Live in regulated KSA enterprises
Speak up
safely.
Investigate
properly.
Raqeeb is OSIT's enterprise whistleblowing and case-management platform — anonymous by architecture, sovereign by default, and built for the audit that comes after.
0%
of fraud found via tips
0 days
to go live on SaaS
0%
KSA-resident data
CASE · LIVE
RQB-2609-7F3K
Anonymous · no name, no email, no account
Report received
09:12
Triaged · severity high
09:41
Investigator assigned
—
SLA clock running · 94% within target
ISO 37002◆
ISO 37001◆
PDPL · SDAIA◆
NCA ECC◆
NAZAHA-ready◆
NDMO classification◆
Why now
Shared inboxes and spreadsheets do not survive a regulator's visit.
01
Regulation has arrived
PDPL enforcement, NCA ECC controls, NAZAHA's anti-corruption drive and ISO 37002 turned formal speak-up channels from best practice into baseline expectation.
02
Boards are accountable
Audit committees now expect defensible intake, investigation and record-keeping — with an evidence trail that stands up to external scrutiny.
03
Trust decides usage
Employees and vendors only report when anonymity is credible. A purpose-built, independent platform is what makes it credible.
0%
of occupational fraud is uncovered by tips — more than any other detection method
0×
higher median fraud losses at organisations without a reporting hotline
0 mo
faster detection when a formal reporting channel is in place
Reporter trust
Anonymity that holds up.
The moment a report is submitted, identity is stripped at the edge and replaced with a case key. Investigators can ask questions for months — and never learn who filed.
Three reporting modes
Anonymous, confidential or identified — chosen per case, on every channel.
Sealed two-way messaging
Replies flow back with identity cryptographically sealed from the case team.
Zero-trace intake
No IP capture on anonymous reports. AES-256 at rest, TLS 1.2+ in transit.
Case-key follow-up
Track status with the key alone — no login, no phone number, no trace back.
File a report. Watch the key appear.
A working replica of the reporter's first 30 seconds — nothing you type here is stored.
Raise a concern
ANONYMOUS
Category
Your secure case key appears here the moment you submit.
Your case key
Save it. It is the only way back into your case — and the only thing linking you to it.
IP address discarded at the edge
Payload encrypted · AES-256
Queued for triage · SLA clock started
Case flow
Walk a case end to end.
Pick any stage, or press play and watch a live case move through all six.
Live case
CASE-202601-0001
Status
New — submitted
Elapsed
00:00:04
Reporter identity
Never revealed
01Submit
What happens
- Concern raised through any of six channels — portal, QR, email, hotline, WhatsApp or API
- Reporter chooses anonymous, confidential or identified, per case
- Attachments added; draft auto-saves so nothing is lost mid-way
Artefacts produced
Case record created
Case key issued
Encrypted attachment set
What Raqeeb does
- Strips IP and device metadata at the edge
- Encrypts payload with AES-256
- Generates the case key and returns it once
Who can see what
Nobody has seen the report yet. Identity was never captured.
02Acknowledge
What happens
- Acknowledgement returned on screen and, if opted in, by the channel used
- Reporter saves the case key — the only route back into the case
- Expectations set: what happens next and by when
Artefacts produced
Acknowledgement receipt
SLA baseline timestamp
What Raqeeb does
- Starts the SLA clock
- Notifies the intake queue
- Writes the first immutable audit entry
Who can see what
Intake officers see a new case. They see no reporter identity.
03Triage
What happens
- Case classified against your taxonomy and scored for severity
- Checked against open cases for duplicates and linked patterns
- Admissible cases routed; inadmissible ones closed with a recorded reason
Artefacts produced
Classification and severity
Routing decision
Recorded admissibility rationale
What Raqeeb does
- Applies RBAC so only the routed team gains access
- Auto-recuses anyone with a declared conflict of interest
- Escalates severity-critical cases immediately
Who can see what
Only the assigned team can open the case from here on.
04Investigate
What happens
- Evidence collected and uploaded; each file hashed on arrival
- Witnesses and interviews recorded in a structured register
- Follow-up questions sent to the reporter through sealed messaging
Artefacts produced
Evidence vault with hash manifest
Interview and witness register
Chronological case timeline
What Raqeeb does
- Maintains chain of custody for every artefact
- Routes reporter replies without exposing identity
- Flags SLA risk before the deadline is breached
Who can see what
Reporter can answer questions without ever being identified.
05Decide
What happens
- Investigator submits the dossier with findings and a recommendation
- Committee reviews, deliberates and records the outcome
- Sanctions and corrective actions assigned with owners and dates
Artefacts produced
Decision pack
Outcome record
Corrective action register
What Raqeeb does
- Assembles the decision pack automatically from the case file
- Logs every approval, abstention and dissent
- Enforces quorum and segregation of duties
Who can see what
Committee sees the evidence. It still does not see who reported.
06Close
What happens
- Outcome communicated to the reporter via the case key
- Corrective actions verified as implemented
- Case frozen and moved into retention
Artefacts produced
Closure record
Retention schedule entry
Board-reportable summary
What Raqeeb does
- Freezes the record — no further edits possible
- Starts the retention clock and legal-hold eligibility
- Feeds the case into trend analytics and board reporting
Who can see what
Record is immutable. Audit can replay every step, forever.
Every transition on every stage is written to an immutable, time-stamped audit log — the reporter's identity never enters it.
System architecture
One boundary decides everything.
Above it, nobody is authenticated and nothing identifying is kept. Below it, every action is attributed and audited. Anonymity is not a policy here — it is where the wire is cut.
The stack
Cross-cutting
RBAC & segregation of duties
Immutable, time-stamped audit
Conflict-of-interest recusal
Retention, legal hold & archive
Anonymous — no authentication
Authenticated case team
Idle · select a layer to inspect it
Click a layer · drag to orbit
Channel layer
Components · 6
What it guarantees
Visibility
From case queue to boardroom.
Role-based dashboards, drill-down analytics and regulator-ready exports in Arabic or English.
Cases by category
0
cases this period
0%
within SLA
0d
median time to close
0
open beyond target
Board & audit views
Operational, compliance and committee dashboards out of the box.
Immutable audit log
Every action, every actor, time-stamped — streamable to your SIEM.
Intake channels
Six ways in. One queue.
Web portal
Branded, bilingual, mobile-responsive — open 24/7 to staff and the public.
Mobile & QR
QR codes on posters, badges and shop-floor signage open the form instantly.
Email intake
Monitored addresses convert messages into structured cases automatically.
Hotline & IVR
Operator or IVR scripts log calls straight into the same case queue.
WhatsApp & SMS
Gateway options for frontline, field and non-desk workforces.
In person / proxy
Compliance officers file on a reporter's behalf with the same protections.
Compliance by design
Aligned with the frameworks that matter.
Standard
ISO 37002:2021
Whistleblowing management practices embedded in the workflow itself.
Standard
ISO 37001:2016
Anti-bribery case handling, records and management-review support.
Regulation — KSA
PDPL & SDAIA
Privacy by design — consent, minimisation, retention and subject rights.
Regulation — KSA
NCA ECC
Security controls mapped for government and critical-infrastructure sectors.
Regulation — KSA
NAZAHA-ready
Supports national anti-corruption reporting and cooperation obligations.
Governance
Records & retention
Configurable schedules, legal hold and audit-grade record-keeping.
One platform. Every disclosure.
Whistleblowing catches misconduct after it happens — these add-ons manage the risk before. Same platform, same immutable audit trail, same Arabic-first experience.
Add-on · Disclosure management
Conflict of Interest
Declarations, reviews and recusals — managed before they become cases.
- Annual and event-driven declaration campaigns for employees, vendors and board members
- Risk-scored review workflows with mitigation plans, owners and deadlines
- Declared interests automatically recuse investigators inside Raqeeb case management
- Living COI register with attestation tracking and committee-ready reports
- Bilingual forms, notifications and records — Arabic RTL and English throughout
Try it — declare an interest
Add-on · Anti-bribery controls
Gifts, Hospitality & Entertainment
Approvals and registers aligned with your anti-bribery policy.
- Declare gifts, hospitality and entertainment — given or received — in under a minute
- Policy engine: thresholds by role, counterparty type and cumulative annual value
- Pre-approval workflows with escalation to compliance for sensitive requests
- Government-official and vendor flags for ISO 37001 sensitivity
- Central register with analytics, exports and an immutable audit trail
Try it — check a gift against policy
Plugs into your digital workplace.
HRMS
Employee & org-unit sync
Employee Self-Service
"Raise a concern" inside your ESS portal
Single Sign-On
SAML 2.0 / OIDC for case teams
Email & SMS
Notifications via your gateways
Raqeeb
REST APIs & webhooks throughout
ANONYMOUS INTAKE STAYS OUTSIDE SSO
Vendor Portal
Suppliers report from their own login
GRC & ITSM
Hand off cases to ServiceNow or your GRC suite
Corporate Website
Public Speak-Up page or embeddable widget
SIEM
Stream audit events for continuous monitoring
Deployment
Your infrastructure or ours — always inside KSA.
On-premises / private cloud
Maximum control for government & regulated sectors
- Runs in your data centre — VMs or Kubernetes / OpenShift
- Your keys, your HSM, your security stack
- Air-gap friendly; works with internal IdP and SIEM
- Full white-labelling, source-escrow and ownership options
- Operated by your team — or managed by OSIT on-site
Raqeeb Cloud — SaaS
Fastest path to a live speak-up channel
- Dedicated single-tenant instance — isolated database, storage & keys
- Hosted exclusively on KSA-resident cloud regions
- OSIT-managed patching, backup, monitoring — 99.9% SLA target
- Annual subscription — unlimited reporters, named case users
- Live in about two weeks with standard configuration
Change your mind later. Migrate between SaaS and on-premises with cases, evidence, configuration and audit history fully preserved.
Data sovereignty
Your data never leaves the Kingdom.
Whistleblowing data is among the most sensitive information an organisation holds — identities, allegations, evidence. Raqeeb keeps all of it on Saudi soil, under Saudi law, governed by your policies.
KSA-resident hosting only
Your data centre or in-Kingdom cloud regions — no other option exists in the product.
No cross-border transfer
Sub-processors disclosed and KSA-resident. Nothing replicates outside.
Isolation & encryption
Single-tenant with dedicated keys — AES-256 at rest, TLS 1.2+ in transit.
Classified & aligned
PDPL / SDAIA, NDMO classification and NCA ECC mapping at platform level.
SCCC by STC
Google Cloud (Dammam)
STC Cloud
Oracle Cloud Riyadh
Huawei Cloud KSA
Alibaba Cloud Riyadh
Your data centre
All regions in-Kingdom
Time to value
Live in weeks, governed like a programme.
Raqeeb Cloud — SaaS fast-track
Standard configuration, training included
≈ 10 working days
01
Provision & brand
02
Configure taxonomy, roles & channels
03
Train & UAT
04
Go live + hypercare
Enterprise — on-premises / private cloud
SSO, integrations and security testing included
≈ 10 weeks
01
Deploy in UAT
02
SSO & integrations
03
Configure data model
04
UAT sign-off
05
VAPT & remediation
06
Production cutover
PMP-led delivery on every engagement: baselined plan, weekly reporting, RAID management, structured UAT and formal handover.
The partner
Why teams choose OSIT.
Proven in production
Raqeeb already runs at regulated KSA enterprises, including the financial sector — hardened by real UAT, VAPT and audits.
Built in Riyadh
Local product and delivery team — your time zone, your language, Arabic-first engineering.
One accountable partner
Product, implementation, training and support under one roof. No finger-pointing between vendors.
PMP-led governance
14+ years of enterprise delivery discipline behind every rollout — government, banking and beyond.
No lock-in
Open standards, full data export at any time, and source-escrow options for enterprise licences.
Part of a wider suite
Sits alongside OSIT's Taaleemo LMS, Masaar open-banking and Nateeq AI platforms.
We needed a channel our people would actually trust, and an evidence trail our auditors would accept. Raqeeb gave us both — inside our own data centre.
What evaluators ask first.
Raqeeb (Arabic: رقيب, "the watchful") is an enterprise whistleblowing system and case management platform from OSIT in Riyadh. It gives employees, vendors and stakeholders anonymous speak-up channels, and gives compliance teams structured investigation management with conflict-of-interest recusal and an immutable audit trail — deployed on-premises or on KSA-resident cloud, in Arabic and English.
Whistleblowing is the reporting of misconduct — fraud, corruption, harassment, safety or data violations — by employees, vendors or other insiders through a protected channel. Organisations use a whistleblowing system to receive these reports safely and anonymously, protect the whistleblower from retaliation, and meet governance obligations such as ISO 37002 — and in Saudi Arabia, NAZAHA anti-corruption and PDPL requirements. Most serious misconduct is uncovered by tips, which makes a trusted speak-up channel the most effective detection control an organisation can run.
A case management system turns each report into a structured, auditable case: intake and triage, severity classification, investigator assignment, evidence collection with chain of custody, sealed communication with the reporter, committee decisions and corrective actions — all against SLA timers and an immutable audit log. In Raqeeb, the whistleblowing channel and the case management workspace are one platform, so nothing is lost between the report and the outcome.
No. Anonymous reports carry no IP, no account and no device identifier. The case key is generated client-side of any identity store, and there is no administrative function — for you or for us — that resolves a key back to a person.
In your data centre, or on a KSA-resident cloud region you nominate — SCCC by STC, Google Cloud's Dammam region, Oracle Cloud Riyadh, Huawei Cloud KSA or Alibaba Cloud Riyadh. There is no cross-border replication anywhere in the product.
Declared interests auto-recuse investigators before assignment, and segregation of duties is enforced by role at every stage. Cases naming senior staff can be routed to an independent committee or an external investigator.
Yes — reporter portal, investigator workspace, committee views, notifications and exported reports all exist in full Arabic RTL and English. Try the language toggle in the header on this page.
Full structured export of cases, evidence, configuration and audit history at any time, in open formats. Enterprise licences can add source escrow.
Talk to us
Build your request.
Answer as much or as little as you like — the summary writes itself as you go, and you send it when it reads right.
Message received
Thank you — one of our team will reply within one working day.
Your reference
See Raqeeb in action.
A live walkthrough takes 45 minutes — from anonymous intake to the board dashboard.