QES

eVisit

An outdoor educational visit planning and approval software system. Includes our unique one-page visit form, ability to add new fields on the form, integrated with OEAP guidance, flexible approval flow per establishment, parental consent, dynamic risk assessments, real-time reporting dashboards and more.

Features

• One-page visit form, no matter what type of trip/visit
• Ability to add more fields to visit form
• Flexible approval flow on an establishment level
• Integrated with AALA and LOTC certifications for providers and venues
• Unlimited manual data imports, including SEN and pupil premium
• Dynamic risk assessment builder or file upload
• Calendar view to track upcoming trips across individuals or establishments
• Extensive visual reporting dashboards
• Staff and volunteer certifications and qualifications
• Parent/NOK consent feature integrated

Benefits

• Secure and UK GDPR compliant - various security access permissions
• Enhance the efficiencies of visit planning
• Flexible approval flow, allowing different approvals for different visit types
• Future proofed with regular product evolution
• Supported within our customer care team, including training
• Customise visit form by adding extra questions per establishment
• See expiring staff/volunteer qualifications easily
• Full logs to monitor system acitivity
• Newly updated with modern, user-friendly interface
• Available on mobile devices

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at emmamoreton@qes-online.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

282258419429044

Contact

Emma Moreton
07889 435679
emmamoreton@qes-online.com

About your service

• Service categories:

  Application Development and Deployment

  Analytics and business intelligence

  • Business Intelligence
  • Advanced and predictive analytics
  • Location and geospatial data management and analytics
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Uses latest microsoft-support browsers. Requires internet connection.
• System requirements:
  • Internet connection
  • Latest microsoft-supported browsers

User support

• Email or online ticketing support: Yes
• Support response times: Same day
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: A Customer Success Manager is appointed to your principle point of contact, along with access the Customer Success Service Desk to raise questions or issues. They will provide support, including initial administrative training, hosting, maintenance and support. All support is done remotely, unless on-site chargeable support is required.; Support is available Mon-Fri 9:00-17:00 excluding bank holidays.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Virtual training to adminstrative users, along with user guidance documents.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: The extract report within the system allows users to extract their data during and after the contract duration.
• End-of-contract process: At contract end, QES will ensure the safe return of customer data and removing their system. Backups will be retained a 30 day period, at which point a full decommissioning of the service will take place, with all databases deleted, including backups.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: No difference, apart from styling to fit device's smaller screen.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Web-based application
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: The system has a user-friendly interface to navigate across, so multi-agency users can access the relevant data and reporting.; QES are compliant to WCAG 2.2 AA standards, using SonarQube to conduct automated checks and flag any non-compliance to developers to rectify. QES use the Chrome plugins: WCAG colour contract checker and wave evaluation tool. QES also use Google Chrome Lighthouse which has an accessibility review tool.
• API: No
• Customisation available: Yes
• Description of customisation: QES can add additional fields into the visit planning form per establishment, customise email content and customer logos, along with the approval flow per trip type and establishment. Further customisations are available but may incur additional fee.

Scaling

• Independence of resources: Each customer’s data is stored in a completely separate, dedicated SQL database with strict access controls, meaning data is logically isolated and cannot be seen, accessed, or affected by any other client.

Analytics

• Service usage metrics: Yes
• Metrics types: Real-time reports available on series of fields from the notification form within the system, including pie charts, bar charts, heat maps, statistic tiles, etc. All available in real-time with filters and ability to extract.; Usage metrics can also be provided on request via email if needed in addition to audit reports embedded within the system to admins.
• Reporting types:
  • Real-time dashboards
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: Physical access control - NCSC access control
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Using the data extract system within the system, allowing users to extract all data.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: QES have an uptime of 99.99% with the exception of planned maintenance. RPO - service would be reinstated to within 5 minutes of when the event occurred. RTO - return to service time will be <1 hour. Planned outages are completed outside of business hours, and completed within 5 minutes of downtime.
• Approach to resilience: QES use Microsoft Azure data centre, with the primary data centre in Cardiff, Wales and secondary site in London, England. All data remains in the UK. QES use Microsoft Azure's highly secure data centre protocols which can be found on their website or can be sent by us on request.
• Outage reporting: Email alerts will be provided by the customer care team.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: The application has a role based security model where by only users assigned management roles will be able to access management interfaces.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Our information security policies are externally audited during our ISO 27001 annual audits. QES also regularly review these internally during management reviews. The DPO is responsible for the maintenance of the security policy, who reports to the COO and then to the MD. All 3 staff members meet regularly throughout the year to ensure these policies are followed, assigning actions, and monitoring actions to track progress and completion where needed. Our policies are also compliant with UK GDPR, Cyber Essentials, and CE+ standards.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: We have a change management team who review all change requests raised by our user group, and schedule them into a product evolution sprint. All changes are subject to a series of automated test controls (SonarQube static application security testing), build validation, release validation, unit tests requiring 100% pass rate, open source library versions, open source library vulnerabilities, open source library licenses and manual test controls including code review, quality assurance review and project management review.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: QES use a 3rd party testing company to annually assess the vulnerability of our solutions. All issues are resolved within 1 month of being raised and the application is re-tested with a pass in the same period. We also use SonarQube in our automated DevOps pipeline to scan for vulnerabilities within our code every time we make a change using OWASPs top 10 vulnerabilities.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Microsoft defender for cloud provides threat detection and prevention across the application. QES are notified through the Azure defender portal as well as email and teams alerts. We deploy patches to medium-critical issues within 24 hours and agree a schedule of works for the others.
• Incident management type: Supplier-defined controls
• Incident management approach: Users will raise system issues through the QES customer care team and their appointed account manager, via email or phone call. The issues will be fixed within the SLA, testing with our QA team and released back to the client's environment with release notes. We complete root cause analysis reviews to assess common events, and update the systems back with any fixes to known common events across multiple systems.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Assessment Bureau
• ISO/IEC 27001 accreditation date: Tuesday 8 July 2025
• What the ISO/IEC 27001 doesn’t cover: The certification covers all operations, assets and personnel involved in the delivery and management of our product services. No controls relevant to the delivery of this service have been excluded. Exclusions are limited strictly to controls deemed non-applicable by our Statement of Applicability (e.g. physical security of data centres managed by Microsoft Azure).
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: British Assessment Bureau
• ISO 9001 accreditation date: Tuesday 8 July 2025
• What the ISO 9001 doesn’t cover: The ISO 9001:2015 certification covers all processes and operations related to the design, delivery and operations related to our products. There are no exemptions within the defined scope. Any requirements of the standard deemed not applicable (such as Clause 7.1.5 if monitoring/measuring equipment is not used) are justified within our Quality Manual and do not affect our ability to ensure product/service conformity.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Ab2a5f87-d68e-4c58-bf63-9f34f2104902
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at emmamoreton@qes-online.com. Tell them what format you need. It will help if you say what assistive technology you use.