OPSPAL LTD

Digital operations software

OpsPal is a smart, cloud-based solution that digitises and manages a business's operational ecosystem. It centralises risk assessments, compliance checks, procedures, and training logs, providing real-time visibility through fully mobile responsive internet-connected devices. Built for frontline teams, it drives operational excellence, accountability, and consistent standards across multi-site businesses.

Features

• Unlimited user licencing
• Scalable from single site to enterprise deployment
• Real-time RAG dashboards
• 24/7 mobile access
• Manages risk assessments; tracks staff acknowledgement and understanding
• Digital policies; single version control, always accessible
• Centralised tracking and scheduling of all compliance tasks
• Live staff competency, qualification, and expiry tracking
• Problem logging with photos, location; tracks through to resolution
• Full audit log tracking of user activity; filterable\ exportable

Benefits

• Access from any device; Apple, Windows, Android
• Instant compliance tracking at organisation, site, team, individual levels
• Full digital audit trail
• Reduces task followup time; nothing gets forgotten\ missed
• Prevents key staff certifications from accidently expiring
• Centralised single version document control
• Full visualisation of problems, followup actions, individual and team accountability
• Eliminates paper, reducing administration and manual errors
• Easy to deploy and scale across multi-site operations
• Tracks staff understanding, reducing exposure to legal risk

• Education pricing available
• Free trial available

Service documents

• Pricing document

  ODT

• Service definition document

  ODT

• Terms and conditions

  ODT

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at contact@opspal.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

297915914251692

Contact

Craig Campbell
07398894678
contact@opspal.com

About the service

• Service categories:
  • Applications
    • Production and operations
      • Service industry and public sector operations
        • Other
      • Other operations
        • Other operations
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: OpsPal's service does not have any constraints. The application and its support service are accessible 24/7. OpsPal provides in-app support where users can log a ticket, view support articles, and receive updates. Any planned maintenance is performed outside normal working hours, and advance notification is provided to customers to minimise, if not eliminate, any impact on their business service.
• System requirements:
  • Internet connection for real-time connectivity required
  • Compatible with browsers Chrome, Edge and Safari
  • Mobile responsive on Apple, Windows and Android devices
  • Works on mobiles, tablets, laptops, desktop pcs

User support

• Email or online ticketing support: Yes
• Support response times: OpsPal aim to reply to support tickets within 2 hours. Users can submit a support ticket 24/7.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), 7 days a week
• Web chat support: No
• Onsite support: No
• Support levels: OpsPal does not provide tiered support levels. All customers have access 24/7 to log a support ticket through the in-app platform, which comes into our centrally managed support desk. A support operative will review the support ticket and either advise and respond to the query with an immediate solution or learning resource from our Knowledge Hub or offer a Teams meeting for further investigation or escalate the ticket to a different department depending on the nature of the ticket query.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: All new users complete a digital onboarding form with their site names and main contact details. This information is used to create their OpsPal site. Users will then book in for an onboarding meeting with their account manager. The account manager will provide an overview of the customer journey and implementation process, where training is delivered in short, topic-specific online sessions, followed up by optional check-in sessions. OpsPal provides a full in-app Knowledge Hub resource for users with product-related queries and the ability for users to raise support tickets within this area too.
• Service documentation: Yes
• Documentation formats: HTML
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: At the end of contract, a customer can export all of their documentation configuration data and all application log files to pdf files for historical reference purposes or to use in the configuration of a new application.
• End-of-contract process: The annual, automatically renewable license subscription to the OpsPal application is a comprehensive package covering all your sites with unlimited user access. ; This subscription price includes:; Application Access: Full use of the OpsPal application.; Technical Support: Unlimited, 24/7 access to the dedicated support team.; Knowledge Base: Access to the in-app Knowledge Hub and Support area, featuring support videos and articles, alongside the ability to raise support tickets.; Maintenance: All necessary application bug fixes and minor enhancements.; Account Management: Invitations to ongoing biannual business review meetings with your account manager after the initial implementation.; Community: Entitlement to join the User Community groups, which host regular online webinars led by existing clients sharing best practice.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: There are no differences between the mobile and desktop service, as OpsPal is fully mobile responsive on any internet-connected device.
• Service interface: Yes
• Description of service interface: Users log in to OpsPal through a dedicated login page, accessible from a browser using a registered email address and password.
• Accessibility standards: None or don’t know
• Description of accessibility: OpsPal prioritises operational safety over achieving full WCAG compliance, as 40% of its functions rely on safety-critical visual indicators (like the red/amber/green status system). Instead, OpsPal uses a browser-based accessibility approach, providing inclusive access through user-selected, proven assistive technologies. This includes full support for browser features (Chrome/Edge high contrast, keyboard navigation, zoom up to 500%) and the Eye-Able extension for screen reader optimisation and colour correction. This method maintains all critical safety functions without compromise.
• Accessibility testing: None
• User support accessibility: WCAG 2.2 AA
• API: No
• Customisation available: No

Scaling

• Independence of resources: OpsPal maintains performance using resilient AWS architecture: Horizontal Autoscaling automatically scales EC2 capacity to distribute fluctuating user workload. The Application Load Balancer (ALB) directs incoming traffic using a round-robin strategy across healthy instances. Multi-Availability Zones and automated failover ensure reliability and continuity. Furthermore, CloudWatch and New Relic provide constant monitoring and performance alarms to proactively address anomalies or traffic spikes

Analytics

• Service usage metrics: Yes
• Metrics types: OpsPal provides a real-time view of service usage metrics across the entire organisation with grouped views at the organisation level (includes all sites), at the individual site level and associated teams, and at the individual user level. Historical activity service usage metrics can be sent automatically via email to admin users for either the last 7-day or 30-day period.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: In-house
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Data Erasure
• Equipment disposal approach: In-house destruction process

Data importing and exporting

• Data export approach: Users can export their app configuration to pdf files. All historical audit log files for each of the apps covering the entire contract duration period can be exported to pdf files by the user.
• Data export formats: Other
• Other data export formats: PDF
• Data import formats: Other
• Other data import formats:
  • PDF
  • DOCX

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: OpsPal delivers high availability and performance by hosting exclusively in AWS London data centres across Multi-Availability Zones. We utilise Horizontal Autoscaling and Application Load Balancing to dynamically manage and distribute user demand, ensuring service continuity. Automated failover limits downtime and data loss to milliseconds during technical failures.; Data in transit is protected by TLS (v1.2 or above) encryption, applied at the ALB and internally for services like RDS and S3. Data at rest is comprehensively protected via KMS, SSE-KMS, and EBS encryption. The hosting environment complies with recognised standards such as FIPS-142 accreditation.; Security controls are continually monitored (CloudWatch, New Relic), and resilience is validated through monthly BCP system testing. Data sanitisation is handled through strict retention schedules and mechanisms for secure erasure and deletion, adhering to UK GDPR requirements like the Right to Erasure.
• Approach to resilience: OpsPal is architected within the AWS Cloud to ensure high availability and minimal disruption. The system is hosted across two AWS London data centres, leveraging Multi-Availability Zones (AZs), which are distinct physical locations isolated from failures in other zones. All databases and objects are stored across these two AZs.; Resilience is primarily achieved through:; 1. Automated Failover: An automatic failover system detects primary server failures (hardware, software, or network issues) and initiates a seamless switch to a backup server without human intervention. In a technical failure or natural disaster, OpsPal automatically switches zones, limiting downtime and data loss to milliseconds. For the database (Amazon RDS), automatic failover to a standby instance typically takes 60–120 seconds.; 2. Backup and Durability: Client objects are stored in Amazon S3, offering 11 nines of durability. A 24-hour snapshot of all data and objects is maintained, stored in replica across the two availability zones.; 3. Continuous Validation: OpsPal's Business Continuity Plan (BCP) system testing occurs monthly, featuring an automated changeover to different data centres, with full monitoring tracked via New Relic and reviewed by the development team.; This infrastructure ensures service continuity and protects data integrity at all times
• Outage reporting: We utilise CloudWatch and New Relic to continually monitor our applications, providing consistent monitoring, notifications, and alarms for critical errors or unusual activity.; In the event of an OpsPal system failure:; 1. The development team is immediately notified via the New Relic system.; 2. Automated Business Continuity Plans (BCPs) are activated immediately for continuation of system operation if the failure is linked to AWS.; 3. The OpsPal login page banner is immediately updated to advise of the system failure.; 4. Customer Organisation Admin users receive email notification if the failure results in a loss of access.; 5. Regular updates are sent to customers until the full OpsPal system is restored.; 6. OpsPal internal staff are automatically advised of the system outage through internal systems.; This integrated monitoring and notification system guarantees rapid response and clear communication during service disruptions.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: OpsPal employs three rigid access levels: Organisation Admin (super-user control across all sites), Site Admin (full administrative rights limited to specific sites), and User (day-to-day operational access like completing tasks and adding problems). Access is strictly restricted via role-based access controls (RBAC), explicitly Denying Site Admins and Users from high-level functions like Org manage. Furthermore, granular control means editing critical documents often requires the user to be the designated Owner
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: OpsPal's governance complies with the BS EN ISO 9001 Quality Management System standard. It also adheres to strict legal frameworks, including the UK GDPR and Data Protection Act 2018. Our infrastructure is housed on AWS servers, which are FIPS-142 accredited.
• Information security policies and processes: OpsPal's information security governance is founded on compliance with the UK GDPR and the Data Protection Act 2018.; Key policies and processes include:; • Incident Management: We maintain an Information Security Incident Management Policy, requiring all actual or suspected security incidents to be reported immediately to the Chief Developer for assessment and response. If personal data is involved, the Information Security Officer is informed. Post-incident reviews are conducted regularly.; • Data Handling and Confidentiality: Strict Confidentiality Policies prohibit employees from disclosing trade secrets or client information. We adhere to the six principles of data protection, ensuring data is processed securely and protected by technical and organisational measures, including strong access controls and regular security assessments.; • Access Controls (Organisational): All employees must adhere to a Screen Lock Policy, ensuring systems lock automatically after 60 seconds of inactivity and are never left logged on unattended. Accessing another employee's records without authority is treated as gross misconduct.; • Training and Compliance: All employees receive continuous training and updates on data protection responsibilities and secure processing practices.; • Resilience Testing: OpsPal's Business Continuity Plan includes monthly automated testing involving data centre changeovers, with full monitoring tracked via New Relic

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: OpsPal implements configuration and change management using supplier-defined controls and a system compliant with BS EN ISO 9001. Our design principle is to make frequent, small, reversible changes.; Component lifetime and performance are tracked via CloudWatch and New Relic, ensuring continuous monitoring and identification of changes in peripheral systems. All changes undergo testing and code quality review during development.; Security impact is managed proactively: configuration access uses IAM policies, network traffic is controlled by Security Groups and ACLs, and changes are validated before deployment to ensure they meet security standards. Data remains encrypted at rest/ in transit using latest certificates.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: OpsPal primarily uses supplier-defined controls for vulnerability management. We continuously monitor applications using CloudWatch and New Relic to detect potential security threats and unusual activity. Critical errors or issues identified through monitoring and regular security assessments and testing are immediately logged.; Threat information is gathered through internal testing and user feedback via the support system. Critical fixes and updates (bug fixes) are addressed immediately, while other improvements are scheduled into regular development sprints. Our deployment principle involves making frequent, small, reversible changes ("operations as code") to fine-tune our offerings, which inherently aids quick patch deployment and reduces risk
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: OpsPal employs continuous protective monitoring using CloudWatch and New Relic to log application activity, network traffic, and critical errors, alongside regular security assessments.; If a potential compromise is detected, staff must immediately report the security incident to the Chief Developer. The response process focuses on containing the breach, assessing adverse consequences for individuals, and limiting the scope of the issue.; Automated Business Continuity Plans (BCPs) activate immediately upon system failure, limiting downtime and data loss to milliseconds. Support aims to resolve reported issues within 48 hours
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Post-quantum cryptography secure: No
• Incident management approach: OpsPal uses supplier-defined controls including the Information Security Incident Management Policy. Incidents are pre-classified (High/Medium/Low Criticality) and assessed by the Chief Developer. Users report suspected incidents immediately to the Chief Developer. Critical fixes are addressed immediately. For total system failures resulting in access loss, affected Customer Organisation Admin users receive email notification and regular updates. Post-incident reviews track incident patterns to drive continuous learning

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: OpsPal offers prospective users the ability to trial the service via registering for a demo service area for a limited time period.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 10%
• Between £250,000 and £500,000: 15%
• Between £500,001 and £1,000,000: 20%
• Between £1,000,001 and £2,500,000: 20%
• Between £2,500,001 and £5,000,000: 20%
• Over £5,000,001: 20%

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
  • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

  • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
  • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
  • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)
• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
  • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

  • Understanding of the issues affecting the development of new skills by target cohort
  • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
  • Understanding of issues relating to entering the contract workforce
• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
  • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  ODT

• Service definition document

  ODT

• Terms and conditions

  ODT

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at contact@opspal.com. Tell them what format you need. It will help if you say what assistive technology you use.