Skip to content
Why Lazuli

Built here. Held to a global standard.

Lazuli is engineered in Kabul by the same team that supports it — no resellers, no offshore escalation, no language barrier.

The system that
actually fits.

Generic and imported platforms are adapted to the region at best. Lazuli is engineered for it — the workflows, the regulations, the languages, and the networks you really run on.

120+
institutions across healthcare, education & enterprise trust Lazuli
Built for local workflows & regulation

Mapped to how institutions here actually operate. Generic software: localized at best.

Fast on low-bandwidth networks

Engineered to stay responsive on Slow 4G and low-end devices. Imported tools assume broadband.

Local engineering & on-site support

An engineering team in Kabul, on your time zone. Generic vendors: remote & time-shifted.

Dari & Pashto, full right-to-left

Multilingual and RTL by construction, not bolted on. Most imports: English-only.

You own your data & integrations

Self-hosted where you choose, with open integrations. Generic SaaS: partial & locked-in.

Trust & compliance

Security & data residency

Enterprise-grade security controls without the enterprise price tag — designed for the realities of Afghan healthcare and education.

Data residency in Afghanistan

All data is stored on Afghan infrastructure. No cross-border transfer by default — compliant with local regulatory requirements.

Encryption in transit & at rest

TLS 1.3 for every API call; AES-256 encryption at the database layer. Keys are rotated on a defined schedule.

Role-based access control

Granular permission sets per department and function. Principle of least privilege enforced across all modules.

Immutable audit logging

Every data write, login, and permission change is timestamped and tamper-resistant — giving you a full chain of custody.

Automated backups

Daily encrypted snapshots with point-in-time recovery. Backup integrity is verified automatically before every restore window.

Rate-limited, validated APIs

All endpoints enforce rate limits, strict input validation, and JWT-authenticated sessions — blocking the most common attack vectors by default.

Open stack, no lock-in

Technology

We build on proven, widely-understood open-source tools. No proprietary runtime, no single-vendor dependency.

SvelteKit

Server-rendered frontend with island hydration — delivering sub-second page loads on constrained Afghan networks.

Laravel

Battle-tested PHP framework powering the API layer — predictable, well-documented, and trivial to hire for locally.

PostgreSQL

Relational integrity for clinical and financial records, with full-text search and JSON columns where flexibility is warranted.

Redis

Sub-millisecond caching and real-time queue processing for notifications, background jobs, and live dashboard data.

Docker & Cloudflare

Containerised deployments with edge-cached static assets — consistent environments from development through to production.

Voices from the field

What our clients say

Unedited quotes from the administrators, clinicians, and finance teams using Lazuli every day.

Healthcare

We evaluated three systems. Lazuli was the only team that actually understood how an Afghan university operates — the language requirements, the fee structures, the way exams work here. Athena covers everything from admissions to payroll in one platform.

KH
Khalid Habib
Chancellor · Mili University
Education

Before Telos ERP, our accountant was spending two weeks closing the month. Now it takes two days and the numbers are accurate.

S
Suliman
Owner · Zahor Elham
Security FAQ

Security questions, answered

The questions every IT manager asks before signing. Answered plainly, without marketing language.

Data is stored on your own servers or a private server we manage on your behalf — it is never stored on shared cloud infrastructure without your consent. Access is controlled by role-based permissions. All API communication is encrypted over HTTPS. We conduct regular security reviews and provide patch updates.
You do. Because the software runs on your infrastructure, your data is entirely under your control. Lazuli has no access to production data without explicit permission from your authorised administrators.
When data leaves your premises for backup or sync, it is encrypted on your device first with a key only you hold — we store ciphertext we cannot read, even if compelled. The standalone database is fully encrypted with AES-256, and traffic is protected with TLS 1.3. A one-time recovery key lets you regain access if you forget your password; without your password and recovery key, no one — not even us — can recover your data. That is deliberate.
Copula uses a hybrid RSA + AES-256-CBC encryption scheme for API traffic, bcrypt password hashing, Sanctum-based API tokens with expiry, and database-level isolation of sensitive modules (HR, Finance, Health). Every endpoint requires authenticated users with explicit permissions at 5 levels: Create, Read, Update, Delete, Approve.
Every create, update, and delete is recorded in an append-only, hash-chained audit log that makes tampering detectable, and a daily integrity job verifies the chain end-to-end. Regulated records — Certificates of Analysis, controlled-substance movements, and recalls — get their own tamper-evident trails and produce signed, timestamped, regulator-ready exports on demand. Regulated data stays on your premises by default, and document numbering is sequential and gap-free by design.
Wherever you need it to. We build models that can run entirely on your own servers, inside your own network, so your patient records, student data, or commercial information never have to leave your control. When a project genuinely benefits from external infrastructure, we tell you exactly what would leave the building and why, and you decide. Data sovereignty is a design choice we make with you, not a default we impose.
Yes. We design for auditability from the start, so every consequential decision can be traced: what data went in, which model version ran, and why it produced the output it did. For anything that affects a patient, a student, or money, we keep a human in the loop with the authority to override the system, and we favour models you can interrogate over opaque ones where the stakes demand it. An AI you cannot explain is an AI you cannot defend to a regulator, and we build accordingly.
Work with us

Ready to see Lazuli in action?

Book a 30-minute consultation with our engineers — we'll review your requirements and send a tailored proposal within five business days.

Chat on WhatsApp