LIGHTBULB ANALYTICS LIMITED

IR3

Lightbulb Analytics’ IR3 is a real-time fleet and resource management service for the public sector, enabling organisations to optimise vehicle and personnel utilisation through live tracking, analytics, reporting and system integration, reducing fleet costs while maintaining operational efficiency.

Features

• Near real-time vehicle and personnel tracking with status updates
• Trip replay with events idling, speed, stops, equipment usage
• Electronic logbooks capturing journeys, times, locations, and driver identification
• Advanced driver behaviour analytics with peer comparisons and benchmarking
• Fleet utilisation analysis by mileage, time, trips, roles, locations
• Incident detection and collision analysis using sensor data alerts
• Real-time alerts for panic alarms, faults, diagnostics, events notifications
• Geo-fencing reports supporting compliance, monitoring, deployment verification and analytics
• System integrations enabling deployment, response-time analysis, productivity insights reporting
• Remote access cloud-hosted platform with unlimited users and scalability

Benefits

• Reduce fleet operating costs using data-driven utilisation insights.
• Improve response times with near real-time vehicle visibility.
• Optimise resource deployment by identifying underused vehicles quickly.
• Enhance driver safety through behaviour monitoring and alerts.
• Simplify compliance reporting with automated logs and geo-fencing.
• Support proactive maintenance using diagnostics and vehicle health data.
• Increase operational productivity through detailed utilisation analytics.
• Enable informed decision with integrated systems and comprehensive fleet reporting.
• Improve accountability by accurately linking trips, actions, and drivers recorded.
• Manage fleets remotely via cloud access and unlimited concurrent users.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at adrian.mcmullan@lba.ltd. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

641141415544327

Contact

Adrian McMullen
07946516028
adrian.mcmullan@lba.ltd

About the service

• Service categories:
  • Application Development and Deployment
    • Analytics and business intelligence
      • Location and geospatial data management and analytics
        • Location and geospatial data management and analytics
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Requires compatible in-vehicle hardware and sensors for full functionality.; ; Dependent on mobile network coverage for near real-time tracking updates.; ; Planned maintenance windows may cause brief, scheduled service interruptions.; ; Third-party system integrations subject to external system availability and APIs.; ; Some advanced features available only with optional modules or add-ons.; ; Mobile application provided as a separately priced optional extra.; ; Implementation timelines depend on fleet size and deployment complexity.; ; Historical data availability depends on installation and service start date.
• System requirements:
  • Reliable internet connection required for accessing cloud-based fleet management platform
  • Modern web browser supporting HTML5 and secure encryption protocols
  • Compatible in-vehicle telematics hardware installed for full service functionality
  • Mobile data connectivity required for near real-time vehicle data transmission
  • User devices supporting secure authentication and role-based access controls
  • Access to third-party APIs required for optional system integrations
  • Antivirus and endpoint security software recommended on user devices
  • Email access required for notifications, alerts, and account communications

User support

• Email or online ticketing support: Yes
• Support response times: IR3 standard support services operate 09:00–17:00, Monday to Friday (excluding weekends and public holidays).; ; Response times during standard support hours are:; ; Priority 1 (critical fault): response within 2 working hours; ; Priority 2 (significant fault): response within 4 working hours; ; Priority 3 (minor fault): response within 8 working hours; ; Priority 4 (information or change request): response within 24 working hours; ; Weekend support:; There is no standard weekend support. Requests logged outside support hours, including weekends, are responded to at the start of the next working day, in line with the priority levels above.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: IR3 provides a single standard support level for all customers, included within the service cost.; ; Support levels provided; Support is delivered Monday to Friday, 09:00–17:00, excluding public holidays, and is prioritised by incident severity:; ; Priority 1 – Critical fault: substantial loss of service or severe data/performance impact.; Response: 2 working hours | Resolution: 8 working hours; ; Priority 2 – Significant fault: partial service loss or limited performance degradation.; Response: 4 working hours | Resolution: 2 working days; ; Priority 3 – Minor fault: limited impact with no loss of business efficiency.; Response: 8 working hours | Resolution: 10 working days; ; Priority 4 – Service request: information requests, administration, or enhancements.; Response: 24 working hours | Resolution: delivered in the next release; ; Support costs; Standard IR3 support is included at no additional cost within the service pricing.; ; There are no tiered or premium paid support levels offered as standard.; ; Technical account management; A dedicated technical account manager is provided as standard, and support is delivered by IR3’s experienced technical support team, with specialist resources engaged as required.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Users are supported in starting to use the service through a combination of formal onboarding, training, documentation, and ongoing support. Initial implementation is typically delivered with direct assistance from the service provider, including formal on-site training sessions where required. These sessions are designed to help fleet managers, administrators, and drivers understand system functionality, role-specific responsibilities, and best-practice use of both the web-based IR3 platform and the mobile application.; ; In addition to on-site training, users are provided with user documentation that explains how to navigate the interface, view and interpret telemetry data, complete driver tasks such as daily vehicle checks, and generate reports. Online training and guided walkthroughs further support learning, allowing users to reinforce knowledge at their own pace and onboard new staff efficiently.; ; Ongoing assistance is available through customer support, enabling users to raise queries, troubleshoot issues, and receive additional guidance as their operational needs evolve. This structured approach ensures users are fully supported from initial setup through to day-to-day operation, helping organisations adopt the service confidently and maximise its value.
• Service documentation: Yes
• Documentation formats: PDF
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: When a contract ends users can extract their data through the service’s reporting tools and API. Fleet and telemetry data can be exported from the web-based IR3 platform using standard report export functions, allowing users to download their information in common formats for retention or migration. In addition, the API can be used to retrieve historical vehicle and asset data programmatically for integration into other systems or long-term storage. Data extraction is performed by authorised users, typically administrators, before service access is decommissioned.
• End-of-contract process: At the end of the contract the service is decommissioned in a controlled manner. Customers are given the opportunity to extract their data before access is removed, using reporting tools and the API to download historical vehicle, asset, and telemetry information. Once the contract ends and data extraction is complete, access to the web platform, mobile application, and API is withdrawn, and ongoing data collection from vehicles or assets ceases.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The mobile service is primarily operational officer focused. The IR3 mobile app supports driver communication with other users, incidents and operational tasks, task completion, while in the field. It enables quick interactions and operational updates on the go. It has been designed to take into account the constraints of mobile devices, such battery life, network coverage and screen size.; ; The desktop service (IR3 web platform) provides the full system functionality, including comprehensive vehicle tracking, analytics, reporting, configuration, and management tools. It is designed for users requiring detailed analysis and system control.
• Service interface: Yes
• Description of service interface: The application is fully web-based and is built with ability to toggle between fields, enhance colour contrast and works with zoom text and voice readers.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: We have conducted interface testing that considers the needs of users who rely on assistive technologies as part of our broader usability and quality assurance processes.
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: The API allows users to access and integrate telemetry and fleet data with third-party systems.; ; What users can do:; Retrieve vehicle, asset, and telemetry data for reporting and analysis; ; Integrate data into external systems (for example, maintenance, finance, or analytics platforms); ; What users can’t do / limitations:; There are no limitations—anything available in the app is also available via the API.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Users can customise the service primarily through the web-based IR3 platform, where authorised users such as system administrators and fleet managers can configure a wide range of features to suit organisational needs, including the creation and modification of reports and dashboards to support operational and management reporting, the setup and adjustment of alerts, rules, and performance thresholds to monitor vehicle and asset behaviour, the management of user roles and permissions to control access to data and functionality, and the configuration of vehicle and asset settings to reflect fleet structure and operational requirements, with all customisation activities performed through built-in administrative tools and settings within the desktop interface, while access to these customisation capabilities is restricted to users with appropriate permissions to ensure system integrity and data security.

Scaling

• Independence of resources: User demand is managed through a secure, scalable Azure-hosted architecture designed to prevent one customer’s usage impacting another’s.; ; The service uses multi-tenant logical separation, role-based access controls, and Azure resource management to isolate customer data and workloads. Platform capacity is continuously monitored, with elastic scaling used to handle peak demand. Performance, availability, and data are actively managed to ensure consistent service levels, while automated alerts and controls prevent excessive usage from degrading the experience for other users.

Analytics

• Service usage metrics: Yes
• Metrics types: IR3 provides the following key service metrics:; ; Vehicle and asset utilisation metrics such as trip activity, mileage, engine hours, idle time, and stop duration.; ; Location and journey metrics, including GPS position, route history, journey start/end times, and geofence events.; ; Driver behaviour metrics such as speeding, harsh braking, harsh acceleration, and cornering events.; ; Vehicle performance and health metrics, including engine status, fault codes, and operational alerts where supported by the vehicle.; ; System availability and data freshness metrics, monitored through the Azure-hosted platform to ensure reliable data capture and reporting.; ; These metrics are available through dashboards, reports, and integrations.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: In-house
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Data Erasure
• Equipment disposal approach: In-house destruction process

Data importing and exporting

• Data export approach: Users can export their data in several ways. Data captured by the IR3 telematics platform, including trips, GPS locations, vehicle performance, and driver behaviour, is available through platform dashboards and can be exported via standard reports in common formats such as CSV or Excel for offline analysis and sharing. The solution also supports data sharing with third-party systems through integrations or APIs, with the scope and frequency agreed with the customer. In addition, historical and archived data is retained within the Azure-hosted platform and can be retrieved or extracted as required, subject to agreed data ownership and retention terms.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: IR3 is delivered via a high-availability, Azure-hosted platform designed to provide resilient and reliable access.; ; The solution targets enterprise-grade availability, supported by Azure’s redundant infrastructure, monitoring, and automated failover. Service performance and uptime are continuously monitored to minimise disruption and ensure consistent access to data and reporting.; ; Where contractual Service Level Agreements (SLAs) are in place, availability commitments and measurement methods are defined within customer agreements. If guaranteed availability levels are not met, service credits or refunds are applied in line with the agreed SLA terms, rather than direct financial penalties, ensuring transparency and fairness for users.
• Approach to resilience: IR3 is designed for resilience through a cloud-native, Azure-hosted architecture.; ; The platform uses redundant infrastructure across Azure data centres, with built-in failover, load balancing, and automated scaling to maintain availability during component failures or demand spikes. Data is securely stored with replication and backup controls to prevent loss. Continuous monitoring, alerting, and proactive maintenance are used to detect and resolve issues quickly. Logical tenant separation and controlled deployments further reduce risk, ensuring the service continues to operate reliably even when individual components are impacted.
• Outage reporting: IR3 outages are reported through a combination of operational monitoring and customer communications, rather than a fully self-service public status portal.; ; Email alerts: Customers are notified of significant service incidents or outages via direct communication, typically email, managed by the support and service management teams.; ; Platform health is continuously monitored within the Azure environment, enabling rapid detection, escalation, and customer notification when issues occur.

Identity and authentication

• User authentication needed: Yes
• User authentication: Multi-Factor Authentication (MFA)
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is tightly controlled using role-based and least-privilege principles.; ; Management interfaces are protected through authenticated user accounts with role-based access controls, ensuring users can only view or manage data relevant to their organisation and job function. Administrative access is restricted to authorised personnel and governed by internal security and change-management processes.; ; Support channels are similarly controlled: only verified customer contacts can raise or discuss support cases, and support staff access customer systems and data on a need-to-know basis, with activity logged and monitored to maintain accountability and security.
• Access restriction testing frequency: At least every 6 months
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: IR3 follows established information security policies and processes aligned to industry best practice.; ; These include defined information security governance, access control, and data protection policies covering the handling of customer and telemetry data. Security is enforced through role-based access controls, authentication, and logical separation of customer data within the platform. The Azure-hosted environment applies network security, encryption, monitoring, and vulnerability management controls. Regular security reviews, incident management procedures, and change control processes are used to identify, manage, and mitigate risks, ensuring the confidentiality, integrity, and availability of customer data.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: The LBA SDLC follows our parent company (AssetWorks) framework, which requires step by step assurance also imposed by tools in place as part of Dev and QA.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Vulnerability assessments, i.e., penetration testing and risk management C&As, are performed annually by our parent corporation as a way to ensure entities are adhering to current guidance and regulations in their respective networks. Vulnerability scans are performed at least bi annually and after any significant changes or additions within the environment. LBA has established SLAs based on criticality of vulnerability found.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: LBA employs DAST and SAST for monitoring as well firewall tools and performance tools inherent in Azure. Response to Incident is dependent on the nature of the event with security and production environments taking precedent.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Post-quantum cryptography secure: Yes
• Incident management approach: The LBA Incident Management Policy is included as part of the ISO27001 certification and is tested annually at a minimum. Communications between LBA and hosted customers in regards to incidents are defined by this policy: Major Incident - Contact Customer designated key users within one hour via telephone and email with full description of incident and remediation within 8 hours. The latter are the defined 'maximum' goals with in practice anticipated to be less. Impacted customers are informed of the scope, cause, remediation and lessons learned.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 1%
• Between £500,001 and £1,000,000: 2.5%
• Between £1,000,001 and £2,500,000: 5%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 15%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: British Assessment Bureau
• ISO/IEC 27001 accreditation date: Monday 3 February 2025
• What the ISO/IEC 27001 doesn’t cover: ISO/IEC 27001 applies only to the processes, locations, systems, and assets explicitly included in the certification scope. Anything not listed is automatically excluded.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• ISO 9001 certification accredited by: Citation ISO Certification
• ISO 9001 accreditation date: Friday 25 July 2025
• What the ISO 9001 doesn’t cover: ISO9001 applies only to the processes, locations, systems, and assets explicitly included in the certification scope. Anything not listed is automatically excluded
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 29988073-57d3-497b-b655-7e272e6d0692
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Plans to engage the contract workforce in deciding the most important workplace issues to address
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
  • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges

  Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

  • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
  • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
  • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

  • Understanding of the issues affecting the development of new skills by target cohort
  • Understanding of issues relating to entering the contract workforce
• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at adrian.mcmullan@lba.ltd. Tell them what format you need. It will help if you say what assistive technology you use.