PHONEHUB IO LTD

Prison Voicemail - Management Portal

Prison Voicemail is an award-winning service improving prisoner-family ties by enabling the exchange of two-way voicemails and live calls through the existing prison phone system. The service is used across prisons in England, Wales, Scotland, and Queensland, Australia.

Features

• Two-way voicemails for prisoners and their approved social contacts.
• Call monitoring and retention processes are unaffected.
• Mobile app for family members enables replay of important messages.
• Prevents call conferencing and forwarding by social contact.

Benefits

• Strengthen family ties in line with the Farmer Review recommendations.
• Alleviate prisoner stress, making the establishment safer for all.
• Quick and easy to setup remotely, no hardware required.
• 96% of prisoners say voicemails make them feel better.
• Prisoners reported positive impacts on their behaviour.
• Especially useful when children or international family members are involved.

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@phonehub.io. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

589154626181788

Contact

Alex Redston
01603340589
info@phonehub.io

About your service

• Service categories:

  Application Development and Deployment

  Data management

  Database administration and development

  • Database Administration
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes
• What software services is the service an extension to: This system is a management portal for the Prison Voicemail service - which is free of charge for all establishments and active in 97% of establishments within England and Wales.
• Cloud deployment model: Public cloud
• Service constraints: None
• System requirements: Android 5+ or iOS 10.2 and above for external user.

User support

• Email or online ticketing support: Yes
• Support response times: During normal business hours we aim to respond within 2 hours.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), 7 days a week
• Web chat support: No
• Onsite support: Yes
• Support levels: We provide support for both prison staff by email and telephone.; ; All prisons have a direct named contact who can be reached 7 days of the week.; ; Phone and email support goes directly to both technical and customer service team. All queries responded to rapidly, typically within 1 hour. Technical support available within similar timeframes.; ; We operate as a social venture putting social impact above profit, therefore we do not charge for technical support where it is our service at fault.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Onboarding is an simple process requiring only a few pieces of information from the prison. The setup is done entirely remotely. All documentation is provided to enable staff to understand the system quickly and efficiently. Additionally, we are available to arrange dedicated training sessions with relevant staff and stakeholders to familiarise staff with controls.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Prison staff can extract all required data directly from the service portal. Data can be downloaded in standard formats suitable for secure storage or transfer.; ; If additional assistance is required at the end of the contract, we will support staff in completing data extraction and confirming that all necessary information has been retrieved.; ; After the contract ends, data is retained or deleted in line with contractual and statutory requirements. At the customer’s request, we can provide confirmation of deletion once retention periods have been met.; ; These extraction capabilities are included within the service; optional bespoke exports outside the standard portal tools can be provided at additional cost if required.
• End-of-contract process: At the end of the contract, access to the service can be disabled either across all sites or at specific prisons with minimal disruption. We support a managed offboarding process that includes confirming deactivation dates, coordinating with operational contacts and ensuring a smooth transition.; ; All customer data held within the service is handled in line with contractual and statutory requirements. At the customer’s request, data can be exported before contract closure or securely deleted once retention obligations have been met.; ; These activities are included within the contract price. Optional work outside the agreed scope (for example, bespoke data extracts or additional consultancy) can be provided at additional cost if required.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: When developing documentation, we take the Web Content Accessibility Guidelines into account and try to ensure that our designs remain perceivable, operable, understandable and robust.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Professional users can use the service from their work laptops, mobiles or tablets; ; Social users can access it from their mobile device / tablet via an app. Both methods are similar in user experience.
• Service interface: No
• User support accessibility: WCAG 2.2 A
• API: Yes
• What users can and can't do using the API: The API allows establishments to integrate the service into their existing systems and automate key workflows. Through the API, users can generate usage reports, schedule visits, upload identity documents, retrieve and manage contact lists, edit relationships, and view or update restrictions on resident communications.; ; The API can also be used to customise certain elements of the service to meet local operational needs.
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Users can request customisations to analytic data, for example, requesting data for specific groups or time frames.; ; All customisations are managed through regular service review meetings.; ; Customisations are made by our in-house, full-time development team and we will consider all suggestions made by customers.

Scaling

• Independence of resources: The nature of cloud software means that the service capability grows as the user base grows. All hardware and network connections are chosen to be highly scalable.

Analytics

• Service usage metrics: Yes
• Metrics types: Number of new voicemail accounts by month and prison.; Number of active voicemail accounts.; Call volume and total duration.
• Reporting types: Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Users can export their data by making a request to the Phonehub team.
• Data export formats:
  • CSV
  • Other
• Other data export formats: Audio files
• Data import formats: Other
• Other data import formats: N/A

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Services are available 365 days x 24 hrs with guaranteed SLA of 99% of availability.
• Approach to resilience: Available on request.
• Outage reporting: Service outages are reported on a user dashboard and via email alerts where required.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Two-factor authentication required to access management interfaces and support interfaces. Access is restricted using Role Based Access Control to approved user accounts, VLAN on the network and access to the network interface. Routing restrictions are in place with registered MAC addresses on switch ports and access to the admin LAN is restricted to admin's only. VPN's are in place to ensure the data is secure during transit.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We follow security processes as documented in our Information Security Management System (ISMS) Policy Manual, based on ISO27001 standards.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Phonehub IO Ltd has a formal documented Change Management process in place as defined in its ISO27001 management system. The Change Management Board (CMB) meet weekly to approve or reject requests for changes, to ensure the integrity of the process.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: For known product vulnerabilities we regularly apply all operating system and software updates. Daily automated third party vulnerability scanning using tenable.io.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Phonehub IO Ltd has a set of defined policies and procedures for protective monitoring in accordance with ISO27001 best practice combined with pervasive security controls with Next Generation Antivirus (NGAV); Endpoint Protection and Response (EDR); and Threat Graph.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Phonehub IO Ltd has a set of defined policies and procedures for incident management in accordance with ISO27001 best practice. The Information Security team will assess the seriousness of any situation and will take necessary action to limit any potential impact. All incidents are logged and reviewed.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: While there is no cost to the establishment for our basic service we do offer a 90 day free trial of the Prison Voicemail management portal, which is a feature which complements the use of Prison Voicemail within the establishment.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 3%
• Between £1,000,001 and £2,500,000: 5%
• Between £2,500,001 and £5,000,000: 7%
• Over £5,000,001: 9%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: LRQA
• ISO/IEC 27001 accreditation date: Thursday 28 November 2024
• What the ISO/IEC 27001 doesn’t cover: The scope of our ISO27001 approval does not have any exclusions.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Eff8f530-c361-4261-9610-331aaae65c9d
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 9235c2de-5e8a-4631-a5da-b42c2510f91a
• Other security certifications: Yes
• Any other security certifications: IT Health Check

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
    • Other measures to offer development opportunities for the target cohort(s) in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@phonehub.io. Tell them what format you need. It will help if you say what assistive technology you use.