Our Technology

The stack we build on

We work with technology that is proven, supportable and available in Oman. Someone has to maintain this after we hand it over, and your team should be able to hire for it locally - that matters more than novelty.

Web platforms technology – HTML5, CSS, bilingual
Web platforms

Front ends your own staff can update

Standards-compliant HTML5 and CSS, with WordPress behind it when the content needs to change without a developer in the loop.

  • Public websites, member portals and self-service booking
  • Bilingual Arabic and English, right-to-left by design
  • Live results and display screens for event days
  • Tested to WCAG 2.1 AA on every browser and device in scope
  • Editor training, administrator guide and documentation at handover
HTML5
CSS
WordPress
WCAG 2.1 AA
AR / EN
Mobile app technology – iOS and Android
Mobile

Built for staff who are nowhere near a desk

Native iOS and Android applications, and mobile-first web for the teams doing the work in the field - inspectors, drivers, referees, range officers.

  • Native apps published to the App Store and Google Play
  • Field apps for result entry, attendance and on-the-spot verification
  • Digital membership cards with a QR code for instant check-in
  • Offline-tolerant screens for weak coverage
  • Improvements to apps you already have, not only new builds
iOS
Android
Mobile-first web
QR cards
Push & OTP
APIs and real-time technology
APIs and real time

Systems that talk to each other, documented

Every platform we hand over ships with a documented interface, so the next integration doesn't need us in the room.

  • REST and GraphQL, specified with OpenAPI 3.0
  • WebSockets and server-sent events for live scoring and results
  • Live boards that update the moment someone commits - no double bookings
  • Background jobs for bulk notifications, retries and scheduled work
  • Rate limiting and an API gateway in front of it all
REST
GraphQL
OpenAPI 3.0
WebSockets
SSE
Core platform services – authentication, workflow, notifications
Core platform services

Identity, payments and permissions, already built

The services every platform needs run as shared, proven modules, so a new build starts from working parts instead of an empty repository.

  • National ID card scan with OCR, verified by a one-time password
  • Member profiles and digital cards, with renewals built in
  • Booking with live availability, eligibility rules and short soft holds
  • Payments through Thawani, bank transfer or cash, tracked to reconciliation
  • SMS and WhatsApp notifications, with roles and permissions down to the action
OCR
OTP
Thawani
WhatsApp API
RBAC
Data and databases technology
Data and databases

The part that has to be right

A relational core with a caching layer in front and an object store beside it, plus deep Oracle experience for the systems already running on it.

  • PostgreSQL as the relational core, with search built in
  • Redis caching so reports don't punish the database
  • Private object storage with signed URLs for documents and media
  • Oracle and Oracle APEX development, tuning and migration
  • Daily incremental and weekly full backups, with restores tested, not assumed
PostgreSQL
Redis
Oracle APEX
Object storage
Business intelligence technology
Business intelligence

Decisions from live data, not last month's spreadsheet

Dashboards that read from the systems you already run, so leadership sees the same numbers the operation does.

  • Power BI dashboards and management reporting
  • Live statistics on registrations, bookings, payments and results
  • Data models that join several sources into one view
  • Reports delivered on a schedule, without anyone assembling them
  • KPI tracking built around what your board actually asks for
Power BI
Power Apps
Data modelling
KPI dashboards
Cloud and hosting in Oman
Cloud and hosting

Hosted in Oman, sized for the day it matters

In-country cloud across multiple availability zones, because tournament day and renewal season don't spread the load out politely.

  • In-country hosting, multi-AZ, sized for peak not average
  • WAF and DDoS protection with a CDN in front
  • Central logging and a health dashboard you can see too
  • Monitoring, patching and security updates under a defined SLA
  • Open-source software and virtual machines to keep licensing sane
In-country cloud
Multi-AZ
WAF + DDoS
CDN
Security and compliance technology
Security and compliance

A first-sprint workstream, not a final-week scramble

Cybersecurity approval, personal data law compliance and a full audit trail are in place before review begins, not bolted on when it fails.

  • TLS 1.3 in transit and AES-256 at rest, document stores included
  • Personal Data Protection Law compliance and in-country data residency
  • Cyber Defence Authority requirements met before security review
  • Every sensitive action and role change logged with who, when and why
  • Independent penetration testing before launch, aligned to ISO 27001
TLS 1.3
AES-256
PDPL
RBAC
ISO 27001
Quality and testing technology
Quality and testing

Proven before launch, not assumed on the day

Testing is our responsibility, not the client's. It runs alongside the build, and every platform ships with the evidence to prove it.

  • Security testing and code review, with every finding fixed before approval
  • Load and stress tests for registration surges and event-day peaks
  • Integration tests across payment gateways, notification channels and APIs
  • Unit and functional tests on every main path, with a 70% coverage floor
  • User acceptance testing with your team, and restores proven by running them
Load testing
Code review
70%+ coverage
UAT