Software engineering · Mobile · Backend · AI · Cloud
From design to deployment — and everything after.
SoftOps is the engineering team behind products in use across the UAE and Pakistan: the apps, the backends, the applied AI and the cloud they run on. We work as the whole engineering function for a small number of ambitious companies, and we own the outcome, not the ticket.
00Receipts, not adjectives
- 7,000+commits shipped on one client platform in its first 14 months
- 9/9live attack payloads blocked at the edge, zero false positives
- <8 minto rebuild 105 cloud resources from code, with zero drift
- 150nationalities of identity documents verified by AI that never touches the internet
- 8languages in one consumer app, right-to-left included
- 300+work items shipped through numbered releases on a single client platform
01Selected work
Our clients' names stay with them.
The engineering speaks for itself.
01 Community super-appUAE A social, live-video and gaming app for the UAE's South Asian workforce — built, run and shipped by one team, from phone to cloud.
One partner, the whole stack.
The client needed one team that could own everything — app, platform, cloud and releases — and keep shipping every few weeks without seams between them. We are that team.
- Flutter app in eight languages, with real-time voice and video inside games and live event rooms
- 12 microservices on an event stream, with a columnar store behind in-app analytics
- Kubernetes on AWS, provisioned as code and deployed by GitOps across three environments
- Real-time media on self-hosted servers the client controls
- Load suites that replay the app's real traffic before every major launch
- Automated App Store and Google Play publishing; bilingual public site
- Code-rendered marketing films: one script, three languages, four formats
Flutter · NestJS · Kafka · PostgreSQL · ClickHouse · LiveKit · Next.js · AWS EKS · Terraform · ArgoCD · k6
- 7,000+
- commits across mobile, backend, admin and infrastructure
- 300+
- work items shipped through numbered releases
- 8 + 36
- features and fixes in a single release, staged ahead of date
- 0
- per-minute vendor bills for live audio and video
02 Identity verification, air-gappedRegulated operator Reads passports and IDs across a dozen scripts, matches faces, checks liveness and fraud, and scores a verdict, all without a single call to the internet.
AI that never phones home.
An operator processing visa applications needed automated verification in an environment where applicant data is not allowed to leave. So every model runs from disk, and "accuracy" means scored against ground truth, not a demo.
- Vision-language OCR for six document types, from passports to bank statements
- Face matching across ID, passport and selfie, plus 1:N search to catch duplicates
- Liveness and document-fraud checks feeding a configurable policy engine
- Human review queues, an encrypted artifact vault, audit log and webhooks
- Three consoles: configuration, review and applicant capture
Python · FastAPI · Vision-language models · DeepFace · ONNX · NestJS · PostgreSQL · RabbitMQ · MinIO
- 16
- services, up and healthy from a single command
- 150
- nationalities whose identity documents the platform verifies
- 1,000
- ground-truth cases every change is scored against
- v1→v17
- face-matching releases in seven weeks, 82 tests
03 Zero Trust on AWSReference architecture A lean Zero Trust architecture built entirely as code, then attacked to prove it holds, at about $84 a month.
Proven under attack, not on paper.
Can a smaller organisation afford real Zero Trust? We built a reference architecture to find out, and signed it off on enforcement rather than configuration. The question isn't "does the rule exist?" but "does it hold when something pushes on it?"
- Ten infrastructure modules with remote state and locking
- Three-tier network with no NAT: no internet route from compute or data, at all
- Every cloud call through nine private endpoints
- Identity capped by permission boundaries that no admin override can exceed
- TLS 1.3-only edge with WAF, three encryption domains, locked backups
AWS · OpenTofu · Fargate · WAF · KMS · GuardDuty · Go
- 9/9
- live attack payloads blocked, zero false positives
- <8 min
- to destroy and rebuild 105 resources; 77/77 tests passing
- 720 ms
- p99 under load with every control on, 0% errors
- ~$84
- a month to run: Zero Trust at SME budgets
04 Visa-processing SaaSUAE Takes travel agencies from passport scan to government approval as one governed workflow, on a ledger built so money can't go missing.
Money you can audit.
Agencies, sub-agencies and agents share one platform, and each sees only its own world. Every application moves real money, so the ledger was designed before the screens.
- 11 services, with tenant identity stamped at the edge on every request
- National digital-identity sign-in; documents malware-scanned into isolated storage
- OCR with transliteration to pre-fill applications
- Double-entry wallet ledger with exactly one write path
- Saga-based charging with automatic reversal and a reconciliation sweep every minute
NestJS · PostgreSQL · BullMQ · OpenTelemetry · Next.js
- 11
- services, delivered in vertical slices from a walking skeleton
- 1
- write path for every dirham that moves
- 0
- charges without an application, or applications without a charge
- 60 s
- between reconciliation sweeps that catch any mismatch
05 NiwaalaOur product · Pakistan Our own food marketplace: customers, restaurant partners and riders on three apps that share one architecture, with compliance checked at onboarding, not after.
Three apps, one architecture.
Alongside client work, we build our own products, held to the same standard we ship for clients. A three-sided marketplace is really three products that have to agree on everything. One mobile architecture, one set of rules and one test trail from requirement to release keep them in step.
- Customer, restaurant-partner and rider apps on a shared clean architecture
- Restaurant web portal and operations console
- 11 services, including verification against food- and tax-authority records
- Payments and a wallet ledger; money held as integer minor units, never floats
- Spec-first QA with requirement-to-test traceability and production guardrails
Flutter · Bloc · NestJS · PostgreSQL · Next.js · Playwright · OpenTelemetry
- 3 + 2
- mobile and web apps from one team
- 11
- backend services in one monorepo
- 6
- onboarding modules specified, traced and tested
- 3
- build flavours per app: dev, staging, production
Also shipped
- Wellbeing appDaily check-ins become weekly insights. Nothing a user writes ever leaves the platform.
- Live audio streamingMosques broadcast sermons live with seven-day replay. Listening needs no sign-up.
- Community food-sharingNeighbours share home-cooked meals: geo-discovery, requests, ratings, moderation.
- AI proposal agentFour agents that analyse, score, write and review, so only good-fit work gets a reply.
- AI support agentConversational support with memory and authenticated sessions.
- Code-rendered filmOne script → three languages × four formats, with word-synced captions and generated music.
- Trading infrastructureStrategy research, backtesting and deployment for automated trading, as code.
02Capabilities
Your complete software lifecycle,
under one roof.
-
Product engineering
iOS and Android apps, web apps and the consoles that run the business. Multilingual, right-to-left, real-time audio and video, store releases on autopilot.
Flutter · React Native · Next.js · TypeScript
-
Platforms & backends
Services that stay simple as they grow: event streams, ledgers, multi-tenancy, analytics. Designed from a written spec, tested against real traffic.
NestJS · Python · Kafka · PostgreSQL · ClickHouse
-
Applied AI
Document understanding, face and liveness, agents that draft and review their own work. On-premise when the data can't leave. Scored against ground truth, not demos.
Vision-language models · LangGraph · ONNX · FastAPI
-
Cloud, DevOps & security
Kubernetes, infrastructure as code, GitOps, observability and Zero Trust. Rebuildable from the repository in minutes and proven under attack.
AWS · Terraform · OpenTofu · ArgoCD · Prometheus
-
Quality & delivery
Load testing, test automation and numbered releases on a live board you can open any time. You always know what ships next, and when.
k6 · JMeter · Playwright · Locust · GitHub Projects
Industries FinTech · Blockchain · Artificial intelligence · Health & wellbeing · Social media · Travel & GovTech
03Method
Engineering-first means
you can check our work.
We write it down first.
Specs and design documents before code. A recent product revamp was specified as six design documents, each mapped to a release, before the first commit.
You see everything.
One live board holds every feature, bug and release, and it's open to you. A release report is a saved filter, not a document someone rebuilds on Friday afternoon.
We measure before we promise.
Load suites replay your app's real traffic before launch. Capacity is a number we've measured, not a hope.
We prove security.
We sign off on enforcement, not configuration. If a control hasn't been pushed on, we don't call it done.
Everything is code.
Infrastructure, deployments, release pipelines, even marketing films. If it can't be rebuilt from the repository, it isn't finished.
AI in every stage.
Our engineers work alongside AI agents in spec, code, test and review, under conventions and guardrails written into every repository. It makes us faster without lowering the bar.
Your first 30 days
- Week 1
Talk to the engineers who'll build it. We map the problem, the constraints and the risks.
- Week 2
A written spec and architecture. You approve it before we write production code.
- Week 3
A walking skeleton in staging: every layer connected, end to end.
- Week 4
Your first numbered release, and a cadence you can plan a business around.
04Company
Built by engineers
who own the outcome.
We started SoftOps in 2022, in Lahore, to build the engineering company we wanted to work in: people who take ownership, grow together and make decisions together. Clients feel that as ownership beyond delivery. We tell you early what you need to hear, we guide you towards the right solution, and we're still here after launch.
Alongside client work we build our own products, starting with Niwaala, a food marketplace for Pakistan. Our goal is to become one of the best engineering companies in the world. We say it out loud so we have to earn it, one system at a time.
“We built SoftOps so that engineers here own outcomes, not tickets. Everything else — the standards, the platform, the trust our clients place in us — grows out of that.”
-
Ammar SajidCo-Founder & CEO
Runs the company and its client partnerships.
-
Muhammad UsmanCo-Founder & CTO
Builds high-performing teams, delivers complex software and brings modern AI practice into how we build.
-
Arbab KhalilCo-Founder & Head of Platform Engineering
A decade building platforms at scale, from SRE on a global learning platform to in-flight systems in Hamburg. Certified Kubernetes Administrator.
Have something hard to build?
Tell us about it. Your first conversation is with an engineer who could build it, not a salesperson.