Yahaji.ai is not only a companion for the pilgrim. The same record powers a scoped oversight stack — from custodial authorities in the Kingdom, down through national agencies such as NAHCON, their licensed operators, applicants who are not yet licensed, and the providers who fulfil the work.
Each tier sees exactly what its mandate requires — and nothing beneath it that it has no right to.
Aggregate arrival, dispersal and compliance posture across every sending country — no personal data, only cohort-level counts, geofence density and incident response times.
Registered pilgrims by state, onboarding through rites to return, medical and SOS alerting, operator performance, quota utilisation and settlement of licensed operators.
Roster, groups, packages, devices, departures, live location and health of their pilgrims — plus payouts, disputes and the documents the agency will audit.
Agencies not yet licensed can still run Yahaji as their operating system for ʿUmrah, Ziyārah and pre-registration — then submit a verifiable track record when they apply for a Ḥajj licence.
Hotels, transport, catering, medical, visa handlers and eSIM partners receive scoped jobs, confirm fulfilment and invoice — never seeing the pilgrim's wider record.
The institutional portals share one design language with the pilgrim app — cream, ink and gold — so a minister and a group leader read the same numbers the same way.
Live event stream, SOS and fall detection, map of every tracked pilgrim, health and battery posture, integration status.
Device fleet, geofence zones (Ḥaram, Minā, ʿArafāt, Muzdalifah, hotels), distribution by area, per-pilgrim drilldown.
Pipelines per sending country, departed / in-transit / arrived, on-time and medical compliance, daily departure volumes.
Rosters, mahram links, mobility and medical needs, group leaders, meet-points and headcounts.
Multi-currency ledger, operator settlements, pending disbursements, disputes and refunds.
Ritual guidance, site atlas and duʿā library versioning, plus broadcast alerts scoped by tier.
A pilgrim is not a data point. Higher tiers get the aggregates they are accountable for; individual records open only with a role, a reason and an audit entry.
Tenant isolation
Every row is owned by an organisation. Nothing crosses a tenant boundary unless a tier above it is explicitly entitled to a rollup.
Role-based access
Platform admin, gov admin, operator admin, group leader, medic, field agent, provider — each with its own routes and its own audit trail.
Rollups, not raw records
Higher tiers see aggregates by default. Drilling into an individual pilgrim is a logged, reason-coded action.
Audit log everywhere
Who looked, who changed, who exported. Regulators get their own read-only view of it.
One pilgrim record
The same identity the pilgrim uses in the app is the one the operator, agency and authority see — no reconciliation spreadsheets.
Data residency & consent
Health and location telemetry is consented, purpose-bound and expires after the season closes.
Agencies, licensed operators, applicants and providers — we scope a tenant, load your roster and give your team the portal that matches its mandate.
