Public sector systems
Government software works under different constraints. Officers get transferred. Budgets arrive at once and then stop. Data has to stay on servers the department controls. The people entering it are often in the field on a patchy connection. We have built for exactly these conditions: a road asset management system for the Government of Balochistan, and platforms for government agencies and national events in Singapore, where security and data-sovereignty rules are strict.
01In detail
What we deliver
Asset management systems
Inventories of roads, buildings and utilities, with condition data, maintenance history and the reports planners actually ask for.
Survey & field data platforms
Bringing survey data from consultants and field teams into one system, checked and searchable, instead of scattered spreadsheets and PDFs.
GIS dashboards
Map-first views so a secretary or chief engineer can see a district at a glance and drill down to a single record.
Citizen-facing portals
Applications, tracking and payments, built for low-end phones and slow connections.
Security reviews of existing portals
Audit and remediation of systems already in service, without disrupting the people who rely on them.
Training & documentation
Written for whoever inherits the system next year, not for the person who built it.
02Process
How it runs
We are registered with the Pakistan Software Export Board (Reg. No. Z-25-13026/25) and as a partnership firm in Pakistan. We bid as lead vendor, as a sub-contractor, or in a joint venture with an engineering or survey firm. The road asset management system for Balochistan was a joint venture.
Requirements
Per tender
We read the terms of reference closely, ask the questions they do not answer, and propose phases that line up with how funds are released.
Build in phases
Milestone-based
Each phase ends with something the department can use and sign off. No single go-live at the end of the financial year.
Deploy on your terms
On-premise or cloud
On government servers, local data centres or a cloud provider, whichever your policy allows.
Train & support
Agreed in contract
Training sessions for staff, an admin manual, and support terms written down before launch.
03Deliverables
What you get
- Role-based access with a full audit trail
- Exports in the formats departments already use (Excel, PDF, shapefiles where relevant)
- Hosting on infrastructure the department controls, if required
- User and administrator manuals
Security checks
Six security checks before every launch.
Before anything goes live, we test it the way an attacker would, then write down what we found and how we fixed it. The same six checks run on every project, from a one-page website to a government portal.
- 01
Scan for known weaknesses
We check your code, the libraries it uses and the server for weaknesses attackers already know how to exploit.
OWASP Top 10 · CVE database
- 02
Try to break in
Our engineers attack it the way a real attacker would: logins, permissions, file uploads, pages that should be hidden.
OWASP ASVS
- 03
Check every public link
Every public page and address is crawled for files, folders and test pages that should never have been online.
OWASP Top 10
- 04
Look for malware
The code, the server and anything users can upload are checked for malware and hidden backdoors.
Before every launch
- 05
Try to trick the AI
For AI agents, we try to make them leak data, ignore their instructions or use access they should not have.
OWASP Top 10 for LLM Applications
- 06
Write it all down
Every finding, how we fixed it and the re-test that proves it, in a report your auditors can read.
ISO/IEC 27001-aligned process
Our process follows ISO/IEC 27001 controls. Prospiral is not ISO certified. VAPT means vulnerability assessment and penetration testing: the first two checks above.
05Questions
Questions we get asked
Yes. A lot of public sector technology work sits inside larger engineering or survey contracts, and we are used to working that way.
Yes. We document the server requirements up front and can help your IT staff set them up.
Yes, in person or online. We also write manuals that people can follow without us in the room.
Start a conversation
Tell us what’s broken.Or what you want built.
Send a few lines about the system or the idea. One of the engineers who would actually do the work will reply, usually within a working day.