Launch, expand and close deals without the compliance wait. Thiqa's agent keeps MENA licences and global frameworks in check, daily.
Early access · work email only
Evidence
What proves each control, and how far each one is from collecting itself.
112
Satisfied and current
11
Failing collection
23
Expiring within 30 days
22
Never collected
68 of 168 collect themselves
A hundred need a person every cycle. Twenty-two of those could stop needing one today — you already run on AWS.
Thiqa's agent runs internal audits 20x faster than manual Excel work, with fewer errors. Built with human approvals and full data confidentiality, safe by design.
Your Problems Solved
Collect evidence once, reuse controls everywhere and track every licence and framework in one place. Thiqa makes each new one fast to reach and easy to keep.
Radar
Compliance Posture
83%
74/89 controls compliant across active frameworks
Central Bank of Egypt
Inspect
100
PCI DSS
Inspect
100
ISO 27001
Inspect
63
AI ingestion
Add framework
Overview
Controls
89/89 controls fulfilled
100
Policies
89/89 policies published
100
Documents
54/86 documents up to date
63
Evidence Collected
54/86 documents up to date
63
Risk Exposure
Medium
1
2
3
4
5
6
7
8
9
10
Negligible
Low
Medium
High
Critical
Vendor Risk
Medium
1
2
3
4
5
6
7
8
9
10
Negligible
Low
Medium
High
Critical
Gaps
3 block
15
down 4 this week
Aug
now
Closed this week
4
Opened this week
1
Open the queue
Critical Actions
All
8
Evidence
4
Documents
2
Policies
2
Provide evidence for regulatory & breach reporting
A documented process shall identify and maintain all compliance-lapse, cybersecurity-incident and data-breach reporting duties, including responsible authorities and required timeline.
THQ-05
Governance
CBE · 1 ref
ISO 27001 · 1 ref
High
Provide evidence for asset inventory & ownership
A documented asset-management process shall identify and maintain an inventory of information and associated assets with owners, location, description and lifecycle status.
THQ-11
Risk & Asset Management
CBE · 1 ref
ISO 27001 · 1 ref
High
The highest data granularity in the market to actually get the job done.
Our modular approach allows you to combine or switch between entities, jurisdictions & frameworks and the whole product changes with you
Thiqa
Scope
Egypt ▾
Obligations
Controls
Evidence
Risk
Scope
Everything on every screen is filtered by this.
Entities
All entities
10
Egypt
3
United Arab Emirates
4
Saudi Arabia
2
European Union
3
Frameworks
3 selected
CBE Governance
Egypt
SAMA CSF
Saudi Arabia
DIFC DP Law
UAE
PCI DSS v4.0
all
ISO 27001:2022
all
GDPR
EU
SOC 2 Type II
all
Egypt · CBE Governance, PCI DSS, ISO 27001
Apply scope
The agent collects it, checks it against the obligation and files it.
Encryption at rest
AWS · APIAutomatedCloud infrastructure · Cryptography
12 of 12 databases encrypted
Collected 29 Aug 2026 · next 28 Sept
Discovered databases
prod-db-1
eu-west-1
AES-256 · KMS
prod-db-2
me-south-1
AES-256 · KMS
prod-db-3
eu-west-1
AES-256 · KMS
prod-db-4
me-south-1
AES-256 · KMS
prod-db-5
eu-central-1
AES-256 · KMS
Control state is derived from evidence. There is no status dropdown.
Controls
89/89 controls fulfilled
100
Policies
89/89 policies published
100
Documents
54/86 documents up to date
63
Evidence collected
54/86 evidence current
63
The agent drafts every policy and maps each block to a requirement as it writes. You edit, it answers.
Policies
/
POL-004
Incident Management & Response
Thiqa is writing
Writing section 4 of 6 · Regulatory notification
Reading CBE Article 5 and the two controls that already exist.
SECTION 4.0
Editing
Regulatory notification
Applies to every incident classified severity 1 or 2 under section 3.0.
Where an incident affects customer funds, cardholder data or the availability of a payment service, [Group] shall notify the Central Bank of Egypt within 24 hours of confirming the incident.
Answers CBE Art 5
The notification shall state the time of confirmation, the systems affected, the containment steps taken and the named incident manager.
Answers CBE Art 5.1
Collected automatically from where they already live, versioned and tied to the obligation they answer.
Documents
Auto-collectedDOC-001: Company details
GRC · Governance · synced 2 min ago
Collected
DOC-003: Locations in scope
GRC · Scoping · synced 2 min ago
Collected
DOC-006: PCI Req 3.4 PAN access list
IT · Access control · collecting…
Collecting
Likelihood × impact, with AI-drafted treatments. Residual risk is derived, never guessed.
Likelihood
5
4
3
2
1
Insignificant
Minor
Moderate
Major
Severe
Inherent
After treatment
Every framework you answer to, mapped once.
ISO/IEC 27001:2022
ActiveInformation security management · 121 controls
Overview
Controls121Updates4Readiness
34 of 121 controls met
28% complete
Vendor assurance from onboarding to review.
Vendor Risk
Medium
1
2
3
4
5
6
7
8
9
10
Negligible
Medium
Critical
Integrate the tools you already use to collect evidence automatically, or run the Thiqa Collector if you're on-premise.
Say yes when your first big customer asks for proof. Thiqa maps what your licence requires and does the groundwork before compliance slows you down.
Take on more audits without taking on more cost. Thiqa reuses the evidence you’ve already collected, so every new audit and market starts ahead.
Run dozens of frameworks without rebuilding them every year. Thiqa keeps each entity’s requirements apart and every control backed by real evidence, so growth never waits on a spreadsheet.
Thiqa is a compliance agent platform and AI native service accelerating MENA licenses and global frameworks compliance. It works out what applies to you, collects the evidence, drafts your policies and tracks your risks, while your team approves every step.
Both. Use the software yourself, have our team run compliance for you, or mix the two. Every option is available.
We build custom collection scripts for your environment and yours alone, and they stay inside it. For cloud tools, Thiqa connects directly to the systems you already use.
No. Your data is never used to train any model, your data remains anonymized to ensure confidentiality.
Every output traces back to the requirement, document or evidence it came from, so you can check it in seconds. Nothing is final until someone on your team approves it; so you’re able to review the whole process.
The agent drafts each policy from your requirements and how your organisation actually works, and links every section to what it satisfies unique to you without rehashing templates. Your team edits and approves before anything is published.
Yes, we’re auditor agnostic so your auditor still certifies you and issues the report. Thiqa gives them organised access to every requirement, control and piece of evidence, so the audit moves faster.
You see your requirements mapped in your first session. Connecting systems and collecting evidence follows at the pace your team is comfortable with.
