PAX SYSTEMS LTD

Pax-CX

Pax-CX is a cloud-based digital application and case management platform for home-to-school transport services. It enables councils to accept transport applications digitally and manage them through configurable workflows in a secure back-office system.
The service is designed for transport teams to reduce manual processing, improve consistency, and support operational delivery.

Features

• Digital, accessible public application forms
• Secure submission of supporting documents
• Centralised case management dashboard
• Configurable workflows, statuses and transitions
• Rules-based automation and email notifications
• Transition-based data capture forms
• Full audit trail and reporting

Benefits

• Designed specifically for Local Authority
• Reduces manual handling, re-keying
• Improves transparency of decision making
• Supports all transport services
• Configurable to reflect local policy and processes
• Automatically identifies best route option
• Creates a safe, appropriate and efficient service
• Scales from small to large Councils
• Secure, isolated deployment per authority
• Audit trail of all activity

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at phil.dyson@paxsystems.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

778244603785271

Contact

Phil Dyson
07973703165
phil.dyson@paxsystems.co.uk

About the service

• Service categories:
  • Applications
    • Content workflow and management
      • Content services
        • Enterprise Content Management Applications
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: No
• System requirements:
  • Stable connection to public internet
  • A modern browser with latest updates applied
  • Software license to view/edit docx, xlsx and pdf files

User support

• Email or online ticketing support: Yes
• Support response times: During normal business hours and where any further support is required issues will be prioritised based on severity.; ; Priority 1 response is immediate.; Priority 2 response is within 16 hours.; Priority 3 response is 24 hours.; ; During weekend and public holiday hours response to critical issues will be immediate and all other non-critical issues will be actioned on the next working day.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: No
• Support levels: Pax support is included as part of the annual subscription fee. This includes:; - unlimited online and phone support.; - standard system configuration.; - initial start-up training package.; ; All support between the customer and Pax Systems is overseen by a technical account manager.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Pax Systems supports authorities through onboarding, including:; • Initial configuration workshop; • Setup of forms, workflows and user access; • Support during UAT; • Initial user training and documentation
• Service documentation: Yes
• Documentation formats: HTML
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: On contract expiry, an administrator can extract customer data directly from the service. Standard export is provided in CSV format for portability and reuse.
• End-of-contract process: Pax Systems, at the end of the contract, will support the Council to moving to a new software service by advising on the export of all the static data in a .csv format and data items such as pictures and documents can be exported directly to disc. For an additional cost the Pax-CX environment and data can be retained for up to a further 30 days to support any Council post-contract queries.; ; All Council data will be securely destroyed between 30 and 120 days after the contract has ended. A copy of the back-end database and written confirmation that Pax no longer retains any customer data, login credentials or any other sensitive details relating to the customer, will be provided at no cost.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: A full platform API exists at framework level. For customer use we provide supported, documented endpoints mapped to business functions and integration requirements, rather than unrestricted low-level access. Endpoints are versioned and maintained as part of the service.
• API documentation: No
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: The form and case management workflow can be customised by each customer through the use of the admin tools in the case management software and working with the Pax team to develop the online forms.

Scaling

• Independence of resources: Single Tenancy model; ; Each customer has a dedicated and isolated environment.; ; Within each customer environment the resource requirements are baselined on an assessment of typical usage, however, resources are allocated dynamically and scale up as necessary to match any demand.

Analytics

• Service usage metrics: Yes
• Metrics types: Pax provides the following periodic service metrics on a monthly basis:; ; - Time spent per user per day; - System up-time statistics; - Number of new, closed and outstanding support calls
• Reporting types: Regular reports
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Day-to-day operational exports are available via built-in export features and search tools. Exports can be downloaded as CSV and, where appropriate, Excel format.
• Data export formats:
  • CSV
  • Other
• Other data export formats: Excel
• Data import formats:
  • CSV
  • Other
• Other data import formats: Excel

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The service is designed for high availability and is operated using commercially reasonable endeavours. Availability targets are defined contractually and monitored continuously.; ; All planned maintenance will be scheduled out of hours and communicated in advance.
• Approach to resilience: The service is deployed in a private, single-tenant cloud environment and designed to minimise single points of failure. Infrastructure is monitored 24x7, with automated alerting and documented incident response procedures. Data is regularly backed up and can be restored in the event of service disruption. Disaster recovery processes are tested periodically to ensure service continuity.
• Outage reporting: We report any outages to all system users by email.; ; All planned outages are scheduled outside of agreed work patterns.

Identity and authentication

• User authentication needed: Yes
• User authentication: Multi-Factor Authentication (MFA)
• Access restrictions in management interfaces and support channels: MFA Single Sign on
• Access restriction testing frequency: At least once a year
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Cyber Essentials Plus
• Information security policies and processes: Pax Systems has a Cyber Security Framework created to specifically control and direct our approach to information and cyber security risk. We align our security framework with the National Cyber Security Centres 14 Cloud Security Principles framework to manage risk and response with policies in place providing clarity on the processes, procedures, roles and responsibilities for risk and sets out how risks are managed.; ; We have a Chief Information Officer at board level with responsibility and oversight of our data and system security and a second Director at board level responsible for ensuring controls are in place for all Information Security policies and procedures, both supported by external security professionals. ; ; Our IT risk management controls provides key management information about the status and performance of our information security management. It combines important metrics about assets, risk assessments, security incidents and documentation status to provide system-wide visibility of Pax Systems information security health.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We have the relevant policy, procedures and systems in place to ensure our security governance.; ; Software changes and change requests are managed through JIRA and deployed to a test server for review and acceptance testing prior to regression testing and deployment to live.; ; Configuration register is used for the product environment services which include deployment checklist during the setup of services, pre go-live check before switching on public (internet connected) services and performing vulnerability risk assessments of live services.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We have a process for continuous monitoring of all critical elements of our SaaS infrastructure. This identifies any new configuration issue or vulnerability that could potentially cause a security risk.; ; Vulnerability identified through a daily feed from vuldb.com are assessed, then recorded in Jira, risk assessed to establish the immediate threat posed, vulnerability type and which software components are potentially affected.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Our protective monitoring processes includes third party penetration testing, pro-active patching of the SaaS environment and software, based on a daily feed of newly identified vulnerabilities from a vulnerability intelligence service.; ; Additionally we subscribe to services that alert us if any system account credentials are compromised.; ; We have internal logging alerts to monitor user access and identify unexpected activity.; ; The hosting provider has dedicated monitoring that supports the hosted environment and detect hardware issues and critical faults with the PaaS Platform.; ; Our response is determined by the potential risk that are exposed by the incident.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: There are pre-defined processes in our Business Continuity and Disaster Recovery Plan for handling common incident types (data incidents, system failure, performance issues, denial of service attacks, ransomware attacks, zero day critical vulnerabilities); ; Our risk management software includes a security incident module which supports management and progress tracking of security incidents from initial reporting, through investigation and remedial actions to final closure, reports and lessons learnt.

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: A pre-configured version of the software is available for a short period to evaluate the system.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: Bffab327-6b09-4f9b-ad1c-3ab9849549a2
• Cyber essentials plus: Yes
• Cyber Essentials Plus Certificate Number: Ecbbb72b-490a-416d-ae9c-d938f90bd995
• Other security certifications: No

Social value

• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at phil.dyson@paxsystems.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.