INTELLIGENT DECISIONING LTD

docCentrum Control and Compliance

docCentrum Control and Compliance delivers secure document management and compliance tracking on Microsoft 365. It automates publishing, approvals, and mandatory read tasks, ensuring ISO and other regulatory adherence. Features include version control, metadata search, real‑time reporting, and onboarding workflows, reducing risk and improving governance across your organisation.

Features

• Centralised, secure document control within your Microsoft 365 tenant
• Streamlined approvals and publishing for controlled and uncontrolled documents
• Full audit history
• Mandatory read and acknowledge tasks
• Quizzes to validate understanding and reduce organisational risk
• Email alerts for new tasks, reminders, and escalations
• Monitor compliance status, lifetime read receipts, and task completion
• Works seamlessly with Office 365 and supports third-party tools
• Easy access to essential documents and policies for new starters

Benefits

• Single Source of Truth
• Automated Publishing Lifecycle
• Compliance Tracking
• Targeted Notifications
• Real-Time Reporting
• Integration Ready
• Improved Onboarding

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@id-live.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

125472604790586

Contact

Tony Pounder
07967 320622
info@id-live.com

About the service

• Service categories:
  • Applications
    • Content workflow and management
      • Content services
        • Enterprise Content Management Applications
        • Content Sharing and Collaboration Applications
      • Document
        • Document
      • Persuasive content management
        • Digital Asset Management Applications
        • Product Content Management Applications
      • Enterprise portals and digital workspaces
        • Multi-Audience Portals
        • Integrated Employee Workspaces
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Microsoft 365, Microsoft SharePoint Online and Microsoft Teams
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: DocCentrum is designed for SharePoint Online within Microsoft 365 and requires modern browsers. It does not support legacy browser versions. Planned maintenance aligns with Microsoft 365 update schedules, with minimal downtime. Support is limited to UK business hours and excludes hardware-specific troubleshooting. Customisation beyond standard features may require additional consultancy.
• System requirements:
  • Microsoft 365 tenant with SharePoint Online enabled
  • Production Power Platform environment
  • Microsoft 365 Business or E3 licence

User support

• Email or online ticketing support: Yes
• Support response times: UK office hours - 08:00 - 18:00; ; Low Priority; Response Time: 4 hours; Resolution Time: 30 days ; ; Medium Priority; Usually applied to single-function errors; resolution within agreed timeframe (often under 15 days). ; ; High / Urgent Priority; Major incidents or critical business impact; response within hours, resolution expedited (often same day or within 1–2 days)
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AAA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), 7 days a week
• AI chatbot: Yes
• Web chat support accessibility standard: WCAG 2.2 AAA
• Web chat accessibility testing: The service provider has carried out web chat testing
• Onsite support: Yes, at extra cost
• Support levels: Intelligent Decisioning provides retained consultancy and managed support services under a personalised SLA, with the costs being on a day rate basis of £900 per day.; ; Support covers Incident Management, Problem Management, and Request Management, with unlimited ticket logging via a self-service portal and monthly usage reporting. ; ; Standard hours are Monday–Friday, 08:00–18:00 UTC, excluding holidays. ; ; Customers receive a dedicated principal contact and access to Microsoft 365 experts for SharePoint, Power Platform, and related technologies.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Intelligent Decisioning provides comprehensive onboarding to help users start using docCentrum quickly and effectively. We offer on-site training for teams that prefer hands-on guidance, covering document lifecycle management, compliance workflows, and integration with Microsoft 365. For distributed or remote teams, we deliver online training sessions via Microsoft Teams, including interactive demonstrations and Q&A to ensure user confidence.; ; To support self-paced learning, we provide detailed user documentation, including step-by-step guides, FAQs, and video tutorials accessible through our customer portal. Administrators receive advanced configuration guides for metadata, workflows, and API integrations, while end-users benefit from quick-start guides for everyday tasks like mandatory reads and document search.; ; Additionally, Intelligent Decisioning offers post-deployment support through retained consultancy packages, ensuring ongoing assistance for configuration changes, troubleshooting, and feature adoption. Our goal is to make implementation seamless, reduce learning curves, and empower organisations to achieve compliance and governance objectives efficiently.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: When a contract ends, Intelligent Decisioning ensures customers can securely extract all their docCentrum data. Administrators can use built-in export features to download documents, metadata, compliance records, and audit logs directly from the SharePoint Online libraries and Dataverse tables where data resides. This includes exporting structured data in CSV or Excel format for reporting and archiving.; For advanced scenarios, the docCentrum API provides authenticated endpoints to retrieve document details, compliance tasks, and lifecycle history, enabling bulk extraction or integration with third-party systems. Customers may also leverage Power Platform connectors for automated data migration workflows.; Intelligent Decisioning offers guidance and support during offboarding, including step-by-step documentation and optional consultancy to assist with data export and validation. All extracted data remains under the customer’s Microsoft 365 tenant, ensuring compliance and security throughout the process.
• End-of-contract process: Intelligent Decisioning offers guidance and support during offboarding, including step-by-step documentation and optional consultancy to assist with data export and validation. This is charged at the current day rate of £900 per day.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The service is fully responsive so the differences are down to the order in which the screen are displayed - the content is stacked for a mobile device
• Service interface: Yes
• Description of service interface: DocCentrum provides a secure, integrated interface combining Azure-hosted APIs with SharePoint Online components. ; ; The core service uses a .NET Web API for data exchange, authenticated via Azure Active Directory. Administrators manage compliance tasks and document lifecycles through an Admin Centre, while end-users interact via SPFx webparts embedded in SharePoint pages. ; ; Features include document browsing, metadata filtering, mandatory reads, and real-time compliance reporting. ; ; The API supports Power Platform connectors and third-party integrations, ensuring extensibility and governance within Microsoft 365.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Intelligent Decisioning conducts accessibility testing to ensure docCentrum meets WCAG 2.1 AA standards and PSBAR compliance. Testing includes user sessions with customers who have assistive technologies such as screen readers (JAWS, NVDA), keyboard-only navigation, and high-contrast modes. We validate that all interactive elements are operable without a mouse, content is perceivable, and navigation is logical for users relying on assistive tools. During UAT, selected participants tested workflows for mandatory reads, document search, and compliance tasks using screen readers and voice navigation. Issues identified—such as missing ARIA labels or inconsistent focus order—were remediated before release. Continuous improvement is embedded in our process, with periodic audits and feedback loops to maintain compatibility with evolving assistive technologies. This ensures inclusivity and usability for all users, regardless of ability.
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: The docCentrum API delivers secure, standards‑based integration for compliance and document control within Microsoft 365. Built on Azure App Service, it exposes a RESTful .NET Core Web API documented by an open Swagger specification, enabling rapid connector creation and straightforward consumption by Power Platform, custom applications, and third‑party services. Authentication and authorization are enforced via Microsoft Entra ID (Azure AD) using OAuth 2.0, with role‑ and policy‑based access aligned to tenant security.; Core capabilities include retrieving document metadata, versions, policies, and compliance states; listing and updating user compliance tasks (read/acknowledge, quizzes), and surfacing audit events for dashboards and reporting. The API supports workflow orchestration by triggering lifecycle actions (approve, publish, retire) subject to governance rules configured in the Admin Centre. Event hooks and web‑friendly payloads facilitate integrations with digital signature providers (e.g., DocuSign, Adobe Sign), enterprise search, and service desks. Pagination, filtering, and consistent error contracts simplify large‑scale consumption.; The API is deliberately protective of configuration: administrative settings, security models, and global workflows are managed in the Admin Centre, not directly writable via endpoints. This preserves control and compliance while giving developers a stable, extensible surface to build automations, portals, and analytics that enhance operational efficiency and audit readiness.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Users with the appropriate access levels can customise:; ; Workflow Configuration – Define approval stages, publishing rules, and compliance tasks.; Metadata Management – Add custom fields, categories, and retention policies.; Branding Options – Apply logos, color schemes, and corporate terminology.; Notification Settings – Customize alerts, reminders, and escalation paths.; Role-Based Access – Assign granular permissions for authors, approvers, and readers.; Integration Flexibility – Connect via API or Power Platform for bespoke workflows.; Third-Party Extensions – Enable digital signatures with DocuSign or Adobe Sign.; SharePoint Enhancements – Extend functionality using SPFx webparts and custom pages.

Scaling

• Independence of resources: Intelligent Decisioning ensures consistent performance by leveraging Microsoft 365’s elastic cloud architecture and Azure App Services, which automatically scale resources under load. docCentrum workflows run independently within Power Platform environments, preventing contention between users. Metadata-driven caching and throttled background tasks maintain responsiveness, while API rate limits and telemetry via Application Insights enable proactive monitoring. These measures guarantee that high demand from some users does not impact others, preserving compliance and document access across the organisation.

Analytics

• Service usage metrics: Yes
• Metrics types: DocCentrum provides real-time compliance and usage metrics to support governance and audits. Key metrics include document lifecycle status (draft, published, retired), mandatory read completion rates, quiz results for policy understanding, and user engagement statistics. Administrators can view lifetime read receipts, overdue task counts, and escalation reports. Additional dashboards track workflow efficiency, approval turnaround times, and metadata accuracy. These metrics are accessible through the Admin Centre and exportable for reporting, ensuring transparency and regulatory compliance across the organisation.
• Reporting types:
  • API access
  • Real-time dashboards
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Supplier type

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Microsoft

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: Never
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type:
  • Data Erasure
  • Physical Destruction / Hardware containing data is completely destroyed
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: Intelligent Decisioning ensures customers can securely extract all their docCentrum data. Administrators can use built-in export features to download documents, metadata, compliance records, and audit logs directly from the SharePoint Online libraries and Dataverse tables where data resides.; ; For advanced scenarios, the docCentrum API provides authenticated endpoints to retrieve document details, compliance tasks, and lifecycle history, enabling bulk extraction or integration with third-party systems. ; Intelligent Decisioning offers guidance and support during offboarding, including step-by-step documentation and optional consultancy to assist with data export and validation. All extracted data remains under the customer’s Microsoft 365 tenant, ensuring compliance and security throughout.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • Docx
  • PDF
  • Xlsx
  • Pptx
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • Docx
  • Xlsx
  • Pptx

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
• Other protection within supplier network: All data resides in Intelligent Decisionings Microsoft 365 tenant, and as such it is protected in transit and at rest, by Microsoft 365.

Availability and resilience

• Guaranteed availability: Intelligent Decisioning guarantees high availability for docCentrum by leveraging Microsoft 365’s resilient cloud infrastructure. Our service targets 99.9% uptime, excluding scheduled maintenance and Microsoft platform outages. Availability is monitored continuously, and performance metrics are reported through the Admin Centre and Microsoft Service Health dashboards.; Service Level Agreement (SLA):; ; Availability Commitment: 99.9% monthly uptime.; Scope: Includes access to docCentrum features, workflows, and compliance tasks hosted within Microsoft 365.; Exclusions: Planned maintenance windows and force majeure events.; ; Refunds and Remedies:; If availability falls below the guaranteed level, customers are eligible for service credits applied against future invoices. Credits are calculated proportionally to the downtime experienced and documented in the SLA terms. For retained consultancy packages, additional support time may be offered as compensation.; Our approach combines Microsoft’s enterprise-grade redundancy with Intelligent Decisioning’s governance and monitoring, ensuring minimal disruption and transparent reporting for compliance and audit purposes.
• Approach to resilience: DocCentrum is built on Microsoft 365 and Azure, leveraging enterprise-grade resilience and redundancy. The service uses Microsoft’s globally distributed datacentres, which operate in active-active configurations across multiple geographic regions. Each data-centre includes redundant power, cooling, and network connectivity, ensuring high availability even during component failures. Data is replicated across multiple physical locations within the same region to maintain durability and continuity.; Azure App Services hosting the docCentrum API benefit from automatic failover and load balancing, while SharePoint Online and Dataverse provide built-in replication and disaster recovery capabilities. Intelligent Decisioning applies governance and monitoring through Microsoft Service Health and Application Insights, enabling proactive detection and mitigation of issues. In the event of a regional outage, Microsoft’s failover mechanisms ensure continuity without user intervention. Combined with our SLA commitment of 99.9% uptime, this architecture guarantees resilience, scalability, and compliance for critical document control and governance processes.
• Outage reporting: DocCentrum reports outages through multiple channels to ensure transparency and timely communication. Service health is primarily monitored via Microsoft 365 Service Health Dashboard, which is publicly accessible to administrators through the Microsoft 365 admin centre. This dashboard provides real-time status updates, incident details, and resolution progress for all underlying Microsoft services, including SharePoint Online, Dataverse, and Azure components.; For automation and integration, Microsoft offers a Service Communications API, enabling programmatic access to health data for custom dashboards or alerting systems. Intelligent Decisioning can configure this API for clients requiring automated notifications.; Additionally, email alerts are sent to designated administrators when incidents occur, including outage details and estimated resolution times. Optional Teams notifications can also be configured for rapid internal communication. Combined, these mechanisms ensure customers are informed promptly and can take appropriate action during service disruptions.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Intelligent Decisioning complies with ISO 27001. We enforce strict access controls across all management interfaces and support channels. Administrative access requires Multi-Factor Authentication (MFA), Conditional Access policies, and IP-based restrictions. Role-Based Access Control (RBAC) ensures least-privilege permissions, supported by dynamic group membership for efficient user lifecycle management. All administrative actions and login attempts are logged and monitored for audit purposes. Support channels are secured through identity governance, data loss prevention, and sensitivity labels. Guest access requires explicit approval and is monitored via Microsoft Purview audit tools. These measures guarantee secure, compliant access and operational resilience.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Cyber Essentials
• Information security policies and processes: Intelligent Decisioning follows ISO 27001-aligned Information Security Management System (ISMS) policies and processes. Core policies include the Information Security Policy, Access Control Policy, Encryption Policy, Patch Management Policy, and Security Incident Reporting Policy. These govern confidentiality, integrity, and availability of information assets, supported by Disaster Recovery and Business Continuity plans. ; Reporting Structure:; The ISMS Manager oversees compliance and chairs the security forum with senior management. Roles and responsibilities are defined in job descriptions and the ISMS Structure Chart. Segregation of duties is enforced across development, test, and production environments. ; Enforcement:; Policies are contractual obligations for all employees. Breaches may lead to disciplinary action. Regular audits, risk assessments, and training sessions ensure awareness and adherence. Security incidents must be logged, investigated, and resolved promptly, with corrective and preventive actions documented. Continuous improvement is achieved through policy reviews and monitoring of statutory and regulatory changes.

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Intelligent Decisioning complies with ISO 27001 and the UK Government’s Cloud Security Principle 5: Operational Security. All changes follow a formal process using Azure DevOps, including risk assessment, approval, testing, and rollback plans. Emergency changes are reviewed post-implementation. Configuration baselines for Microsoft 365, Azure, and Windows are enforced via Intune and Defender. Segregation of duties, version control, and MFA prevent unauthorised changes. Compliance is maintained through audits, penetration testing, and annual reviews. Staff receive mandatory security training, and incidents trigger documented response procedures, ensuring resilience and transparency.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Intelligent Decisioning operates an ISO 27001-aligned vulnerability management process. We assess threats through regular risk assessments, automated vulnerability scans, and secure code reviews. Critical patches are deployed immediately; standard updates follow monthly or quarterly cycles after testing and rollback planning. Threat intelligence is sourced from Microsoft security bulletins, OWASP alerts, and vendor advisories to ensure timely response. Compliance is maintained through documented procedures, audits, and continuous monitoring, guaranteeing resilience and alignment with UK Government security principles
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Intelligent Decisioning uses Microsoft Defender XDR and Azure Monitor for continuous monitoring, alerting on anomalies and suspicious activity. Potential compromises are logged immediately and escalated under our ISO 27001-aligned Incident Response Policy. Critical incidents trigger immediate containment, eradication, and recovery actions, followed by root cause analysis and preventive measures. Response times are rapid—critical issues are addressed within hours, often starting mitigation within 60 minutes of detection. Regular audits, automated alerts, and documented procedures ensure resilience and compliance with UK Government security principles.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: Intelligent Decisioning operates an ISO 27001-certified Information Security Management System. Our incident management framework includes predefined processes for common events such as data breaches or service disruptions. All incidents are reported immediately by users via a standard template and escalated to the Information Security Manager for logging and response. Critical incidents trigger rapid containment and recovery actions, with SLAs ensuring urgent responses within 30 minutes. Formal incident reports, including root cause analysis and corrective actions, are provided internally and externally where required. Post-incident reviews and audits drive continuous improvement and maintain compliance with operational security principles.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks:
  • Public Services Network (PSN)
  • Joint Academic Network (JANET)
  • Scottish Wide Area Network (SWAN)
  • Health and Social Care Network (HSCN)

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Includes core document management features, basic workflows, mandatory read, and email support during UK business hours. Excludes advanced compliance, custom workflows, integrations, and extended support. Offered as a trial for up to six months.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 2%
• Between £250,000 and £500,000: 3%
• Between £500,001 and £1,000,000: 4%
• Between £1,000,001 and £2,500,000: 5%
• Between £2,500,001 and £5,000,000: 6%
• Over £5,000,001: 10%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: Citation ISO Certification
• ISO/IEC 27001 accreditation date: Friday 12 October 2018
• What the ISO/IEC 27001 doesn’t cover: The scope of the Management System applies to the following:-; THE PROVISION OF IT CONSULTANCY SERVICES AND DEVELOPMENT OF CUSTOM; SOFTWARE SOLUTIONS
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• ISO 9001 certification accredited by: Citation ISO Certification
• ISO 9001 accreditation date: Friday 9 July 2021
• What the ISO 9001 doesn’t cover: The scope of the Management System applies to the following:-; The provision of IT consultancyservices and development of custom software solutionS
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 2B993ED0-97BA-43B0-BB95-93AA09B2158B
• Cyber essentials plus: No
• Cyber Essentials Alternative: You do not have a current and valid Cyber Essentials Plus certificate, or will not have in place within 12 months of the date of award but have an IASME certified equivalent.
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Volunteering opportunities for staff
  • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@id-live.com. Tell them what format you need. It will help if you say what assistive technology you use.