Curshaw

Pellucid - Asset Data and Contract Management Platform

Pellucid is a SaaS platform that helps organisations make informed decisions about their property assets and facilities management (FM) services. It does this by giving you clear ownership, control and visibility of your asset data.

Features

• Reporting dashboards linked to electronic versions of contracts
• Structured asset and location data aligned with FMS 002
• Integration with CAFM systems
• Controlled change management and change control processes
• Links between assets, locations, work orders and maintenance activities
• APIs supporting recognised standards and guidance, including SFG20 and legislation
• Contract review workflows with action tracking and audit support

Benefits

• Maintain real-time access to asset data and reduce information asymmetry
• Improve the quality of asset data through structured data management
• Support accurate planned maintenance and lifecycle cost forecasting
• Achieve better value for money by reducing risk pricing
• Avoid repeated asset validation surveys when contracts change
• Support automated performance reporting and audit against contractual requirements

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at felix.wisby@curshaw.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

266101354006944

Contact

Felix Wisby
07443103415
felix.wisby@curshaw.com

About the service

• Service categories:
  • Applications
    • Enterprise resource management
      • Asset life-cycle management
        • Asset life-cycle management
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Hybrid cloud
• Service constraints: Any required maintenance windows will be communicated to users in advance. Wherever possible these windows will be overnight to minimise disruption.
• System requirements:
  • Microsoft account, for sign-in and authentication purposes.
  • Up to date web browser.

User support

• Email or online ticketing support: Yes
• Support response times: Within three business days.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Service availability is over 99%, excluding planned out-of-hours maintenance.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: The service includes:; Initial training for users; Annual refresher training; Access to online training materials; Ongoing support via chat, email and phone; ; These services are included within the core service price.
• Service documentation: No
• End-of-contract data extraction: Pellucid supports buyers in exiting the service and retrieving their data in line with the Call-Off Contract. Data will be provided by us as described below.
• End-of-contract process: Pellucid supports buyers in exiting the service and retrieving their data in line with the Call-Off Contract.; On termination of the service:; All buyer data and documents are returned to the buyer; Platform data and IDF content are stored in industry-standard XML; Buyer-generated data can be exported in commonly used formats, including Word, PDF and XML; Buyer data is securely deleted from all systems and storage media after the end of the subscription period. ; ; Where a buyer requests full off-boarding to an alternative supplier:; A complete copy of XML and HTML content can be provided in an SQL database; The cost of off-boarding is the greater of one year’s annual licence fee for the relevant project(s) or £7,500

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: There are no differences beyond layout optimisation.
• Service interface: Yes
• Description of service interface: The service interface is accessible via a web browser.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: The system is compliant with screen readers and reconfigures according to the user's chosen zoom %.
• User support accessibility: WCAG 2.2 AA
• API: No
• Customisation available: Yes
• Description of customisation: Reporting and Performance Dashboards can be configured to the preference of the buyer's authorised representative.

Scaling

• Independence of resources: We guarantee 99.9% uptime of the application and server infrastructure in line with Tier 1 data centre standards for a highly available mobile application hosted on Microsoft Azure infrastructure, following the guarantee we have in place from Microsoft.

Analytics

• Service usage metrics: Yes
• Metrics types: Number of active users in a given period.; Time taken to undertake specific service tasks.
• Reporting types: Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: Data is exported at the end of the term of the licence.
• Data export formats: CSV
• Data import formats: Other
• Other data import formats:
  • CSV
  • PDF
  • XML
  • SQL
  • DB2
  • Oracle

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • IPsec or TLS VPN gateway
  • Other
• Other protection between networks: Encryption in line with ISO27001:2022.
• Data protection within supplier network:
  • IPsec or TLS VPN gateway
  • Other
• Other protection within supplier network: Encryption in line with ISO27001:2022.

Availability and resilience

• Guaranteed availability: Service availability is over 99%, excluding planned out-of-hours maintenance. There is no financial recompense model for failure to meet service levels.
• Approach to resilience: Data is replicated daily across two server locations to support service continuity in the event of a major infrastructure failure. Further details are available on request.
• Outage reporting: Email alerts will be sent in the unlikely event of any outages.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
• Access restrictions in management interfaces and support channels: User permissions are established as part of onboarding and can be modified by request during the contract term.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: The system and its components are all built with an integrated security model. Single sign on is enabled using integrated security and authentication providers (currently Microsoft, Google, Apple and Meta). ; We support multi-factor authentication on all the Identity providers where required.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Almost all changes are configurable changes through data, rather than wholesale change to the service itself. An integrated test process is in place which establishes three stages of development and testing prior to approval and release, and this is accredited as part of our ISO27001 assessment. This encompasses an assessment of potential security impact, and this assessment is part of the consideration in releasing the change.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: We have a confidential vulnerability management process, which is confidential to help ensure vulnerability is kept to a minimum. We continually assess potential threats and vulnerabilities using in-built AI and real-time penetration testing, with patches developed as quickly as possible in the unlikely event of any identified issues, usually within 24 hours.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: We conduct internal automated monitoring on an ongoing basis. If a potential compromise is found, we respond with a patch or relevant update within 24 hours.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Post-quantum cryptography secure: Yes
• Incident management approach: We have a pre-defined process for common events. Where a user reports an incident via phone or email, we have a process which includes an Incident Report Committee investigating the incident, agreeing the most appropriate response and the required timescale. Implementation of this response to rectify the problem then takes place as agreed. The reporting user is then updated in line with ITIL standards.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 30%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: Intercert
• ISO/IEC 27001 accreditation date: Thursday 18 December 2025
• What the ISO/IEC 27001 doesn’t cover: N/a
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 29f14193-fc08-4e3e-a0c3-769c8889451e
• Cyber essentials plus: Yes
• Cyber Essentials Plus Certificate Number: 96b4326c-0460-4ebd-8123-67906c3e7393
• Other security certifications: No

Social value

• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at felix.wisby@curshaw.com. Tell them what format you need. It will help if you say what assistive technology you use.