DOCUMATION SOFTWARE LIMITED

Purchase to Pay Automation

Seamlessly integrating with all ERP/Finance Systems, our P2P automation uses AI to ensure purchase requests remain in budget and are coded and approved at PO level. When goods/services are received and receipted, the verified invoice is submitted to the workflow for AI powered processing and posting to the finance system.

Features

• Integrates with all finance systems
• AI enabled fast Document & Data Capture & verification
• Enforced purchasing policies & budget control
• Touchless processing from PO to invoice approval powered by AI
• Built in non PO Invoice approval & exception workflows
• Full visibility of processes and transactions
• Mobile Approver app for on the go approvals
• Full Audit trial
• Comprehensive Controls & built in compliance to business rules
• MS BI reporting tools for realtime reporting

Benefits

• Reduced manual intervention
• Simple purchase process for wider business users
• Lower transactional costs
• Enforced controls & adherence to budget/business rules
• Enables access to early payment discounts & Lower transactional costs
• Power BI analytics supporting continual process improvement
• Inbuilt reporting for HMRC PPR
• Assists with fraud prevention/detection
• Supplier onboarding and verification
• Reduced carbon footprint with removal of paper based processes

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at listeningteam@documation.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

389100035021640

Contact

Listening Team
+44 2380 647776
listeningteam@documation.co.uk

About the service

• Service categories:
  • Application Development and Deployment
    • Analytics and business intelligence
      • Business Intelligence
        • Business Intelligence
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: AP automation, Expenses, E-invoicing, Statement Reconciliation
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: None
• System requirements: N/a

User support

• Email or online ticketing support: Yes
• Support response times: We have an SLA that has the highest ticket status as critical - this is responded to within 1 hour during Standard Support Service which operates 09:00 – 17:00 UK time Monday - Friday (GMT/BST). The standard support service does not cover England public holidays. Extended support hours as an option
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Documation' s comprehensive standard support applies to all of our customers.; Support costs are included in subscription fees and vary depending on the system options chosen.; An account manager is allocated to every customer and our help desk team includes technical managers and support engineers
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Prior to starting use of our service; we consult with the organisation to assess and review their readiness for automation; including areas such as Master Data; approval and delegation of authority rules, best practise opportunities, current barriers to straight through processing.; ; On start of use; key areas such as training sessions including documentation, both online and on-site at organisations preference; mentoring sessions, hypercare on completion of User Acceptance Testing in support of ‘Live’ promotion of service.; ; Each organisation also benefits from a team of Customer Success, Account Manager and regular reviews of automation success with a view of continuing close working relationship to maximise ROI and automation ‘straight through process’ success
• Service documentation: Yes
• Documentation formats: PDF
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: Documation can facilitate documents and data from the solution when the contract ends.
• End-of-contract process: The price of the contract includes the standard off boarding process.; An additional charge is made for transfer of documents and data which depends on the volume and method preferred by the customer.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Mobile application can be used for approvals.
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: "Configurable APIs available as standard containing methods designed to support:; - Submission of documents for processing/storage; - Submission of document index data; - Submission of reference data (used to support processing of documents within solution); - Retrieval of data from solution; - Retrieval of documents from solution"
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: Each customer has a dedicated customer environment which segregates their processing and their data from any other customer and resources are scaled according to the requirements of each customer.

Analytics

• Service usage metrics: Yes
• Metrics types: MS Power BI
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest: Physical access control, complying with another standard
• Data sanitisation process: Yes
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Standard exports are available which allow authorised users to extract documents and data from their solution
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: We have a Hosted infrastructure service level agreement and a Software application service level agreement. Please refer to these for details of guaranteed availability.
• Approach to resilience: Cloud service utilises virtual servers which are hosted in a clustered Cloud platform, which has resilience inbuilt as standard. This includes an automatic failover/node migration mechanism should any physical cluster node fail and/or enter maintenance mode. The platform utilises SAN storage and this storage is distributed in different physical nodes acting as one and separated from computer.
• Outage reporting: Any outage that impact multiple customers, will be communicated to the required customers via email and a notification will be made on the HelpDesk Announcement bar.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Management Access to particular hosted environments requires membership of specific security groups, of which access is provided on an as-needed basis, with approval and review processes in place. Console level access is restricted to authorised IT personnel only
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users receive audit information on a regular basis
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We have a range of policies which have been created and audited in line with ISO27001. These policies include Information Security Manual, Information Security Policy, HR Security Policy, Risk Assessment and Treatment Policy, Acceptable Use Policy, Access Control Policies and Operation Security Policy. Team Members read the policies at onboarding and also review them annually as well. They have to confirm they have read and understood the policies.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We adhere to ISO:27001 Standard. We operate a Configuration Management Database, containing a list of systems and their respective security configurations. Changes made to this, and other aspects of IT operations, are subject to change control, which includes an approval process and audit trail with version history.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We adhere to ISO:27001 Standard. We utilise tools like Microsoft Defender XDR, Tenable Web Application Scanning & Acronis Cyber Protect to detect and remediate vulnerabilities and automate Microsoft and 3rdParty software patching. Available patches are reviewed in our management system, approved on a regular basis and applied at least monthly. Vulnerabilities detected and remediation statuses are reviewed monthly and acted upon in priority order, using CVSS scores and asset criticality measurements ensuring the most critical, actively exploited and easily exploitable vulnerabilities are acted upon first. We subscribe to threat intelligence sources with notifications of active threats & vulnerabilities, including remediations.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We utilise Microsoft Sentinel (SIEM), integrated with Microsoft Defender XDR on all our hosted servers. Incidents and corresponding alerts triggered from the SIEM result in proactive notifications being sent to the IT Team for review. We also utilise PRTG Network Monitor which trigger alerts when unusual activity is detected. Response times are driven by the incident assessment and will be immediate where required.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Post-quantum cryptography secure: No
• Incident management approach: Our Incident Management Process consists of:; Identifying and reporting the incident ; Impact assessment and action planning; Identifying a Root Cause Analysis; Identifying Lessons Learned; Where relevant: ; -BCP Team notification ; -Customer Notification ; -ICO Notification; -Documation Team Notification ; -Business Continuity Phase ; -Recovery and Resumption Phase

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: We offer a FOC POC that is carried out with our Solutions Consultants; We offer a one day proof of concept with our solution consultants; Request for Proof of Concept is made via our website
• Link to free trial: https://www.documation.co.uk/contact-us/

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 5%
• Between £250,000 and £500,000: 8%
• Between £500,001 and £1,000,000: 12%
• Between £1,000,001 and £2,500,000: 20%
• Between £2,500,001 and £5,000,000: 25%
• Over £5,000,001: 35%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: BSI
• ISO/IEC 27001 accreditation date: Monday 15 May 2023
• What the ISO/IEC 27001 doesn’t cover: Documation's ISO27001 certification covers all controls specified by the 2022 standard with the exclusion of A8.30 outsourced development which control is not required as we do not currently have any outsourced development.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: None of the criteria
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: Yes
• Any other security certifications: ISO27001

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering
• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at listeningteam@documation.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.