QUIDOS LIMITED

SNUG

SNUG provides EPC-aligned energy efficiency insights to support Warm Homes Plan delivery. Using official EPC data and a government-approved RdSAP engine, it estimates ratings, key metrics and cost-effective home upgrade pathways with interactive what-if modelling. Where no EPC exists, geospatial comparables are used. Available via web or API.

Features

• Address lookup by postcode or address for rapid property identification.
• Retrieves official lodged EPC records via government “Find certificate” sources.
• Recalculates performance using the Quidos government-approved RdSAP calculation engine.
• Produces updated estimated Energy Performance Estimate and headline metrics.
• Generates tailored improvement recommendations aligned to property characteristics.
• Interactive what-if modelling: adjust inputs, instantly recalculate results.
• Geospatial fallback finds nearest comparable property when EPC missing.
• API access for partner integrations, bulk analysis, and automation.
• Supports country-specific EPC data sources across UK administrations.
• Will be updated to HEM engine when HEM is released

Benefits

• Quickly generate up-to-date ratings without commissioning a new EPC.
• Standardise property energy insights using government-approved RdSAP recalculation.
• Identify retrofit opportunities faster with tailored, prioritised recommendations.
• Reduce manual data gathering by pulling EPC data automatically.
• Explore scenarios instantly by adjusting inputs and recalculating outcomes.
• Fill data gaps using geospatial comparable-property lookup when EPC missing.
• Integrate energy insights into existing systems using the SNUG API.
• Scale portfolio analysis with consistent outputs across large property datasets.
• Improve decision-making with clear metrics, recommendations, and evidence trails.
• Integration into HEM (Home Energy Model) when HEM released

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@quidos.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

730862302930352

Contact

Quidos Sales Team
01225 667570
sales@quidos.co.uk

About your service

• Service categories:

  Application Development and Deployment

  Analytics and business intelligence

  • Advanced and predictive analytics
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: The service is hosted and requires internet access over HTTPS (TLS 1.2+) and a modern browser with JavaScript enabled for the web UI. ; ; Availability and outputs depend on underlying datasets; where a property has no EPC, results will be indicative using comparable-property logic and Geospatial lookup. ; ; API usage will be rate limited: default rate limit 10 requests/second with a burst limit of 100 requests; ; Monthly quota will apply from the 1st day of each month. Higher limits are available by agreement.
• System requirements:
  • Modern web browser: Chrome, Edge, Firefox, or Safari latest versions.
  • SNUG API consumers need HTTPS-capable HTTP client library.
  • SNUG API consumers need secure transfer protocol (e.g. Snowflake)
  • For bulk use, stable network and reasonable request throughput capacity.

User support

• Email or online ticketing support: Yes
• Support response times: Quidos aim to respond to queries with 24 hrs for a general query and as per the SLA's for software issues.; ; The helpdesk is open 5 days a week from 9am to 5pm Monday to Thursday and 9am to 4:30pm on Fridays
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: No
• Support levels: Quidos will:; ; (a) use reasonable endeavours to respond to requests for Maintenance Services made through the helpdesk; and; ; (b) use reasonable endeavours to resolve issues raised by the customer, in accordance with the following response time matrix.; ; P1 ; Files cannot be uploaded or downloaded between the customer and and Quidos. ; Response within one normal business hour. ; Resolution time within one normal business day continuous effort after initial response and with customer co-operation.; ; P2 ; Serious operational problems, which affect files from being processed normally and preventing valid results from being returned.; Response within two normal business hours ; Resolution within two normal business days.; ; P3 ; Certain non-essential features of the API are impaired while all major components of the total solution remain functional, perhaps with a workaround.; ; Errors that are non- disabling and clearly have little or no impact on the normal operation of the total solution. ; ; Response within twelve normal business hours. ; Resolution in next new version of the software, in accordance with an agreed timetable.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Quidos can provide all of the above. ; ; The service will typically be integrated into the customers existing systems and this process will form part of the contract. For example using Snowflake for secure data transfer between the two system.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • Other
• Other documentation formats: OpenAPI
• End-of-contract data extraction: This question is not applicable as the API responds with the property data on demand to a call, The engine is stateless for all intent and purposes. outside of a data cache there is not a store of user data that can be extracted.
• End-of-contract process: At the end of the contract the API Key for the customer is removed and there is no further access to the API
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: The onboarding and offboarding documentation is designed to be read by a technical audience, as it is standard Open API document it can be read by screen readers without an issue.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Designed as a responsive app for different screen sizes
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: There are two interfaces ; ; A Web interface (UI): a browser-based site where users search a property and view results.; ; An API interface: HTTPS/REST endpoints partners call programmatically (often with an API key) to retrieve ratings, datasets, and recommendations.
• Accessibility standards: None or don’t know
• Description of accessibility: The Web interface has been designed to return the EPC of the property based on one question of "What is the address ?" Once the user has entered the address they are taken straight to the results screen. By bypassing a complex set of questions regarding the property users with assistive needs can go straight to the results
• Accessibility testing: NA
• API: Yes
• What users can and can't do using the API: Users access the SNUG API over HTTPS using an API key supplied in the X-API-KEY header, calling either the LIVE or DEV server.; ; What users can do; ; GET Derived RdSAP calculated outputs for a known property. which Performs a query to fetch Derived RdSAP data using the provided UPRN. ; ; PUT an OS Places DPA address payload to obtain a derived/calc result.; ; POST Recalculate after changing property inputs by posting a DerivedRdSAP object ; ; Request either JSON or XML by using the Accept header. ; ; How setup works; ; Obtain an API key, choose environment (LIVE/DEV), and integrate using either the UPRN flow or the OS Places flow.; ; Changes via API; ; Changes are made by supplying updated inputs and re-running the calculation endpoint. ; ; Limitations; ; SNUG does not perform the OS Places lookups/validation; callers must supply valid OS Places output via a separate service.; ; Nearest-match filters apply only when SNUG must use nearest matching.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: SNUG is built on AWS managed services designed for elastic scaling. API Gateway and Lambda automatically scale with demand, so capacity increases as request volume grows. To protect tenants from noisy-neighbour effects, we apply throttling and concurrency controls, monitor latency and error rates, and use queue-based buffering (with dead-letter queues) for asynchronous workloads. This limits the impact of traffic spikes, isolates failures, and maintains consistent performance for all users.

Analytics

• Service usage metrics: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Staff screening not performed
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: NCSC approved service provider
• Protecting data at rest: Physical access control, complying with another standard
• Data sanitisation process: No
• Equipment disposal approach: In-house destruction process

Data importing and exporting

• Data export approach: This question is not applicable as the API responds with the property data on demand to a call, The engine is stateless for all intent and purposes. outside of a data cache there is not a store of user data that can be extracted.
• Data export formats: Other
• Other data export formats: Not Applicable
• Data import formats: Other
• Other data import formats: Not Applicable

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: SNUG is provided with a monthly availability service level target of 99.0% (“two nines”), measured across a calendar month. Availability is defined as the SNUG web application and SNUG API successfully responding to valid requests over HTTPS, excluding scheduled maintenance and events outside our reasonable control (for example, major upstream internet outages).; ; Planned maintenance; Planned maintenance will be communicated in advance where practicable and scheduled to minimise user impact. Planned maintenance windows are excluded from availability calculations.; ; Service credits (refund mechanism); If monthly availability falls below 99.0%, affected customers may request service credits applied to the next invoice (or next subscription period), calculated as a percentage of the monthly service charges for the impacted service:; ; 98.0% to <99.0%: 5% service credit; ; 95.0% to <98.0%: 10% service credit; ; <95.0%: 25% service credit; ; Credits are the customer’s sole and exclusive remedy for SLA breach, capped at 25% of the monthly service charges for the affected month.; ; Claim process; ; Customers must submit a claim within 30 days of month-end, including the dates/times of impact and supporting evidence (for example request logs or screenshots). We will validate against our monitoring data and confirm the credit amount.
• Approach to resilience: SNUG is designed for resilience in line with NCSC Cloud Security Principle 2 (asset protection and resilience).; ; All SNUG infrastructure runs on AWS in the Europe (London) Region (eu-west-2), and service data is stored and processed in the UK. AWS Regions use multiple, physically separate Availability Zones, and SNUG uses managed services that are designed to operate across those zones.; ; The service uses a serverless architecture built around Amazon API Gateway and AWS Lambda, reducing reliance on fixed servers and supporting automatic scaling and rapid recovery from instance-level failures. API Gateway has a published 99.95% regional SLA from AWS.; ; Resilience is strengthened through asynchronous processing with dead-letter queues (DLQs) to capture failed events for safe reprocessing, plus controlled retries/backoff to prevent cascading failures.; ; Infrastructure is defined as code (Serverless Framework) and deployed via automated CI/CD pipelines, enabling repeatable builds, rapid rollback, and consistent environment recovery. Centralised monitoring, logging, alerting, and operational runbooks support fast detection and incident response.
• Outage reporting: SNUG reports outages and service degradation through a combination of internal monitoring and customer-visible checks:; ; Email alerts (internal): Quidos uses AWS CloudWatch alarms to detect availability, error rates, latency, and downstream dependency failures. Alarms generate automated notifications to internal operational email distribution lists for triage and response.; ; API health checks (external monitoring): The SNUG API exposes health-check endpoints that can be called by buyers (or their monitoring tools) to verify service availability and basic dependencies. This enables independent monitoring and alerting by the buyer.; ; Public dashboard: SNUG does not currently provide a public status dashboard by default. If required, service-status reporting (for example a shared status page and/or agreed notification list) can be provided as part of onboarding or on request.

Identity and authentication

• User authentication needed: No
• Access restrictions in management interfaces and support channels: Access to SNUG management interfaces is restricted using AWS IAM and IAM Identity Center with named user identities, mandatory MFA, and role-based access control. Permissions follow least-privilege principles, with elevated access limited to authorised staff and production changes requiring approval. Administrative activity is logged for audit and investigation. Support channels are restricted through controlled access to Freshdesk, where only authorised support staff can view and handle tickets. For the support helpline and Freshdesk, identity is verified before discussing account-specific information, and sensitive requests are escalated through the defined support process.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: No audit information available
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: Yes. Quidos is certified to Cyber Essentials Plus (independently assessed). This provides assurance against a defined set of baseline security controls. It does not constitute an ISO 27001 Information Security Management System certification.
• Information security policies and processes: For SNUG service operations, Quidos follows documented information security policies and processes aligned to Cyber Essentials Plus.; ; Policies in scope include: Information Security, Access Control, Acceptable Use, Incident Response, Vulnerability/Patch Management, Change Management, Backup/DR, Logging/Monitoring, and Data retention/classification.; ; Compliance is enforced through day-to-day operational controls:; ; Training: security onboarding for relevant staff, including acceptable use and reporting.; ; Access management: mandatory MFA, least-privilege IAM, and joiner/mover/leaver controls. Production access requires explicit approval.; ; Secure delivery: peer code reviews and controlled releases under change management.; ; Vulnerability management: patching and remediation follow the vulnerability/patch process.; ; Monitoring and response: central logging/monitoring is used to detect issues; security incidents are recorded and tracked in JIRA from identification through to closure and lessons learned.; ; Resilience and lifecycle controls: Backup/DR supports recovery, and retention/classification policies govern how service data is stored, handled, and disposed of.; ; (Reporting structure and role ownership are provided elsewhere in the application.)
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: SNUG uses infrastructure-as-code (Serverless Framework) and version-controlled code (Git) to track all components through their lifetime. (API routes, Lambda functions, IAM policies, DLQs, configuration). ; ; CI/CD builds immutable artefacts and promotes them through dev/live with traceable version tags. ; ; All changes are logged in JIRA and delivered via pull requests with peer review, automated tests, and approval gates. ; ; Security impact is assessed during review (data handling, IAM permissions, authentication, logging, dependency changes). ; ; Releases are monitored after deployment and can be rolled back to a prior tagged version.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Vulnerabilities are managed using supplier-defined controls aligned to NCSC Principle 5. We assess threats through ongoing review of architecture and changes, plus monitoring of AWS Security Bulletins and NCSC advisories for relevant issues. New findings are triaged and tracked in JIRA with team priorities and ownership to closure. Patching is deployed via our CI/CD pipeline, with an expedited path for urgent fixes. Target timeframes: critical/actively exploited within 48 hours, high within 7 days, medium within 30 days, low within 90 days. We run git-secrets scanning to reduce credential leakage risk.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: SNUG uses protective monitoring aligned to NCSC cloud security principles. Logging and metrics from API Gateway and Lambda are monitored for indicators of compromise, including unusual traffic spikes, elevated 4xx/5xx rates, latency increases, authentication failures, Lambda errors/timeouts/throttling, and dead-letter queue messages. CloudWatch alarms generate email alerts to the operations team in near real time. Suspected compromises are triaged immediately: we confirm scope/impact, contain (for example disable affected API keys, restrict access, or roll back changes), remediate, and restore normal service. Actions, evidence, and follow-ups are recorded in JIRA. We aim to start investigation within 1 hour for high severity alerts.
• Incident management type: Supplier-defined controls
• Incident management approach: SNUG follows a documented incident management process for outages, degraded performance, failed deployments, and security alerts. ; ; Runbooks and checklists support common events (for example API errors, dependency failures, DLQ growth, rollback, or suspected credential exposure). Incidents are severity-rated, assigned an owner, and tracked to closure in JIRA with actions and follow-ups. ; ; Users report incidents via the Quidos support helpline or via Freshdesk incident support. ; ; For significant incidents, we provide an incident update covering impact, timing, mitigations and current status. Post-incident reports are available on request, including timeline, root cause and corrective actions.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: All abilities of the API will be included for a set time determined in the contract between the two parties

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 5%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: NQA - number 125009
• ISO 9001 accreditation date: Friday 13 March 2020
• What the ISO 9001 doesn’t cover: “ISO 9001 certification applies to the Quality Management System covering the activities listed on the certificate, including our provision of software solutions providing technical information and design support services in the construction industry (which includes the SNUG service), plus our accreditation/training services and supplier prequalification. ; ; Activities, services, products, or locations not included in that ‘applicable to’ statement (or not listed in the certificate appendix of locations) are not within the certified scope. The certificate does not specify any additional exclusions beyond these defined scope boundaries.”
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 5af01ab9-672d-4f31-acd7-1e011b01af26
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: B8fe49e1-c19f-4112-96a3-d40b369492e2
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@quidos.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.