post them over HTTP. Older industrial equipment often speaks Modbus or a vendor protocol, in which case a gateway on site translates it. The software scope should name the protocol for every device type before anyone estimates the ingestion work.

MQTT works through a broker: devices publish readings to topics, the platform subscribes and stores them. It copes with poor connections, which matters at a site on the edge of mobile coverage. HTTP is simpler for devices that only report occasionally, such as a kiosk sending a daily sales summary.

Ask the hardware supplier for three things: the message format with an example, how each device authenticates, and whether the device can be addressed remotely for commands such as unlocking a door or restarting a machine. Commands are where security matters most, so they are scoped and tested separately from read-only monitoring.

What drives the cost of an IoT platform in Malaysia?

Six things: the number and variety of device types, how often each one reports, how long the data must be kept, how many dashboard views and roles are needed, the alert rules and channels, and the business systems that must receive the data. Hosting and messaging fees continue after launch and should be quoted separately from the build.

Two sites with ten identical meters each is a small project. Ten sites with meters, access control, chillers and a kiosk from four vendors is a different one, even if the dashboard looks the same, because every device type is an integration. Count the device types, not the devices.

Macoin does not publish a package price for IoT software, because the scope varies that much. WhatsApp +60 18-263 7350 with the device list, the sites, the people who need dashboards and the systems that must receive the data. We usually propose a pilot with a handful of devices and one dashboard as the first release, so the connection, alert rules and integration are proven before the rollout across every site is priced.

What should the security and ownership terms cover?

Each device must have its own credentials, all traffic must be encrypted, commands to devices must be restricted by role and logged, and personal data such as access-card holders must be handled under Malaysia's PDPA. The platform, its cloud account or server, and the device credentials should be registered to your company, with source code and documentation handed over.

The OWASP Internet of Things Project lists the common failures: shared default passwords, unencrypted traffic, no update path and no logging. Ask both the hardware supplier and the software developer which of those they have addressed in writing. A platform that can unlock doors or stop machines is an operational risk if that answer is vague.

Hosting can be a cloud account in your name or a server on your premises in Malaysia, depending on connectivity at the site and any data residency requirement. Either way, the accounts, the data and the ability to change supplier should stay with you. Macoin hands over the source code, deployment setup and documentation on full payment, as it does for every other system it builds.