ARVATO LIMITED

UIPath Robotic Process Automation by ArvatoConnect

Our partnership with UI Path Robotic Process Automation (RPA) enables organisations to automate repetitive, rule-based tasks using secure, scalable digital workers. It integrates seamlessly with enterprise systems, improving efficiency, accuracy, and compliance. UI Path empowers businesses to accelerate digital transformation, reduce costs, and enhance productivity through intelligent, unattended automation.

Features

• Low-code, No-code, drag and drop functionality
• Easily scalable and quick to deploy
• Infused with best-of-breed Generative AI, Machine Learning and LLM
• Culturally and technically open platform
• Defence-grade security
• Enterprise-ready
• Seamlessly integrate front and back office applications
• Frictionless deployment, existing architecture not affected
• Integrated computer vision, document understanding (AI and ML)
• Industry's most skilled and capable robots

Benefits

• Automate manual, repetitive processes with software robots
• Analyse your automations and ROI with dashboards and one-click drilldowns
• Access free, online, self paced training with certifications
• Discover and validate automation candidates and ROI
• Improve your customer and citizen experience and your SLAs
• Accelerate benefits from digital transformation
• Improve compliance and governance in your workplace
• Improve your employees experience with a digital assistant
• Easily automate conversational processes with integrated chatbots
• Automate and centralise software testing

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at richard.husband@arvatoconnect.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

135861536226632

Contact

Richard Husband
07867464428
richard.husband@arvatoconnect.co.uk

About your service

• Service categories:

  Application Development and Deployment

  Application platforms

  • Robotic process automation
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Planned Maintenance and regular updates to the Cloud Platform are; updated in the portal, http://status.uipath.com/. For support exclusions,; refer to the 'Support Exclusion' clause in the Support Terms available; here:; https://www.uipath.com/hubfs/legalspot/UiPath_Support_Terms.pdf
• System requirements:
  • Orchestrator (Cloud Platform): https://docs.uipath.com/cloudplatform/docs/software-requirements
  • Robots - S/w Requirements: https://docs.uipath.com/robot/docs/software-requirements
  • Robots - H/w Requirements: https://docs.uipath.com/robot/docs/hardware-requirements
  • Studio: S/w Requirements: https://docs.uipath.com/studio/docs/software-requirements
  • Studio: H/w Requirements: https://docs.uipath.com/studio/docs/hardware-requirements

User support

• Email or online ticketing support: Yes
• Support response times: Support channels include help desk portal and any existing customers may raise requests/ incidents from it by accessing the following link: https://www.uipath.com/company/contact-us. Other support channels such as phone-in support and customer support portal for managing and tracking tickets are available for customers availing Premium Support. SLAs for Response time: Priority - Standard - Premium 1- Urgent- 2 hours - 1 hour 2-High - 8 hours - 4 hours 3 Normal - N/A -8 hours 4-Low - N/A - 2 business days.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: UiPath offers three types of technical support programs: (a)Standard; support is in English and included with every license purchase.; Available during regular UiPath business hours for each region, and; 24/7 support is available for Priority 1 (P1) issues. Standard support is; free. (b)The Premium Support plan is meant for customers who: -Have; critical business processes in production which require 24x7 support,; accelerated case response and resolution and mission-critical support.; -Want assistance with initial architectural analysis as well as basic; installation and upgrade preventive care (c) The Premium Plus Support; plan is meant for customers who: -Have critical business processes in; production which require 24x7 support, accelerated case response and; resolution and mission-critical support. -Want coordinated, ongoing; assistance with their architectural design -Are new customers seeking; to build a strong foundation and confidence in their automation; program -Are mature organizations seeking to expand the benefits of; their automation program -Want to inject UiPath product and; implementation expertise in planning, training and quickly enabling; relevant features -Seek to drive continuous improvement and technical; maturity in their automation program Premium plans include a; Technical Account Manager. Please see; https://www.uipath.com/support/packages-options
• Support available to third parties: No

Onboarding and offboarding

• Getting started: A strong differentiator for UiPath is our Learning Culture. It is critical for UiPath to make significant global investments in our people, partners, customers, industry and academia. UiPath has a free E-Learning platform (academy.uipath.com), that speeds up the learning and proficiency curve. Training for development, management and reporting consists of three levels: starting with the Foundation course, followed by the Orchestrator and then the Advanced courses. These courses are available online, free of charge and are self-led through the UiPath Academy.; ; Advanced courses can also be delivered as classroom training through our UiPath Official Training Partners (https://www.uipath.com/partners/official-training-partners) or in some cases, directly provided by UiPath. UiPath has 18 training partners, covering all regions. Role-based training is available and the training can be customized for the customer.; ; We also provide online resources including documentation, videos, knowledge base, and FAQs, available here: https://www.uipath.com/developers/guides-and-resources
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: UiPath, regarded as a data processor under GDPR regulations, upholds all obligations associated with this role by affording customers complete control over their data in alignment with product architecture and implementation. The company facilitates data export upon request and ensures data deletion from its systems within the mandated 30-day soft-delete period following account closure or data deletion requests. Customers are encouraged to assess their Cloud Platform usage's compliance with privacy obligations. For comprehensive details on UiPath's data processing practices and GDPR commitments, refer to the Privacy Policy: https://www.uipath.com/legal/privacy-policy
• End-of-contract process: End of contract process will be provided in user agreements. At a high; level, on contract termination, all data will be exported to customer on; request as per GDPR guidelines. The UiPath cloud platform follows the; same guidelines as Microsoft Azure, the underlying storage platform for; data destruction on contract termination. These are available at; https://docs.microsoft.com/enus/azure/security/fundamentals/protection-customer-data
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: TBC

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
• Application to install: Yes
• Compatible operating systems: Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: UiPath has the Orchestrator Mobile App, which is available in the Apple App Store and Google Play Store. The Orchestrator is not designed to be used on mobile browsers/ web browsers. The mobile app only offers a light-view into the customers' Orchestrator instances. With the Orchestrator app, you can perform the following: Monitor Robots and Queues, search assets, start, stop, or kill jobs. With the mobile app, you can also mark processes and jobs as 'Favourite' and monitor the processes using Push notifications. These two features are not available in the Orchestrator service.
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: UiPath's Cloud Platform encompasses various independent services like Orchestrator, Tenant Management, Licensing Service, and others. These services are abstracted from end-users through the UiPath Cloud Portal, ensuring a unified experience. The entire suite, including the Cloud Portal, operates under a software-as-a-service (SaaS) model hosted on Microsoft Azure. Core Azure services, including compute, storage, networking, SQL database, and identity and access management, support these services.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: UiPath integrates accessibility into design, develop and quality; assurance processes of its dependent products. Compliance to; accessibility standards are evaluated through the use of automated; testing, manual validation with assistive technologies, and support form third party source.
• API: Yes
• What users can and can't do using the API: From the integration perspective, for automation, Cloud Platform; (SaaS) or Cloud Deployment can integrate with applications via the; APIs. Orchestrator’s REST API fully programmatically supports all; operations on the server-side like adding robots, processes, assets,; queues and starting/ stopping/ scheduling processes. This is the; standard way to integrate with external BPM or workflow tools, ERP,; CRM or any other applications . Orchestrator REST API is powerful; enough to integrate seamlessly with partner BPM systems or any other applications, providing 22 Custom API methods for access and control of 29 logical resources within Orchestrator (for example, Jobs, Logs, Queues, Robots and Settings). As an example of how users can use this, an external application such as a chatbot can easily trigger the robots to perform a task based on input in the chatbot. Refer here for more information on the APIs: ://orchestrator.uipath.com/reference
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: UiPath Cloud Platform has been designed to be ready for growth, with; excess capacity planned according to the expected expansion of; customers. As we scale the cloud up and ensure it keeps it customer; promises, we are re-actively monitoring the capacity based on; engineering feedback. Our engineering team has worked on some of; the world’s largest cloud platforms and understand the nuances of; scaling cloud environments successfully and with high reliability.

Analytics

• Service usage metrics: Yes
• Metrics types: The UiPath server (Orchestrator) has Elasticsearch and the Kibana reporting tool built in. This means that the usage metrics can be analysed in any way customers need.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: UI Path

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: Each Customer is issued their own vault that stores certificates, keys, and any other credentials working between services. Additionally, all user accounts and application accounts are tied to a customer identity that serves as a separate domain. All database storage leverages AES CBC 256 or 128 where 256 is not available. Logical separation is created by means of encryption and separate accounts between services for each customer.
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: All data is accessible to customers via the UI of the Cloud Platform. In; case customer wants to export data, the request for data export must; be placed with UiPath who will perform the database export.
• Data export formats: Other
• Other data export formats:
  • Data cannot be imported but created in the Cloud Platform.
  • Manual steps for migration from on-prem to cloud-platform are available.
• Data import formats: Other
• Other data import formats:
  • Data cannot be imported but created in the Cloud Platform.
  • Manual steps for migration from on-prem to cloud-platform are available.

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: UiPath will make commercially reasonable efforts to provide to; Customer an uptime of 99.9%. Uptime is measured per service per; region. The availability of the hosted service will be communicated to; the Customer on the https://status.uipath.com/ webpage or through; other channels, as appropriate. SLAs are specified in the user; agreement.
• Approach to resilience: UiPath Automation Cloud leverages Azure resiliency natively for all; components. Currently replication is only between datacenters in the; geographic region (within the US or within the EU). This could be; expanded based on customer requirements. Refer here for more; information: https://azure.microsoft.com/en-in/features/resiliency/
• Outage reporting: The availability of the hosted service and any incidents/outages will be; communicated to the Customer on the https://status.uipath.com/; webpage. In the status.uipath.com portal, customers can sign up for; notifications and alerts via their preferred communication method:; email, text, ATOM, or RSS feed.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Username and password control over access to uipath products. This can be achieved via AD or other auth mechanisms.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: UiPath has an internal Cyber Security Policy that defines the cyber security procedures and measures implemented by UiPath and subsidiaries in order to protect the confidentiality, integrity and availability of the company’s information assets in accordance with business objectives and applicable laws and regulations.; ; UiPath’s Cyber Security governance framework is based on the following principles:; 1. Ensuring security of UiPath critical information and systems is a shared responsibility.; 2. The Global Cyber Security Policy is approved by UiPath management, published and communicated to all users (employees, contractors, freelancers, vendors and collaborators).; 3. The policy will be subject to continuous monitoring and regular improvement and will be reviewed annually and modified if significant changes occur.; 4. All data stored and processed by UiPath will be handled according to an appropriate level of confidentiality and in compliance with relevant regulatory and contractual requirements.; 5. Cyber security roles and responsibilities will be defined and communicated.; ; This policy along with other subsequent policies are provided as training to all employees. Violation of policies lead to disciplinary action, upto termination of employment.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: For configuration changes to the service, for the regular maintenance; of the cloud platform, which may happen every two weeks, updates are; done in Deployment rings, and notification to customers are provided; via the portal: https://status.uipath.com/ . Major updates are also; announced in release notes. For infrastructure changes, UiPath Cloud; Platform is hosted in the Azure Data Centers. A change in storage; location or infrastructure would be treated as an infrastructure incident; triggering notification of the customer. UiPath has a dedicated team to; work with Microsoft and the Azure team who would be notified; immediately of any proposed change.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: For external vulnerability testing, UiPath uses the services of Veracode; VAPT. UiPath Robots, UiPath Studio, and our on-premise (standalone); Orchestrator are Veracode Continuous Certified. For the Cloud; Platform, we have Veracode certification, ISO 27001, and working; towards SOC 2 report. We also monitor vulnerabilities introduced in our; code base through third-party libraries and minimize our dependency; on these libraries and corresponding exposure. We also participate in; the HackerOne Bounty Program to identify vulnerabilities in our RPA; Platform and surrounding ecosystem. UiPath Cloud Services use; Azure's PaaS which automatically provides regular updates for known; security vulnerabilities in infrastructure.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: UiPath employs a 24/7 Site Reliability Team that monitors security; alerts and incidents. UiPath monitors access management, application,; system, and network traffic both at the perimeter and within the; environment to prevent any malicious activity and to track availability; and performance. In the event of a breach, we use security response; plans to minimize data leakage, loss, or corruption. We provide; transparency to our customers throughout the incident; (https://status.uipath.com). Once the issue is contained, our security; incident management process continues as we identify the root cause; and track the necessary changes to ensure we prevent similar issues; in the future.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Customers can raise a ticket through our online ticketing portal or use; phone-in support based on the support model purchased. In the event; of a breach, we use security response plans to minimize data leakage,; loss, or corruption. Our 24x7 SRE and Security team identify the issue; and engage the development team resources to contain the impact of; the incident. Once the team has contained an issue, our security; incident management process continues as we identify the root cause; and track changes to ensure we prevent similar issues in the; future. Incident management for the infrastructure is managed by; Azure.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: The Community plan of the UiPath platform is free of charge and has no time limit. There is online support only. Software is available for onsite trials, PoC's and pilots, at no charge, subject to signing an NDA.
• Link to free trial: https://www.uipath.com/product/free-trials-and-downloads

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 5%
• Between £2,500,001 and £5,000,000: 5%
• Over £5,000,001: 5%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BSI
• ISO/IEC 27001 accreditation date: Wednesday 7 September 2022
• What the ISO/IEC 27001 doesn’t cover: While it is not practicable to list exclusions in isolation, our ISO 27001 certification supports all contracted services to ArvatoConnect customers, including contact centre, back-office and IT services.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: BSI
• ISO 9001 accreditation date: Monday 16 January 2023
• What the ISO 9001 doesn’t cover: While it is not practicable to list exclusions in isolation, our ISO 9001 certification supports business process outsourcing, delivering a comprehensive range of front and back office services. This includes customer experience services and administrative services.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Fbb5c636-5561-4d78-b819-3360c25ffe07
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: A774e5a5-9ad4-4cbf-a7a3-e47ea2c0ef05
• Other security certifications: Yes
• Any other security certifications:
  • Tisax
  • ISO 20000-1:2018

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at richard.husband@arvatoconnect.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.