SAN DIGITAL LIMITED

Overshow AI Assistant

Overshow is a Software as a Service AI assistant delivering secure, configurable AI-enabled workflows for knowledge work. It combines buyer-managed client applications with centrally managed cloud services for identity, configuration, licensing and support. Capabilities include conversational assistance, document understanding, summarisation and search, with processing performed locally or within buyer-controlled environments.

Features

• Conversational AI assistant for knowledge work and task support
• Local document analysis, summarisation and contextual understanding
• Configurable prompts, policies and AI behaviours per organisation
• API and connectors for enterprise systems and data sources
• Human-in-the-loop review and approval of AI outputs
• Role-based access control and detailed audit logging
• Buyer-managed client application with central configuration services
• Controlled updates, versioning and AI lifecycle management

Benefits

• Assist knowledge workers directly within their existing tools and workflows
• Reduce time spent searching, summarising and reusing organisational information
• Apply AI safely without exporting sensitive data unnecessarily
• Improve consistency and traceability of AI-assisted outputs
• Enable scalable AI adoption without complex infrastructure changes
• Maintain governance through access controls and auditable behaviour
• Accelerate insight and decision-making across teams
• Reduce operational overhead by combining local processing with managed services

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at lee.crossley@sandigital.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

489773496344607

Contact

Lee Crossley
07515495891
lee.crossley@sandigital.uk

About your service

• Service categories:

  Application Development and Deployment

  AI platforms

  • Search and knowledge discovery

  AI software services

  • Conversational AI Software Services
  • Generative AI Software Services
  • Document AI Software Services
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Desktop operating systems, identity providers and enterprise systems, including Microsoft Entra ID, device management platforms, document repositories and line-of-business applications used by public sector organisations. The service can also operate as a standalone AI assistant without requiring integration.
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: The service requires internet connectivity for licensing, updates and support services. Core AI capabilities depend on the availability and quality of buyer-provided data. Some advanced features may require configuration or integration effort. Performance depends on the buyer’s device and local environment.
• System requirements:
  • Supported operating system (macOS or Windows)
  • Modern processor and sufficient local memory
  • Local storage for application data and configuration
  • Secure internet connectivity for updates and support
  • Buyer-managed identity and access controls

User support

• Email or online ticketing support: Yes
• Support response times: We respond within one business day during UK business hours.; Limited monitoring outside business hours, responses next working day.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Standard support (included); Email or online ticketing support during UK business hours.; Responses within one business day.; Support provided by experienced cloud and software engineers.; ; Enhanced support (optional, at additional cost); Agreed response times and priority handling.; Extended support hours if required.; Optional named technical contact or cloud support engineer.; ; Technical account management; A named technical account manager or cloud support engineer can be provided.; ; Pricing; Standard support is included in the service price.; Enhanced support and named contacts are priced on request, depending on scope and service level.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: San Digital supports buyers to get started through a structured onboarding process tailored to the service and buyer needs. This typically includes initial configuration, user setup, and guidance on integrating the service with existing systems where required.; ; Users are provided with online documentation and onboarding materials covering core features, configuration options, and best practice usage. Remote onboarding sessions and walkthroughs can be provided during implementation to support administrators and key users.; ; Additional training, workshops, or onsite support can be provided by agreement where required, at additional cost. Ongoing support is available through email or online ticketing during UK business hours.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: At the end of the contract, buyers can request extraction of any data held by centrally managed service components, including configuration data, usage metadata and user-generated content associated with the service. Data can be exported in commonly used, machine-readable formats via the service interface or API, depending on configuration. San Digital will support buyers during offboarding to ensure data is provided in an agreed format and within agreed timescales. Data stored locally on buyer-managed devices remains under buyer control throughout. Following confirmation that data extraction has been completed, any centrally held buyer data is securely deleted in line with contractual and data protection requirements.
• End-of-contract process: At the end of the contract, the service enters an offboarding period covering centrally managed service components such as licensing, configuration and support access. During this time, buyers can extract relevant centrally held data using the service’s standard export tools or API. Standard offboarding support, including data extraction and guidance, is included in the contract price. Once extraction is completed and confirmed, access to centrally managed service components is removed and any centrally held buyer data is securely deleted in accordance with contractual terms and data protection requirements. Any additional offboarding support beyond standard extraction can be provided by agreement and may incur additional cost.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: No
• Application to install: Yes
• Compatible operating systems:
  • MacOS
  • Windows
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: The service provides a secure, user-facing interface through a desktop application and supporting configuration views. Users interact with the AI assistant through a responsive interface integrated with their operating system, while administrators manage access, policies and settings through controlled configuration interfaces. No browser-based installation is required for end users.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Interface accessibility is considered during design and development, with testing focused on keyboard navigation, screen reader compatibility and visual contrast using common assistive technologies and automated accessibility tools. User feedback is reviewed; accessibility issues are identified and incorporated into ongoing development. Formal third-party accessibility testing can be undertaken where required by buyers.
• API: Yes
• What users can and can't do using the API: Yes. The service provides HTTP-based APIs and supports Model Context Protocol (MCP) integrations, available on request. Authorised users can use the API to integrate Overshow with other systems, configure organisational settings, manage access controls, and exchange data required to support AI-assisted workflows.; ; Through the API, users can set up aspects of the service such as configuration parameters, policy settings, and approved integrations, subject to role-based access controls. Ongoing changes, including updates to configuration, prompts or connected data sources, can also be managed via the API where enabled.; ; API access is restricted to authorised administrators and service components. Certain sensitive actions, such as core application installation, local device configuration or security-critical changes, are not exposed via the API and must be performed through approved service processes. API availability, scope and documentation are provided on request.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Buyers can customise the service to meet organisational and operational requirements. Customisable elements include user roles and permissions, access policies, AI prompts and behaviours, approved data sources, integrations, and workflow configurations.; ; Customisation is primarily carried out through administrative configuration interfaces or, where enabled, via the service API. Administrators can enable or restrict features, define usage policies, manage integrations with enterprise systems, and control how AI-assisted functionality is applied within the organisation.; ; Authorised buyer administrators are responsible for organisational-level customisation. End users can personalise aspects of their own experience, such as interaction preferences, saved queries, or notification settings, within the limits set by administrators.; ; More advanced configuration, bespoke integrations, or changes to service behaviour can be delivered by San Digital as part of onboarding or through agreed change requests. All customisation is subject to role-based access controls and security policies, and does not affect the underlying platform or other customers.

Scaling

• Independence of resources: The service separates customers through a combination of buyer-managed local execution and logically isolated centrally managed service components. Centrally managed resources are monitored and controlled to prevent one organisation’s usage from adversely affecting others. Local processing is isolated per device and user. Where applicable, limits and controls are applied to centrally managed components to ensure fair usage.

Analytics

• Service usage metrics: Yes
• Metrics types: The service provides usage and operational metrics to help buyers understand how centrally managed service components are being used. Metrics may include user activity, feature usage, configuration events and basic service health indicators. Metrics are tenant-specific and accessible only to authorised users. Metrics support operational monitoring, service optimisation and reporting.
• Reporting types:
  • API access
  • Real-time dashboards
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure

Data importing and exporting

• Data export approach: Users can export centrally managed service data using built-in export functionality through the service interface. Data exports can be initiated by authorised users and are provided in commonly used, machine-readable formats. Exports can be performed on demand or as part of agreed offboarding processes. Access controls ensure users can only export their own data.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • JSON
  • NDJSON
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • JSON
  • NDJSON

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: We target 99.5% monthly availability, excluding planned maintenance. Service credits may be applied where availability falls below this level, as defined in the contract.
• Approach to resilience: The service is designed with resilience across centrally managed service components, including licensing, configuration and update services, hosted in UK-based datacentres on a hyperscale cloud platform. These components use fault-tolerant architectures, automated health checks and redundancy. Core assistant functionality runs on buyer-managed devices, where resilience depends on the buyer’s local environment and device management controls. Detailed resilience and recovery information for centrally managed components is available on request.
• Outage reporting: Outages affecting centrally managed service components are reported via email alerts and the support ticketing system. Where relevant, infrastructure-related incidents may be referenced through the underlying cloud provider’s public service health dashboard. Local assistant functionality on buyer-managed devices is not dependent on central service availability. Major incidents are communicated until resolution, with post-incident summaries available on request.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is restricted using role-based access controls and the principle of least privilege. Administrative access is limited to authorised personnel and protected by strong authentication. Support requests are logged and managed through controlled ticketing systems, with access restricted to appropriate support staff. User access and permissions are reviewed and adjusted as required.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: Security governance is led at director level and supported by documented policies and procedures. Secure development practices, access control, incident management and supplier assurance are reviewed regularly. Physical and infrastructure security is provided by the underlying cloud provider, with governance oversight retained by San Digital.
• Information security policies and processes: San Digital follows information security policies and processes including access control, identity and authentication management, data protection and handling, secure software development, vulnerability management, incident response, backup and recovery, and supplier security assurance. Security responsibilities are owned at director level and implemented through documented procedures, with regular review and management oversight.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Service components are version-controlled and tracked throughout their lifecycle using source control and deployment tooling. Changes are proposed, reviewed and approved before release, with testing performed prior to deployment. Security impact is assessed as part of change review, including consideration of access, data handling and dependencies. Changes are logged and can be rolled back if required. Emergency changes follow defined procedures with post-change review.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Potential threats are assessed through automated vulnerability scanning, code review, dependency monitoring and review of system changes. Vulnerabilities affecting centrally managed services and client components are risk-assessed based on severity and impact. Patches and mitigations are prioritised and deployed in line with change management processes. Threat intelligence is sourced from cloud provider advisories, vendor notifications, industry best practice sources and public vulnerability databases such as CVE listings.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: The service uses logging, monitoring and alerting to identify unusual or potentially malicious activity. Logs are reviewed and alerts investigated to identify potential compromises. When a potential incident is identified, access may be restricted, affected components isolated, and investigation initiated in line with the incident management process. Incidents are prioritised by severity, with critical incidents responded to as soon as practicable. Buyers are informed of confirmed security incidents in accordance with contractual and regulatory requirements.
• Incident management type: Supplier-defined controls
• Incident management approach: San Digital follows documented incident management processes covering common events such as service disruption, security incidents and data issues. Users can report incidents via email or the online support ticketing system. Incidents are logged, assessed and prioritised based on severity, with appropriate response and escalation. For significant incidents, affected users are informed and an incident summary or report can be provided on request, including actions taken and any follow-up measures.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: A time-limited evaluation version is available by request. It includes access to core functionality in a non-production environment with usage limits. Advanced features, integrations, customisation and production support are excluded. Trial duration and scope are agreed in advance and may be restricted.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 2%
• Between £500,001 and £1,000,000: 4%
• Between £1,000,001 and £2,500,000: 6%
• Between £2,500,001 and £5,000,000: 8%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 0c5d3da8-0fbf-4984-bdaf-badca42a1c8f
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at lee.crossley@sandigital.uk. Tell them what format you need. It will help if you say what assistive technology you use.