Thiqat
Thiqat is a legal-tech platform connecting clients with license-verified lawyers: online booking and payment, private video sessions, full case management, and a laws library with an AI assistant. Built Arabic-first, with security at its core: two-factor authentication, fine-grained permissions and payment verification.
Thiqat (Arabic for “trusted ones”) is a full-stack legal-tech platform that connects clients with license-verified lawyers. It covers the entire client journey, from finding a lawyer to the final verdict: booking, online payment, remote sessions, and case tracking with hearings and documents. The platform was designed Arabic-first with a right-to-left interface, supports multiple languages, and runs as an installable web app (PWA).
The Idea
Many people struggle to find a lawyer they can trust, and then struggle to follow their case after hiring one. Thiqat solves both problems. No lawyer appears in the directory until the verification team has manually reviewed their license. Once a case is open, the client follows it step by step on a single page shared with their lawyer.
Key Features
Verified lawyer directory: search by country, city and practice area. Only clients who actually attended a session can leave a review, and every service has a clear price.
Booking and online payment: through HyperPay and Tap, supporting Mada, Visa, Mastercard and Apple Pay, plus bank transfer. Tax invoices are issued automatically.
Private session room: chat, file attachments and voice notes, with built-in voice and video calls. Only the two parties to the appointment can enter the room. Messages are kept in a legal archive sealed with a digital fingerprint.
Case management: a timeline of every event, hearings and postponements, documents organized in folders, and document requests sent to the client.
Laws and regulations library: with an AI assistant that answers based on the uploaded legal texts.
Lawyer tools: professional profile, weekly availability, a wallet with earnings payouts, and paid featured placement in the directory.
Admin dashboard: lawyer verification, payment and report monitoring, and fine-grained roles and permissions for every staff member.
Public API: with keys, permission scopes and rate limits, for integration with partner systems.
Security
Because the platform handles sensitive legal and financial data, the codebase (over 18,600 lines) went through a full security review. Every vulnerability it found was fixed, and the fixes were tested on a real server. Protections include:
Account protection: mandatory two-factor authentication for staff, session idle timeouts, and automatic sign-out of other devices when a password changes.
Permissions and payments: permissions that can’t be escalated, and every payment matched against the gateway before it is confirmed.
Page protection: against injection, forged requests and malicious scripts (CSRF and CSP).
Abuse protection: email verification, human verification (CAPTCHA) and rate limits.