PERMISERV LIMITED

Garden waste permit printing and permit management software

We provide Garden Waste Permit Printing and Permit Management Software for local authorities, taking on the administrative burden so councils can deliver efficient and reliable garden waste collection services to residents. All permits are printed at our factory in London and passed securely to Royal Mail for delivery.

Features

• Secure, browser-based access with role-based user permissions
• Responsive web interface supporting desktop, tablet, and mobile devices
• Customisable data import facility using spreadsheets or API integration
• Real-time search and status tracking of permit service requests
• Automated permit fulfilment workflow with dispatch date tracking
• Built-in reporting and analytics with configurable, exportable outputs
• CSV data export for operational and historical reporting purposes
• Email and ticket-based support with incident tracking and reporting

Benefits

• Reduces administrative effort for councils managing garden waste permits
• Improves operational efficiency through streamlined permit fulfilment processes
• Enables faster, more reliable permit dispatch to residents
• Provides clear visibility of permit status and service performance
• Reduces resident enquiries through improved tracking and transparency
• Supports consistent service delivery across multiple council teams
• Integrates easily with existing waste management systems
• Scales to support councils of different sizes without added complexity
• Simplifies reporting and data extraction for audit and planning
• Minimises IT overhead through a fully managed cloud-based service

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at mail@permiserv.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

121502338102593

Contact

John Bayley
020 75829579
mail@permiserv.com

About the service

• Service categories:
  • Applications
    • Production and operations
      • Service industry and public sector operations
        • Other
      • Other operations
        • Other operations
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
• Service constraints: We have no known user constraints.
• System requirements:
  • Standard, modern web browser with JavaScript enabled
  • Secure internet connection supporting HTTPS access
  • User account with valid authentication credentials

User support

• Email or online ticketing support: Yes
• Support response times: Yes, the service includes email and online ticketing support at no additional cost. Users can raise support requests during standard business hours through these channels. We target an initial response within one working day, with the majority of enquiries (approximately 95%) responded to within four working hours. Support response times apply during weekdays, excluding public holidays. Weekend support is not provided as standard, but urgent issues can be logged and will be addressed on the next working day in line with agreed support arrangements.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes
• Support levels: The service provides structured support levels to meet council operational needs. Standard support is included within the contract price and provides access to email and online ticketing support during normal business hours, covering general queries, operational guidance, and issue resolution. Each council is also allocated a dedicated Account Manager who acts as the primary point of contact and provides service oversight, coordination, and user support.; ; Onsite support can be provided where required, for example to support onboarding, process changes, or specific operational requirements. Onsite support is delivered by experienced service personnel with detailed knowledge of the system and council workflows. Where onsite support is requested outside of standard onboarding activities, this is provided at an additional cost, which is agreed in advance with the council.; ; The service does not require a dedicated cloud support engineer for day-to-day use. Technical issues are managed by the supplier’s technical team, coordinated through the Account Manager, ensuring councils receive appropriate technical support without the need for specialist in-house resources.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: At the start of the contract, each council is allocated a dedicated Account Manager who supports onboarding and early use of the service. The Account Manager provides user training covering system access, permit processing, reporting, and day-to-day operation. Training is typically delivered online to allow flexibility and quick access for users, but on-site training can be provided where required by the council. Standard operating procedures and user guidance are documented and made available for reference. Additional training sessions can be provided as needed to support new users, refresher training, or changes to processes, ensuring councils can use the service effectively from the outset and throughout the contract.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • ODF
  • PDF
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Onboarding and offboarding documentation is made easily accessible to council users through multiple formats and channels. The supplier supports councils in a hands-on manner, using video meetings to guide users through onboarding and offboarding activities and to explain relevant processes. Supporting documentation is provided digitally and is available as downloadable PDF files and HTML pages, either issued directly or accessed through the secure web portal. This ensures users can refer to clear, up-to-date guidance at any time. Documentation is structured to support both operational use and transition activities, including service setup, ongoing use, and data handover or exit.
• End-of-contract data extraction: At the end of the contract, councils can extract their data using built-in reporting and export tools that are available throughout the contract term. These allow councils to create custom reports and extract their data at any time in standard formats for local retention or analysis. Following contract end, data is retained by default for 18 months to support a full garden waste service cycle plus an additional reference period. After this period, data is either securely deleted from the central SQL database or, where agreed, encrypted and returned to the council as the Data Controller. Data handling and deletion are carried out in accordance with agreed data protection requirements.
• End-of-contract process: At the end of the contract, PermiServ works with the council to support an orderly and controlled transition. The service is typically left accessible for an agreed short period following contract expiry to allow the council to complete reference activities, reporting, or transition to a replacement solution, where required. During this period, councils continue to have access to reporting and data extraction tools.; ; All standard end-of-contract activities are included within the contract price, and there are no additional charges for offboarding, data extraction, or data handling. Following the agreed retention period, data is either securely deleted from the central system or, where requested, encrypted and returned to the council as Data Controller. All end-of-contract activities are carried out in line with agreed data protection requirements and documented exit procedures.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Yes, the service has been designed to work on mobile devices. The platform uses responsive design technology to ensure it adapts to different screen sizes and devices, including smartphones and tablets. There are no significant functional differences between the mobile and desktop versions of the service. Users can access the same features, data, and reporting capabilities across devices, allowing consistent use whether accessing the service in the office or on the move.
• Service interface: Yes
• Description of service interface: The service provides a secure, user-authenticated web interface. Users access the service through standard web browsers using role-based authentication controls. The web interface provides full access to the software’s functionality, allowing authorised users to manage permits, view and update records, run reports, and monitor service activity. Access levels are configured to ensure users can only perform actions appropriate to their role, supporting secure and controlled use of the permit management system.
• Accessibility standards: None or don’t know
• Description of accessibility: The service is accessed through a browser-based interface designed for clarity and ease of use. Users can upload spreadsheets, create and manage service requests, search records, run reports, and monitor operational queues through consistent screen layouts and standard web interactions.
• Accessibility testing: Formal testing with users of assistive technology has not yet been completed. Accessibility considerations have been incorporated into the service design through the use of standard web technologies, consistent layouts and clear navigation structures intended to support a wide range of users. The service is browser-based and does not rely on specialist plugins or proprietary software, supporting compatibility with common assistive tools such as screen readers and browser accessibility features.; ; We are actively working towards improved accessibility and alignment with WCAG 2.1 standards. Accessibility improvements are reviewed as part of ongoing service development, and feedback from council users is considered when prioritising enhance the team works collaboratively to understand these needs and, where feasible, implement reasonable adjustments within the service interface or supporting processes.
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: Users can interact with the service through a RESTful API to integrate permit management activities into their existing systems and workflows. The API supports secure authentication using OAuth 2.0, API keys, and/or IP whitelisting, allowing buyers to select an approach that aligns with their internal security policies.; ; Through the API, users can create service requests for permits processing and fulfilment. Once submitted, users can read, search, and retrieve service requests to track status, confirm processing, and reconcile records with internal systems.; ; Users can make changes through the API by submitting updated service requests where permitted, for example to correct or amend information prior to processing. The API also supports querying historical requests to support reporting and audit requirements.; ; The API is intentionally limited to core create and read/search functionality. Configuration changes, user management, pricing changes, and system-level settings are managed through agreed operational processes rather than the API, ensuring service integrity, data consistency, and controlled change management.
• API documentation: Yes
• API documentation formats:
  • HTML
  • ODF
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Users can customise the service to meet individual council requirements. Customisable elements include additional management reports, data structures, and the data import facility, which can be tailored to align with each council’s systems and processes. Customisation is typically agreed during onboarding or as part of ongoing service delivery and is implemented by authorised supplier staff at no additional cost. Councils work directly with the supplier to define reporting formats, data fields, and import rules to ensure accuracy and usability. Access to customised reports and data imports is then available to council-nominated users through the standard service interface and integrations.

Scaling

• Independence of resources: The service is designed to ensure user performance is not adversely affected by demand from other users. Resource usage is actively monitored by the development team, with a defined trigger point at approximately 60% utilisation. When this threshold is reached, additional or larger server instances are deployed using IaaS. The platform is capacity-planned to support significantly more councils than currently onboarded.

Analytics

• Service usage metrics: Yes
• Metrics types: The service provides both standard and configurable service usage metrics. Users can create custom reports to capture nuanced data points to support bespoke reporting requirements. Standard metrics include the number of permits dispatched per month, replacement permit rates, and historical trends over defined periods. These metrics support operational monitoring, performance review, and service planning by councils throughout the contract term.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest: Physical access control, complying with another standard
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Users export their data using a built-in data export facility within the service. Authorised users with appropriate privileges can define search criteria to filter records and select export options. The resulting data is generated on demand and downloaded directly to the user’s browser in CSV format. This allows councils to extract operational and historical data for reporting, reconciliation, or local retention at any point during the contract term.
• Data export formats: CSV
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • XML
  • XLS
  • XLSX

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The service is provided with a guaranteed availability level of 99.9%, measured on a monthly basis. Availability is defined as the ability for authorised users to access the core service through the web interface and perform standard operational activities. Planned maintenance is scheduled outside of normal working hours wherever possible and is excluded from availability calculations where advance notice is provided.; ; Service availability is monitored continuously, and any unplanned service interruptions are logged and investigated by the supplier’s technical team. Where availability falls below the guaranteed level in a given month, the supplier will work with the council to review the cause and agree appropriate service credits or remedial actions in line with the contract terms. Refunds or service credits are applied proportionately based on the level and duration of the service impact.; ; Availability performance is reviewed as part of ongoing service management, with trends monitored to support continuous improvement and to minimise the risk of recurrence.
• Approach to resilience: The service is designed with resilience built into both the application and hosting layers. The platform is hosted using Infrastructure as a Service (IaaS), allowing computing resources to be scaled, replaced, or redeployed quickly in response to failures or increased demand. System health and resource utilisation are continuously monitored, with automated and manual processes in place to support rapid recovery.; ; In the event of a significant infrastructure issue, replacement server instances can be provisioned and made operational within approximately 30 minutes, minimising disruption to users. Data is stored centrally and protected through regular backups to support service restoration where required.; ; The underlying datacentre environment is managed by the IaaS provider and benefits from resilient power, networking, and physical security controls. Detailed information on datacentre resilience, backup arrangements, and recovery processes can be made available to councils on request. The service design aligns with the government’s cloud security principle of asset protection and resilience by reducing single points of failure and supporting timely service recovery.
• Outage reporting: In the event of a service outage, affected councils are notified promptly via email. Notifications are sent to named customer users and provide clear information on the nature of the issue, the services impacted, and the actions being taken to restore normal operation. As the incident is investigated and resolved, regular update emails are issued to keep users informed of progress and expected resolution times where available.; ; The service does not currently provide a public status dashboard or an outage reporting API. Following resolution, incidents are reviewed internally to identify root causes and any required preventative actions, supporting continuous improvement and minimising the risk of recurrence.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Username or password
  • Other
• Other user authentication: Users are authenticated using unique usernames and passwords, with multi-factor authentication available to provide additional security. Two-factor authentication can be enabled using common authenticator applications, including Google and Microsoft. The service also supports single sign-on through identity federation with Azure Active Directory and Google, allowing councils to integrate authentication with existing identity providers. Authentication controls are role-based and ensure only authorised users can access the service and perform permitted actions.
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is restricted to authorised personnel only. Management interfaces are protected using IP address restrictions and require authenticated access using individual usernames and passwords, with two-factor authentication enabled. Access rights are granted on a role-based basis and reviewed periodically to ensure they remain appropriate. Support channels are similarly restricted to authorised users, ensuring that sensitive information and administrative functions are protected from unauthorised access.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We operate a formal information security management framework aligned to ISO/IEC 27001, which provides the structure for developing, maintaining, and enforcing information security policies and processes across the business. Policies cover areas including access control, data protection, incident management, risk assessment, and business continuity.; ; Responsibility for information security is defined within our organisational reporting structure, with senior management oversight to ensure policies are implemented and reviewed regularly. Compliance with policies is supported through documented procedures, staff training, and role-based access controls. Adherence to information security requirements is monitored through internal reviews and audits, with corrective actions implemented where required. This approach ensures information security controls are consistently applied and maintained throughout service delivery.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Configuration and change management processes are in place to control updates to the service throughout its lifecycle. Hardware components and underlying infrastructure are managed by the Infrastructure as a Service (IaaS) provider, while PermiServ maintains responsibility for application configuration, software updates, and security patching. Service components and configuration items are tracked to ensure changes are documented and traceable over time. Proposed changes are assessed prior to implementation to identify any potential security or service impacts, with testing carried out where appropriate. Security updates are applied in a controlled manner to minimise risk and service disruption, supporting stable and secure operation.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: A secure development policy is followed to ensure security is maintained when developing new features or updating the service. Server updates are automatically installed where available, and regular maintenance updates are performed to keep all software up to date. Potential threats are assessed using a third-party vulnerability scanning tool, alongside monitoring the CVE database for newly identified vulnerabilities affecting server software. Patches are deployed as soon as they become available. Where a patch is not immediately available, appropriate mitigating controls are implemented to reduce the risk of exploitation.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Protective monitoring is carried out using in-house tools to monitor system access and network traffic for indicators of suspicious or unauthorised activity. Potential compromises are identified through alerts and manual review, then verified by the technical team. Where a potential security incident is confirmed, the data breach policy is followed to record what occurred, actions taken, and any parties notified. Response times are risk-based and proportionate to the severity of the incident, with the security team available to investigate and respond as soon as a potential compromise is identified.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: Premiserv operates defined incident management processes to support consistent and timely handling of service issues. Common incident types have pre-defined response procedures to support efficient investigation and resolution. Users report incidents through email or the online support ticketing system, which are monitored during standard business hours. Incidents are logged, prioritised, and tracked by the support team, with progress updates provided to affected users as appropriate. Where required, incident reports are issued to councils summarising the issue, actions taken, and any preventative measures identified, supporting transparency and continuous service improvement.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: The free trial provides full access to software features and functionality for evaluation, excluding physical printing and dispatch services.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: CQS (Certified Quality Systems) Ltd
• ISO/IEC 27001 accreditation date: Tuesday 13 February 2024
• What the ISO/IEC 27001 doesn’t cover: Permiserv’s ISO/IEC 27001 certification applies to the information security management system (ISMS) and the defined scope of systems, processes, and services used to deliver the Permiserv platform. The certification does not extend to third-party services or infrastructure that are not under Permiserv’s direct operational control, such as the underlying data centre facilities and physical hardware managed by the Infrastructure as a Service (IaaS) provider. End-user devices, council-managed networks, and third-party systems that integrate with the service are also outside the scope of the certification. Responsibility for information security controls relating to these components remains with the relevant third parties or customer organisations.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: Provided
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
  • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
  • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors
  • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)
  • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at mail@permiserv.com. Tell them what format you need. It will help if you say what assistive technology you use.