QROUTES LIMITED

QRoutes

QRoutes is the UK’s market-leading planning and optimisation tool for home-to-school transport. It manages the complexities of SEND transport while delivering network-wide efficiency analysis and advanced scenario modelling. It also has dedicated functionality for planning and optimising mainstream school and adult social care transport.

Features

• Fast, automated and effective route optimisation
• Automatically find the best route for a new passenger
• Find opportunities to share transport between schools
• Automatically assign passengers to bus stops
• Specify who can travel with whom
• Assign and schedule Passenger Assistants
• Export tender-ready route itineraries with maps
• Track cost changes over time
• REST API for system integration
• Latest Ordnance Survey (OS) map data

Benefits

• Reduce transport costs by up to 20%
• Retain control, applying local knowledge and operational judgement
• Comply with statutory requirements such as maximum ride time
• Accommodate mobility requirements such as wheelchairs
• See and modify routes visually on a map
• Integrate with other software through CSV or API
• Bring all planners up to the same high productivity level
• Plan your whole transport network at once
• Identify and model strategies for targeted cost saving initiatives
• Plan adult social care transport

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at david.stewart@qroutes.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

169618522301937

Contact

David Stewart
0117 3329499
david.stewart@qroutes.co.uk

About your service

• Service categories:

  Applications

  Supply chain management

  • Logistics and transportation management
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Hybrid cloud
• Service constraints: QRoutes must be accessed through an up-to-date web browser (Chrome, Edge, Firefox or Safari).
• System requirements:
  • An up-to-date web browser (Chrome, Edge, Firefox or Safari)
  • A program to view and edit CSV files (e.g. Excel)

User support

• Email or online ticketing support: Yes
• Support response times: The user can contact support via the in-application help. Tickets can also be raised by email to support@qroutes.co.uk.; ; QRoutes will reply to all emails and tickets within 1 business day.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: QRoutes is proud of its close working relationship with customers. The subscription price includes example processing of the customer's data, tailored training for all users, and unlimited online support.; ; Each customer has access to a Customer Success Manager and a Training and Support Manager.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Training is typically provided online (although onsite can be arranged) using the customer's own data, wherever possible. QRoutes is a relatively straightforward product and most users find it intuitive and easy to use. It also has user documentation built into the application.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: Passenger details, transport requirements and route information can be retrieved by users at any time in CSV format. This applies to data that is stored only within a browser session, or if customers choose to store data in QRoutes persistently.; Custom map overlays and user activity audit data can also be downloaded in CSV format.
• End-of-contract process: The customer simply decides whether to re-subscribe or not. There is no tie-in of any sort.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: QRoutes provides a map-based (GIS) user interface through a web browser. The user can load in passenger information, view, add and optimise routes. The user can also view upcoming roadworks, vehicle restrictions and custom map overlays. A REST API interface is also available which enables integration with other systems or planning transport without using the web browser interface.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: QRoutes commissioned an accessibility audit of the QRoutes application. The interface was tested by visually impaired, blind, colour-blind, and deaf users.; ; The testers used assistive technology, including screen readers (JAWS, NVDA, Dragon) and a zoom tool (ZoomText), and navigated QRoutes using only a keyboard.; ; The testers carried out a live session with the QRoutes team, including developers and product managers, to demonstrate their experiences, and produced a written report of recommendations that QRoutes is using in the development of new and existing features.
• API: Yes
• What users can and can't do using the API: Customers first create a log-in account on the web interface. They can then use those same authentication details to begin a session via the API. Users can use the core features of QRoutes over the API: they can load in transport requirements, schedule trips, optimise routes, store data, specify custom fleets, assign passengers to bus stops, and retrieve results. It is also possible to load data over the API and then open that session in a web browser. Additional functionality is added to the API in response to customer demand.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Customer account administrators can control what functionality is available for standard users and how it is configured, including:; Routing & scheduling performance objectives;; Road speed calibration settings;; Passenger types;; Vehicle layout and depots;; Roadworks email notifications

Scaling

• Independence of resources: QRoutes has a scalable hosting architecture, whereby processing is sent to a single server but additional server resource is available for the potentially extensive back-end computations. Customer processing requests are allocated to free resource, meaning no one customer's usage affects another. The servers are used exclusively by QRoutes applications.

Analytics

• Service usage metrics: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Users download their processed data directly from the application or through the REST API as CSV files.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: QRoutes aims to provide 99.5% monthly uptime, excluding scheduled maintenance and force majeure events. Uptime is defined as the percentage of total minutes in a calendar month during which the service is available and functioning as intended. ; ; Scheduled maintenance will be performed either a) between 10:00 pm and 02:00 am UK time, or b) between 08:00 pm and 08:00 am UK time provided that QRoutes has used reasonable endeavours to provide users notice of such at least one business day in advance.; ; Customers are eligible for service credits if the monthly uptime falls below the committed levels: 5% of the monthly fee if the uptime is still above 98.5%, or 10% of the monthly fee if the uptime falls below 98.5%.
• Approach to resilience: QRoutes' services are hosted by iomart (https://www.iomart.com) or Microsoft Azure (https://azure.microsoft.com). Each application is backed up to isolated locations and has two permanently available dedicated disaster recovery environments, both in separate geographical locations to the production environment.
• Outage reporting: QRoutes notifies its users of any scheduled service downtime (outside the 10:00 pm to 02:00 am maintenance window) via the relevant application's log-in page.; ; When an outage or service disruption is expected to last longer than 15 minutes, an email (including the expected time of the return of services) is sent to users. QRoutes will email users again once the service is restored, providing detail on the cause of the outage.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to user accounts is controlled by username and password. Customers can configure the password policy for their users and choose whether to mandate the use of multi-factor authentication (MFA).; ; There are two levels of customer user: Standard and Administrator. The latter can control account configuration settings, including user access, as well as view audit history logs of account usage. MFA can be mandated for customer Administrator accounts independently of Standard accounts.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: QRoutes maintains a structured security governance framework that combines policy, oversight, and continuous assurance. ; ; All of its potential production environments undergo annual independent penetration testing, and least-privilege principles are enforced through Just Enough Access to restrict internal access to sensitive systems. ; ; Staff receive role-specific security training and are vetted to BS7858:2019 standards. Governance activities are supported by documented processes, regular reviews, and clear accountability, to ensure risks are identified, monitored, and managed effectively across the organisation.
• Information security policies and processes: QRoutes consistently reviews its approach to data protection and cyber security, notably through the agenda in its weekly operations meeting. Best practice is captured and disseminated across the company through internal communication and/or dedicated meetings, and the company provides data protection and cyber security awareness training for all its staff at least annually. The company maintains documentation detailing how its approach meets the National Cyber Security Centre's Cloud Security Principles.; ; The CEO is also the company's Data Protection Officer and ensures that any data or security concerns are raised with other directors in a timescale befitting their severity. ; ; QRoutes also operates software which automically alerts staff of potential service delivery problems and/or vulnerability concerns. ; ; QRoutes' services are hosted by iomart (https://www.iomart.com) or Microsoft Azure (https://azure.microsoft.com). The former is accredited for ISO standards 9001, 27001, 22301, and 50001, the latter for ISO standards 27001, 27017, 27018, and 27701, and Cyber Essentials Plus in the UK.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Customer change requests are logged in the company's support site, and their resolution tracked alongside other tickets in the Jira product management software. ; ; All software changes are triple tested manually for functionality, usability, and performance. QRoutes also maintains an automated test capability, which includes functional, regression, performance, stress, and security tests. All releases must pass automated regression and security tests in a staging environment prior to release, and then again in the production environment afterwards.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: QRoutes scans for vulnerability issues in both its deployment and development environments. ; ; For deployment, it uses a leading third party service to monitor the vulnerability of its production, disaster recovery, staging, and test environments. QRoutes staff are notified of potential issues daily, and establish their severity and immediacy within 1 business day. Critical vulnerabilities are patched within 24 hours, others in a timescale befitting the assessment. ; ; For development, an OWASP checker is run automatically following source code builds. It identifies potential security vulnerabilities within the code itself and highlights when any third-party libraries become outdated.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: QRoutes' protective monitoring processing includes third party penetration testing, data centre security, customer account monitoring, and the proactive patching of its servers and/or software as described in vulnerability management. ; ; The firewalls in QRoutes' data centres provide protection against unauthorised network access, malware and exploit attacks, application-layer attacks, and Distributed Denial of Service (DDoS) attacks. ; ; QRoutes operational staff also monitor account log-in attempts and usage for abnormal activity on a daily basis.
• Incident management type: Supplier-defined controls
• Incident management approach: QRoutes has pre-defined processes for handling all common IT system incident types, covering service availability, performance, and, as described above, security.; ; Availability is provided through the maintenance of two disaster recovery servers, both in separate geographical locations to its production server. Service performance adheres to the company's published Service Level Agreement.; ; Any incidents concerning data protection are logged separately. The Data Protection Officer determines what follow-on actions may be necessary in each case. ; ; QRoutes reviews incidents at its weekly operations meeting, escalating the visibility of more serious incidents to the monthly board meeting.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: UK local authorities responsible for planning home to school transport can access a restricted service free of charge for a two week trial period. Other organisations should contact info@qroutes.co.uk to determine if there is a free trial option.; ; Trials are restricted to 5 establishments (e.g. schools).

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0.0%
• Between £250,000 and £500,000: 1.0%
• Between £500,001 and £1,000,000: 2.0%
• Between £1,000,001 and £2,500,000: 3.0%
• Between £2,500,001 and £5,000,000: 4.0%
• Over £5,000,001: 5.0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at david.stewart@qroutes.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.