Libya is going digital. We make it hold.
Aswaq Libya designs, integrates and secures the core systems of banks, ministries and energy operators, with in-country ownership, engineering discipline to international standards, and AI that stays under control.
Security-first architecture
Threat model before scope. Identity, access and controls designed before a line of code.
Evidence on every action
Audit trails, decision logs and tested restores your regulator can read, not a PDF nobody opens.
AI under supervision
Automation with a named owner, a log and a defined limit. Digitalization first, AI second.
Local ownership in Misrata, engineering discipline to international standards, one accountable team
Aswaq Libya أسواق ليبيا · Misrata, Libya
The single accountable partner for your program: stakeholder alignment, regulatory dialogue, Arabic-first delivery, on-site implementation and long-term operations. The team that stays after go-live.
Engineering bench Secure architecture · DevSecOps · Applied AI
A compact expert team for banking, regulated and institutional modernization: secure architecture, DevSecOps, penetration-testing readiness and controlled AI automation, delivered to European standards of engineering discipline.
Modern architecture around the core you already run: secure integration layer, identity and access model, and a migration path that never takes the business offline.
Security posture review, a penetration-testing program with owned and retested fixes, and backup and DR readiness proven by timed restores with agreed RTO/RPO.
Audit logs designed as a business requirement, CI/CD gates, secrets control and release records. Operations and approvals that can be shown, not asserted.
Document intelligence in Arabic and English, operational monitoring, voice workflows and reporting support, built as a supervised layer with a named human owner.
Backup policy per application, database and file store. Encrypted storage, restore tests with dated results and Misrata–Benghazi failover rehearsed, not described.
Scope, cadence, remediation ownership and retesting logic, with findings connected to release governance and executive reporting.
Control first, AI last
Risk review
before architecture
Every phase closes
with an artefact
Restores tested,
RTO/RPO signed
Data stays
in Libya
Your team runs it:
capacity transfer
AI as a supervised
layer, never above
Standards we align to
- 1
- 2
- 3
- 4
Banking and finance
Payment volume outran the control layer. First ninety days: privileged-access and approval-path baseline on core banking and the payment switch, audit logging live on money and access, and a verified restore of the core database with RTO/RPO your board can sign.
- Regulator: Central Bank of Libya
- Evidence at day 90: Access review · restore report · runbook
Government and public sector
Registries and citizen services are going online faster than records governance. First ninety days: registry data and integration map with ownership, one approval workflow digitalized with a full audit trail, and the primary registry backed up and restore-tested.
- Regulator: NISSA · line ministry
- Evidence at day 90: Decision log · retention policy · restore report
Oil, gas and energy
OT and IT are converging, and contractors are on both sides of the line. First ninety days: OT/IT boundary and contractor access model with expiry, monitoring and alerting on critical interfaces, and a continuity plan across sites that has actually been rehearsed.
- Context: Multi-site · limited connectivity
- Evidence at day 90: Access model · alert chain · failover record
Telecom
Release velocity, subscriber data and fraud, all at once. First ninety days: integration and data-flow map across BSS/OSS, CI/CD gates with release records an auditor can read, and fraud-signal monitoring wired to a named team.
- Context: Weekly releases · subscriber data
- Evidence at day 90: Release records · access reviews · triage chain
Every important action leaves evidence
core-banking-svc · PAY-TRX/48213
s.alfitouri@ops · ROLE/treasury-approver
dr-orchestrator · BKP/oracle-fin-01 · RTO 42m
release-gate · REL/2.14.3 · pentest open
ai-classifier v3.2 · DOC/kyc-11908
m.benali@admin · USER/ext-contractor-07
siem-monitor · SESSION/admin-console
workflow-engine · REQ/procurement-3391
backup-agent · FS/registry-archive · retain 7y
a.zarrouk@audit · LOG/export-q3
ci-pipeline · SECRET/db-prod
ai-monitor v1.8 · LINE/branch-benghazi-2
siem-monitor · SESSION/admin-console
workflow-engine · REQ/procurement-3391
backup-agent · FS/registry-archive · retain 7y
a.zarrouk@audit · LOG/export-q3
ci-pipeline · SECRET/db-prod
ai-monitor v1.8 · LINE/branch-benghazi-2
core-banking-svc · PAY-TRX/48213
s.alfitouri@ops · ROLE/treasury-approver
dr-orchestrator · BKP/oracle-fin-01 · RTO 42m
release-gate · REL/2.14.3 · pentest open
ai-classifier v3.2 · DOC/kyc-11908
m.benali@admin · USER/ext-contractor-07
Built for institutions that cannot afford surprises
Banking and finance
Government and public sector
Oil, gas and energy
Telecom
Ports, logistics and trade
Health and insurance
Central bank and regulators
The load is already here
+00%
E-payment transaction value in 2025 vs 2024 (LYD 389 bn)
00k
POS terminals in the field, +15k since 2025. Did the controls keep up?
Request the 3-week Security and Readiness Review
Fixed scope, fixed fee. The findings are yours whether or not we continue together.