WORLDLINE IT SERVICES UK LIMITED

TX Manager

A cost-effective, comprehensive, and user-friendly digital traceability interface that connects government institutions directly with economic operators, simplifying onboarding, product serialisation, traceability events visualisation, etc.

Our track record speaks for itself: 25 billion products traced, 16 billion transactions annually, and a commanding 40% European market share.

Features

• User-centric and real-time web portal & mobile app
• Market registry: centralised management of stakeholders and products
• Tax stamp & Unique ID Management
• Event traceability ledger for all product movements and transactions
• Business Intelligence: dashboards, real-time and customisable reports
• Security equipment management module ensuring anti-tampering

Benefits

• TPD success story in Europe,
• Trusted independent service provider,
• Interoperable & API-based solution,
• Data sovereignty guaranteed,
• Cloud agnostic solution – data & API driven design.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at WLopportunities@worldline.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

682760596993155

Contact

Christine Best
+447812325539
WLopportunities@worldline.com

About your service

• Service categories:

  Application Development and Deployment

  Application development

  • Development languages, environments and tools
  • Software construction components
  • Business rules management
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: Depending on the traceability requirements, some extra hardware and material may be required and sourced (such as anti-tampering devices or tax stamps)
• System requirements: No specific requirement

User support

• Email or online ticketing support: Yes, at extra cost
• Support response times: Worldline has a First Line Support team that can respond immediately to any issues with the application in production.; We can also set up a dedicated Level 2 user support team.; For example, in France, we have a subcontractor that provides user support (level 1).
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: No
• Support levels: "Worldline’s core business is critical online services, and our offering includes Level 1 (24/7), Level 2 (business hours) and Level 3 (business hours) support for key user groups of the purchaser.; Related costs will be assessed during the contracting phase, depending on availability requirements and customer volume.; ; A Service Delivery Manager (i.e. Technical Account Manager) is responsible for ensuring proper management of tickets (incidents and service requests), coordinating changes, and providing regular reports to the purchaser."
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We provide a first onsite training to key users. Additionnal trainings may be discussed as part of the call-off contract.; ; We provide training material (user guide, service description), and the service GUI includes tooltips. ; ; At last, our service GUI includes a chatbot to answer users questions
• Service documentation: Yes
• Documentation formats:
  • PDF
  • Other
• Other documentation formats:
  • Tooltip
  • Chatbot
• End-of-contract data extraction: There are two ways for exporting data out of the system:; - complete data export: raw or csv, to be agreed with Worldline; - report based extract, in a csv format, available from the report feature
• End-of-contract process: By default, a standard raw data or csv export of complete data is scheduled. Export will be restricted to business data (no Worldline product specific data will be exported); We will agree for each call-off contract on additional exports, depending on buyer requirements.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Onboarding and offboarding documentation will be customised for each call-off contract. Accessibility standard to meet will be aligned with the buyer

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The service design is web-responsive. Some features are restricted on the mobile app, as users are expected to be consumers and will not have permission for administration features.
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: Interface is a responsive application which allows logged user to use the functionalities provided by TX Manager (Entities management, Product management, unique codes ordering, dashboard generation, reporting, monitoring of actions, product tracking)
• Accessibility standards: None or don’t know
• Description of accessibility: Accessibility is integrated from the product’s design start, supported by WCAG 2.0‑trained experts. In early design stages, ergonomists and UX specialists ensure key principles—intuitive navigation, consistent terminology, robust interaction methods (including form error handling), and proper semantic structure (heading hierarchy)—are applied. Developers are trained to consider accessibility throughout interface creation. Our Q&A specialists are WCAG 2.0‑certified and play a crucial role in audits. This expertise ensures the design groundwork and final assessments align with international best practices, delivering a reliable, comprehensive approach from concept to final audit.
• Accessibility testing: No specific interface testing has been conducted with users of assistive technology at this stage.
• API: Yes
• What users can and can't do using the API: All features available on the GUI are accessible via our APIs.; Appropriate credentials and permissions are required to utilise the APIs.; Some usage limitations may be applied to the APIs to protect service performance.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Users can configure several features of the service in order to adapt ergonomics and friction to the use case, such as :; - need for approval for creation; - notification subscriptions ; ; Configurable items are described in the user guide.

Scaling

• Independence of resources: Measures depend on the chosen hosting type at call-off: a dedicated instance or a tenant on a multi-client platform.; In the case of a multi-tenant platform, several measures ensure isolation and performance for each tenant, such as:; ; - applicative thresholds to protect against abusive usage of the features (thresholds set according to agreed usage); - use of microservices to maximise scalability of the core features; - capacity planning to ensure permanent overscaling of the platform to absorb traffic peaks; - use of scalable infrastructures

Analytics

• Service usage metrics: Yes
• Metrics types: "Metrics are mainly about past activities and remaining work items for the user.; Past month activities and remaining work items types may vary depending on user's role."
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: The standard way for a user to export data is to use the " report based" extract, in a csv format, available from the report feature. However, key users may issue service requests to Worldline (at extra cost) for getting special extracts.
• Data export formats: CSV
• Data import formats: Other
• Other data import formats: Not applicable

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Availability of the Services (monthly uptime): 99.5%.; ; Incident management; Mean Time to Notify (MTTN) Service Level for all Services: 30 minutes for Severity 1 incidents from Worldline awareness .; ; Mean Time to Restore (MTTR) Service Level for all Services:; ; - 4 hours for Severity 1 incidents;; - 1 Business Day for Severity 2 incidents, if no Change Management Process is needed;; - 3 Business Days for Severity 3 incidents, if no Change Management Process is needed.; ; Service support availability:; - Level 1 support: 24/7/365.; - Level 2: Business Hours (on duty for Severity 1 incidents).; - Level 3: Business Hours (on duty for Severity 1 incidents).; ; Incident Severity Definition; -Severity 1: An error that disables or materially impairs major service function or the Customer’s operations. If a workaround exists, reclassified as Severity 2.; - Severity 2: An error reducing performance in any non-critical process.; - Severity 3: An error visible only on a single end-user system or non-essential components.
• Approach to resilience: Our service design follows the below principles for ensuring resiliency:; - asynchronous data processing for managing traffic peaks and avoiding locks (for a selected set of workflows); - active/passive Disaster Recovery Plan; - microservice replication (at least one replicate per microservice), combined with a live API based heatlh check
• Outage reporting: Incidents are tracked using a ticketing tool with an alerting mechanism.; Our service delivery teams inform customers according to agreed contractual terms.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
• Access restrictions in management interfaces and support channels: Access restriction in management interfaces is managed through Role Based Control and permission management.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Worldline France has established and certified an Information Security Management System (ISMS) in accordance with the ISO/IEC 27001:2013 standard, covering its operations and the projects entrusted to it by its clients. All services and deliverables provided under this engagement are included in the ISMS and benefit from all associated security measures—both technical and organizational—based on current best practices as well as the legal and regulatory requirements applicable to Worldline and its clients.; All employees receive mandatory training in security policy.; Security incidents can be reported either via the line manager or the project's CISO, or via a dedicated mailbox.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Change management is a formal process for handling modifications to the platform, including software updates and configuration changes to adapt to evolving circumstances, regulations, and technologies. It relies on strict documentation and application version control, as well as validation steps with clearly identified responsibilities as defined in the quality assurance plan. These validation steps include risk management, specifically security risks, for updating the risk register and implementing appropriate actions for each case.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Weekly security scans are conducted on IP addresses exposed to the internet. The results are sent to the Security Officer responsible for project security for analysis.; Technical updates are also carried out at least twice a year to keep the service up to date and resolve known vulnerabilities .; Known vulnerability tracking is carried out in collaboration with the Security Officer, and deployment decisions are made according to the severity of the threat: from deployment within 24 hours to periodic updates.; Security scans are based in particular on OWASP, Qualys and SonarQube references.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Worldline’s security incident management policy outlines procedures for response, categorisation, handling, and communication of events affecting Worldline’s or clients’ data. Incident priority is determined by scope and impact on information systems. ; For attacks involving client data, Worldline delivers a preliminary incident report within 48 hours, detailing investigation status, understanding of the attack, scope, impact, and mitigation actions taken. Relevant logs or traces are provided once the incident is confirmed. ; Additionally, Worldline can deploy a Security Operations Centre (SOC) to correlate log sources and quickly detect potential malicious behaviour affecting data.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Application and platform monitoring is carried out 24/7 by operational teams who can be contacted at any time via phone or ticketing. ; The monitoring centre analyses and categorises incidents, taking appropriate action according to the type of event and established procedures. ; Incident tracking is available through the ticketing system, and a post-incident report is produced for major or critical incidents.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 1%
• Between £500,001 and £1,000,000: 1.5%
• Between £1,000,001 and £2,500,000: 2%
• Between £2,500,001 and £5,000,000: 2.5%
• Over £5,000,001: 3%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: EY CertifyPoint
• ISO/IEC 27001 accreditation date: Tuesday 1 August 2023
• What the ISO/IEC 27001 doesn’t cover: Nothing
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: EY CertifyPoint0
• ISO 9001 accreditation date: Tuesday 1 August 2023
• What the ISO 9001 doesn’t cover: Nothing
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: USD AG
• PCI DSS accreditation date: Wednesday 16 October 2024
• What the PCI DSS doesn’t cover: All Worldline services which are not part of a card payment solution (PCI DSS only applies to card payment related services). All Worldline teams are nevertheless trained to PCI DSS requirements and the Worldline Information Security Management System is aligned with PCI DSS requirements
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: A4af5190-7f45-41c3-ab5a-c40a1557bd92
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at WLopportunities@worldline.com. Tell them what format you need. It will help if you say what assistive technology you use.