XCD HR and Payroll Solution
XCD is a full suite of cloud HCM solutions, delivered as a single-solution from one database to provide full employee relationship management. Functionality includes Gross & Net (UK) Payroll, Time Management, Expenses/Compensation/Reward, Learning/Performance/Appraisals, Recruitment, and associated functions (Workflow, Reporting, BI, Automation, Document management, mobile) for HR Professionals, Managers and Employees.
Features
- Single-solution HR and Payroll suite delivering complete Employee Relationship Management
- Built on world-class Salesforce Lightning platform
- Full UK net payroll for public sector and mid enterprise
- Full support for single sign on (SSO)
- Accessible through desktop browser or mobile
- ATS integration through sister product and leading ATS, Hireserve
- ERP integration for Finance, PSA, time clocking, biometrics and more
- Full suite covering full employee lifecycle (recruit to retire)
- Role based access for all employees
- Rapid onboarding and implementation (90% faster than some competitor platforms)
Benefits
- Single solution provides seamless collaboration across all functions
- Data automation has saved customers 1000’s of hours per year
- Global analytics dashboards allow HR function to provide strategic support
- Powerful reporting using standard Salesforce technology
- No re-keying of data required between HR and Payroll
- Update personal data anywhere, any time using the mobile app
- Modules configurable to meet organisational requirements and enable process automation
- Manage complex and different contract terms and working hours
- Continual service improvement underpinned by Salesforce development and innovation roadmap
- Native Salesforce cloud app allowing anytime, anywhere access
Pricing
- Education pricing available
- Free trial available
Service documents
Request an accessible format
Framework
G-Cloud 15
Service ID
4 4 8 7 4 4 9 3 2 8 4 0 8 9 2
Contact
XCD HR LIMITED
Andrew Bray
Telephone: 07503 629249
Email: andy.bray@peoplexcd.com
About your service
- Service categories
-
Applications
Enterprise resource management
- Payroll management
Human capital management
- Core Human Resources Applications
- Talent Management Applications
- Multi cloud support
- No
Service scope
- Software add-on or extension
- Yes, but can also be used as a standalone service
- What software services is the service an extension to
- XCD Employee Relationship Management (ERM) Suite is built on the Salesforce platform. It can be run a standalone solution leveraging the Salesforce Lightning platform. As a further benefit for organisations running Salesforce.com, XCD is also compatible with existing Salesforce Customer Relationship Management, Professional Services Automation and associated applications.
- Cloud deployment model
- Public cloud
- Service constraints
-
Planned maintenance will be undertaken in line with the Salesforce maintenance schedule and policy but with negligible impact to system availability or SLA performance. This includes major releases, patch releases, and daily releases.
To provide prior notice and details of any maintenance, Salesforce provides a published site maintenance calendar supplemented with email notifications and in-app notifications. Further details can be provided on request. - System requirements
-
- Browser compatibility (Google Chrome or Microsoft Edge reccomended)
- An Octane score of 20,000 (30,000 recommended)
- Network latency of 200 ms or lower (150 ms recommended)
- Download speed of 1 Mbps (3mps recommended)
- At least 5GB RAM, 2GB available for browser tabs
- 8GB Ram, 3GB available for browser tabs recommended
User support
- Email or online ticketing support
- Yes
- Support response times
-
Support hours are UK Monday to Friday 09:00 to 17:30
Excludes Public Holidays.
Resolution times as follows:
Emergency: 24 Hours
Critical: 48 Hours
Normal: 5 Business days - Workaround (if available) or considered for future release.
Evidencing the quality of our support, our "fix at first touch" rate is 54%, where we have provided an immediate resolution to any query. - User can manage status and priority of support tickets
- Yes
- Online ticketing support accessibility
- EN 301 549
- Phone support
- Yes
- Phone support availability
- 9 to 5 (UK time), Monday to Friday
- Web chat support
- No
- Onsite support
- Yes, at extra cost
- Support levels
-
All customers receive access to our Support Team for software issues and queries as well as a Customer Portal and case management. XCD provide the following levels of support:
Standard Support (included in software fee).
Premium Support - As per standard but with enhanced access to CSM, additional support through additional training, 3rd line support access, health checks and quarterly support review sessions (additional cost per annum - dependent on employee numbers and payrolls).
Platinum Support - As per premium but with further features including additional access to CSM, training, access to all LMS modules and monthly support review sessions (additional cost per annum - dependent on employee numbers and payrolls). - Support available to third parties
- Yes
Onboarding and offboarding
- Getting started
-
Throughout the sales cycle, we will allocate you a dedicated Business Development Manager who will get to know your teams, your processes and your strategies. They will work with the professional services team to scope the project requirements. Upon commencement of the project, our Sales and Professional Services teams will arrange a formal kick off meeting with you to ensure continuity as we move into the implementation phase.
We will walk through the outline project plan, methodology, RACI, governance and communication and outline the steps for the implementation which follow our methodology of:
1) Design
2) Configure
3) Quality Assure
4) Data Migration
5) Systems Handover and training
6) User Acceptance Testing
7) Go-live Readiness
8) Go-live Support and Handover - Service documentation
- Yes
- Documentation formats
-
- HTML
- ODF
- End-of-contract data extraction
-
When a contract comes to an end, we will work with customers to assist them extracting any or all of their data from the XCD system in a quick, seamless and secure manner.
This will take the form of consultancy to advise customers in what tools are available to export data OR to actually extract the data on behalf of the customer. Customers will have the ability to export their data directly without support or advice using the standard Salesforce tools.
In line with the rates indicated in our pricing document, this is a chargeable consulting activity which would be scoped and estimated on an individual customer basis. This cost is not included in the ongoing cost of the contract with XCD. - End-of-contract process
-
If a customer issues XCD with notice that they wish to terminate the contract, we will arrange for a conference call with the customer and appoint a dedicated XCD Project Manager to work with the customers Project Manager to facilitate a smooth off-boarding process.
The Project Managers will discuss timelines for items such as "Last Transaction Date" and "Data Export Options". We will then create a Project Plan or set of agreed activities and assign resources to carry out the activities from both XCD and the customer's perspective.
Following contract termination data is retained for 30 days then permanently deleted from the platform. - Documentation accessibility standard
- EN 301 549
Using the service
- Web browser interface
- Yes
- Supported browsers
-
- Microsoft Edge
- Firefox
- Chrome
- Safari
- Opera
- Other
- Application to install
- Yes
- Compatible operating systems
-
- Android
- IOS
- Designed for use on mobile devices
- Yes
- Differences between the mobile and desktop service
-
XCD's mobile app is tailored specifically for mobile phones, and allows users to easily manage tasks including expenses, leave, authorisations and approvals, and view payslips.
In addition to this, the entire XCD application can be accessed via a tablet through the browser interface. - Service interface
- Yes
- User support accessibility
- EN 301 549
- Description of service interface
-
XCD has multiple methods for integrating to and from the application:
1) CSV/Flat Files - Predominantly used for data import or integrating external systems where real time interfaces are not required.
2) Reporting Outputs - Typically used where users wish to inspect the data prior to import to another system, for example General Ledger (GL) reporting to Finance.
3) Pseudo Real Time Rest API - Used for integration where Employee, Work Patterns, Leave and associated holiday data is required. - Accessibility standards
- None or don’t know
- Description of accessibility
-
Access through either:
Native files (for example CSV)
As a report output
Rest API with JSON through a third party integration tool such as Mulesoft
Accessibility testing - Accessibility testing
- XCD's service interface is data only and used for integration into applications. Therefore we have not tested with assistive technology.
- API
- Yes
- What users can and can't do using the API
-
The API is delivered as an extension package associated with the XCD core package.
The API is REST utilising JSON to deliver its payload.
The API covers standard functions in the XCD application relating to:
- Leave
- Payroll
- Overtime payments
- Expenses
- Timesheets
- Performance management
Users can call the API to request any information from the XCD application, or insert data into the XCD application. - API documentation
- Yes
- API documentation formats
- API sandbox or test environment
- Yes
- Customisation available
- Yes
- Description of customisation
-
The XCD suite of solutions is highly customisable as it is built on the Salesforce Lightning platform.
System Administrators can customise the solution in the following ways:
-Objects and Fields
-New Screens (modify existing or build new)
-Workflows and Processes Reports
-Analytics and BI Process Builders Users
-Roles and Access.
Much of this customisation can be done by users through simple drag and drop functionality to create lightning components which help to automate HR processes.
Scaling
- Independence of resources
-
Scalability is ensured through use of Salesforce infrastructure which handles a daily average of 6 billion transactions. Despite this, the Salesforce environment consistently maintains sub-250ms response time.
Within each logical system, we use load balancers to distribute demand among multiple web and application servers for additional scalability and redundancy. The multi-tenant application design, combined with the fastest servers and high-performance networking infrastructure available, guarantees capacity.
In addition to scaling for growth, Salesforce continually strives to improve the response time for our services. To reinforce our claims, transaction volumes and response times are reported in real-time via Salesforce's Trust Status portal.
Analytics
- Service usage metrics
- Yes
- Metrics types
-
He service includes various metrics to monitor usage and adoption of the service. For example, to identify user behaviour, this includes last login and login duration.
Provides performance and availability information for the entire service, the infrastructure detail metrics are available on the Salesforce Trust platform.
For specific metric monitoring and further detail, customers can extend capability through the use of Event Monitoring. For example: Which applications are being used, by who, how they are being used, when, where from and whether there are performance issues. This data can be used to improve adoption, security and performance of the application. - Reporting types
-
- API access
- Real-time dashboards
- Regular reports
- Reports on request
- Resource tagging
- Yes
- FOCUS resource tagging
- No
Resellers
- Supplier type
- Not a reseller
Staff security
- Staff security clearance
- Other security clearance
- Government security clearance
- Baseline Personnel Security Standard (BPSS)
Asset protection
- Knowledge of data storage and processing locations
- Yes
- Data storage and processing locations
-
- United Kingdom
- European Economic Area (EEA)
- Other locations
- User control over data storage and processing locations
- Yes
- Datacentre security standards
- Complies with a recognised standard (for example CSA CCM version 4.0)
- Penetration testing frequency
- At least every 6 months
- Penetration testing approach
- ‘IT Health Check’ performed by a CHECK service provider
- Protecting data at rest
-
- Physical access control, complying with CSA CCM v4.0
- Scale, obfuscating techniques, or data storage sharding
- Other
- Other data at rest protection approach
-
Classic Encryption: We supply the native Salesforce application feature which can be used to encrypt specific custom fields with 128-bit master keys and using the Advanced Encryption Standard algorithm. This has no additional cost but does impact some application functionality.
Platform Encryption: Platform Encryption allows customers to encrypt data stored through Salesforce such as files and attachments, certain standard and custom fields, and use an advanced key management system. It uses native strong, standards-based encryption. Controls help to protect data, including the use of derived data encryption keys and customer-controlled key rotation, generation, and destruction process. Available at additional cost. - Data sanitisation process
- Yes
- Equipment disposal approach
- Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
- Data sanitisation type
- Deleted data can’t be directly accessed / Cryptographic Erasure
Data importing and exporting
- Data export approach
- Users can export their data using the standard Salesforce tools or can request that XCD extract the data on their behalf.
- Data export formats
- CSV
- Data import formats
- CSV
Data-in-transit protection
- Data protection between buyer and supplier networks
-
- Private network or public sector network
- TLS (version 1.2 or above)
- Other
- Other protection between networks
-
By default, customers connect to the service over the public internet with all transmissions between the user and the Salesforce Services secured using TLS 1.2 or higher and encrypted using 256 or 128-bit encryption.
The services use International/Global Step Up SSL certificates with 2048-bit Public Keys. Web Service callouts can be secured using TLS, as well as with 2-way TLS.
In addition, customers can partner with a selection of supported ISPs for a more direct connection to the Salesforce service. In the UK, BT are one such ISP. This service is known as Salesforce Express Connect. - Data protection within supplier network
-
- IPsec or TLS VPN gateway
- Other
- Other protection within supplier network
-
Customer data is protected within the Salesforce service through a mature, standards-based defence in-depth security architecture.
Logical and physical access is strictly controlled and monitored. The controls used are in-scope for our various security certifications (and those commonly required by our clients) and audited regularly by third parties.
Controls such as firewalls, intrusion detection, anti-malware, file integrity monitoring are augmented with extensive monitoring to provide robust prevention, detection and response. The service is subject to internal, external and third-party vulnerability scanning and application penetration testing.
Availability and resilience
- Guaranteed availability
-
Being based on Salesforce Services, our platform is inherently designed with the concept of continuous improvement and Trust (such as Availability, Performance and Security) in the infrastructure. Our use of Salesforce ensures we benefit from their investments to make on-demand services available to its customers 24/7, except for (minimal) planned downtime, for which Salesforce gives customers prior notice, and force majeure events.
Excellent availability statistics (historically 99.9%) are critical to Salesforce's customers’ success and to the performance of Salesforce as a leading global cloud-based software provider. Live and historical statistics on Salesforce system performance are publicly shared on the Trust and further detail can be shared upon request and signature of an NDA. - Approach to resilience
-
To maximise availability, the service is delivered using a world-class data centre infrastructure consisting of a primary production data centre, a full capacity secondary data centre for hosting the service provided to customers.
The infrastructure utilises carrier-class components designed to support millions of users. Extensive use of high availability servers and network technologies, and a carrier-neutral network strategy, help to minimise the risk of single points of failure. This also provides a highly resilient environment with maximum uptime and performance.
Further details available on request. - Outage reporting
-
Our service provides access to live and real-time outages information via public portal and via email alerts, using Salesforce's Trust Status site.
With the goal of rapidly restoring services during any outages, we utilise Salesforce's Escalation policies which are established and maintained. In the event of an extended outage, periodic updates are provided in near real-time to customers via the Trust dashboard site. In addition, service notifications are provided to nominated contacts via various channels such as email.
Update frequency for notifications is dependent on the customer support service plan selected by our customer (as detailed in our pricing).
Identity and authentication
- User authentication needed
- Yes
- User authentication
-
- Multi-Factor Authentication (MFA)
- Identity federation with existing provider (for example Google Apps)
- Username or password
- Other
- Other user authentication
-
Using the base application of Salesforce, we can offer a comprehensive range of authentication mechanisms that customers can choose from. These include:
-The inherent username and password option
-Single Sign-On (SSO)
-Social Sign-On through another application, such as google
-Integration with a customer's existing identity management systems
-2-Factor Authentication
The application can also act as a Service Provider or Identity Provider for SSO integration using Security Assertion Markup Language (SAML). - Access restrictions in management interfaces and support channels
-
Management access for service support and delivery is offered through multiple layers of controls including, but not limited to:
-Multiple 2 factor authentication
-Bastion host and proxy control
-Segregation of duties
These controls are in scope for SSAE-18 auditing and evidences through the SOC 2/ISAE3402 report.
Access to the management interface for the customer to configure their salesforce environment is configured by the customer themselves. The options are outlined in the above response. Robust application design and testing ensures that users without administrative access rights cannot access more sensitive areas of the application. - Access restriction testing frequency
- At least every 6 months
- Management access authentication
-
- Multi-Factor Authentication (MFA)
- Public key authentication (including by TLS client certificate)
- Identity federation with existing provider (for example Google Apps)
- Dedicated link (for example VPN)
- Username or password
- Other
- Description of management access authentication
-
We can offer customers a comprehensive set of authentication mechanisms.
These include:
-The inherent username and password option
-Single Sign-On (SSO)
-Social Sign-On through another application, such as google
-Integration with a customer's existing identity management systems
-2 Factor Authentication
The application can also act as a Service Provider or Identity Provider for SSO integration using Security Assertion Markup Language (SAML).
Audit information for users
- Access to user activity audit information
- Users have access to real-time audit information
- How long user audit data is stored for
- User-defined
- Access to supplier activity audit information
- Users have access to real-time audit information
- How long supplier audit data is stored for
- At least 12 months
- How long system logs are stored for
- At least 12 months
Security governance
- Named board-level person responsible for service security
- Yes
- Security governance certified
- Yes
- Security governance standards
- ISO/IEC 27001
- Information security policies and processes
-
We have a robust information security policy and set of defined processes which are externally audited.
These include:
-All locations protected against cyber attack through physical and internet access controls.
-Secure by design hardware and infrastructure with up to date patching policies.
-Defined policies for the storage and retention of sensitive and PII data Incident and breach management process.
-Training and Awareness for all staff and customers.
Evidencing the robustness of our policies which are externally audited, we annually maintain our Cyber Essentials and ISO27001 certifications. - Software Security Code of Practice
- Yes
Operational security
- Configuration and change management standard
- Supplier-defined controls
- Configuration and change management approach
-
Nfrastructure and Policy change management is undertaken by our Executive Team. Development change management is covered in our Software Development Lifecycle and enacted through specification, tooling and release management processes.
The client environment uses a change management object where changes to the organisation are recorded and agreed with the client. To assess security impacts, we have tooling to audit changes to the environment on request or prior to release.
For client issues and requests, we use Case Management where each request is stored, communicated and documented. Our Project Manager will oversee Change Management implementation by maintaining a project log. - Vulnerability management type
- Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
- Vulnerability management approach
-
Through Salesforce, our service deploys various vulnerability management and threat detection processes including internal scanning, external scanning and vendor patch release management.
Technical operations and security personnel monitor vulnerability alerts and patch release notifications from vendors and other sources. There are associated evaluation and deployment processes in place. Salesforce also regularly performs self-vulnerability assessments using various tools and techniques, such as Qualys.
In addition, Salesforce uses external service providers to perform an application vulnerability assessment after each major release (3 times annually) and network vulnerability assessments quarterly. There is also an on-going external application scanning service used. - Protective monitoring type
- Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
- Protective monitoring approach
-
Our service benefits from Salesforce's Computer Security Incident Response Team (CSIRT)'s security event logging and management system to manage the alerts and logs generated by devices on our network and provide protective monitoring. The system consists of a central database, management server and distributed agents.
The distributed agents receive events from network devices and systems (firewalls, IDS, routers, switches, hosts, file integrity, and database monitoring) on the network, then compress, encrypt, and transmit the data to the management server and database for processing. Correlated events are configured to generate alerts and logs which are monitored on a 24/7 basis. - Incident management type
- Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
- Incident management approach
-
We utilise Salesforce's formal Incident Management Process which guides the Salesforce Computer Security Incident Response Team in investigation, management, communication, and resolution activities.
Salesforce will promptly notify the customer in the event of any security breach of the Service resulting in an actual or reasonably suspected unauthorised disclosure of Customer Data. Notification may include phone contact by Salesforce support, email to customer's administrator and Security Contact and public posting on the Trust portal.
Salesforce.com is a member of the prestigious Forum of Incident Response and Security Teams (FIRST) and complies with the FIRST framework and best practices for incident response. - Post-quantum cryptography secure
- Yes
Secure development
- Approach to secure software development best practice
- Supplier-defined process
Public sector networks
- Connection to public sector networks
- No
Pricing
- Discount for educational organisations
- Yes
- Free trial available
- Yes
- Description of free trial
- On request, we offer a free 30-day access to a demo environment.
Discount percentage by annual call-off contract value (excluding VAT)
- Less than £250,000
- 0%
- Between £250,000 and £500,000
- 0%
- Between £500,001 and £1,000,000
- 0%
- Between £1,000,001 and £2,500,000
- 0%
- Between £2,500,001 and £5,000,000
- 0%
- Over £5,000,001
- 0%
Non-mandatory Standards and certifications
- ISO/IEC 27001 certification
- Yes
- Who accredited the ISO/IEC 27001
- Alcumus ISOQAR
- ISO/IEC 27001 accreditation date
- Thursday 1 May 2025
- What the ISO/IEC 27001 doesn’t cover
- Nothing not covered by certification.
- ISO 28000:2022 certification
- No
- ISO 9001 certification
- No
- Quality management systems (QMS)
- Yes
- CSA STAR certification
- No
- PCI certification
- No
- Cyber essentials
- Yes
- Please provide your Cyber Essentials Certificate Number
- B974819e-187e-4c4a-ab11-b7ab40505052
- Cyber essentials plus
- No
- Cyber Essentials Alternative
- None of the criteria
- Other security certifications
- No
Social value
- Section B - Commitment for Future: Delivery
-
-
Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.
Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority
- New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
- Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
- Plans to engage the contract workforce in deciding the most important workplace issues to address
- Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
- Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
- Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
- Activities to cascade good practice on fair working conditions throughout the supply chain
- Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
- Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
- Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
- Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
- Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
- Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
- Volunteering opportunities for staff
- Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
- Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
- How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain
-
Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.
Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.
- Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
-
Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain
Policy Outcome 6: Employment and training: For those who face barriers to employment
- Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
- Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
- Introducing transparency to pay and reward processes
- Working conditions which promote an inclusive working environment and promote retention and progression
- Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition
-
Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.
Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.
- Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
- Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
-