QUALITY COMPLIANCE SYSTEMS LTD

QCS Compliance

QCS Compliance Centre supports regulatory compliance and consistent quality through structured policies, audits, and risk management. It further supports process control, staff training, and continuous improvement, reducing operational risks and enhancing efficiency. This trusted service assists clients to meet regulatory standards, and drives long-term quality excellence for organisational success.

Features

• Regulatory Compliance Management. Supports adherence to industry standards.
• Policy & Document Control. Centralised policy libraries aligned to regulation.
• Audit Management. Automated scheduling, tracking, and reporting of audits.
• Risk Assessment. An online tool to conduct Risk Assessments.
• Non-Conformance Tracking. Logs issues and manages resolution processes.
• Training & Competency Management. A comprehensive library of e-learning courses.
• Performance Monitoring & Reporting. Dashboards and compliance KPIs.
• Task Management. Assign and monitor tasks to evidence improvement cycle
• Continuous Improvement Tools. Supports root cause analysis and improvement initiatives.
• Online access and Mobile applications available for ease of access

Benefits

• Regulatory Assurance. Supports compliance with industry standards and legal requirements.
• Risk Reduction. Minimises operational and compliance risks through proactive monitoring.
• Improved Efficiency. Streamlines processes with standardised processes and workflows.
• Enhanced Transparency. Provides clear audit trails and documentation for accountability.
• Better Decision-Making. Real-time reporting that supports informed decisions.
• Customer Confidence. Builds trust through consistent quality and compliance.
• Cost Savings. Reduces penalties, errors, and waste by maintaining compliance.
• Continuous Improvement. Facilitates ongoing process optimisation and quality enhancement.
• Employee Competency. Supports and evidences training and compliance with policies.
• Scalability. Adapts to organisational growth

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at laura@carebeans.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

782719749175499

Contact

Laura Young
0333 405 3333
laura@carebeans.co.uk

About your service

• Service categories:

  Application Development and Deployment

  Data management

  Database administration and development

  • Database Administration
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: No
• System requirements:
  • Stable Internet Connection – Reliable connectivity for cloud-based operations.
  • Modern Web Browser – Latest Chrome, Edge, or Firefox supported.
  • Operating System Compatibility – Windows, macOS, or Linux environment required.
  • Minimum RAM – At least 8GB for smooth application performance.
  • Processor Speed – Dual-core or higher for efficient processing.
  • Storage Space – Minimum 10GB free disk space for data.
  • User Authentication – Secure login with multi-factor authentication enabled.
  • Database Support – Compatible with SQL or cloud database services.
  • API Integration – Ability to connect with third-party systems.
  • Compliance Standards – Meets ISO, GDPR, or relevant regulatory frameworks.

User support

• Email or online ticketing support: Yes
• Support response times: 24 hour response time for all support enquiries with an estimated resolution time communicated at point of first contact.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: QCS has conducted accessibility testing on the integrated web chat feature to ensure it meets the needs of users relying on assistive technologies. Testing focused on compatibility with screen readers such as JAWS, NVDA, and VoiceOver, verifying that all chat content, buttons, and notifications are properly announced using ARIA roles and semantic HTML. Keyboard-only navigation was rigorously checked to confirm that users can access all chat functions without a mouse, maintaining logical tab order and visible focus indicators. Color contrast ratios were validated against WCAG 2.1 standards to support low-vision users, while zoom and magnification tests ensured the interface scales without distortion. Speech-to-text and text-to-speech functionality was tested for voice control users, alongside alternative input devices like adaptive keyboards and switch controls. Error messages and status updates were reviewed for clarity and accessibility, ensuring they are screen-reader friendly. Real-world usability sessions with assistive technology users provided critical feedback, helping refine the chat experience for inclusivity and compliance. These measures guarantee that our web chat is fully accessible, enabling seamless communication for all users regardless of ability.
• Onsite support: Yes
• Support levels: QCS service offers various support options to meet diverse organizational needs. Support via phone, email and chatbot during business hours and access to a comprehensive knowledge base for self-service troubleshooting. ; Dedicated technical support.; QCS support ensures reliability, responsiveness, and expert guidance at every stage.
• Support available to third parties: No
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: QCS is designed to make onboarding simple, efficient, and user-friendly. From the moment users log in, they are guided through an intuitive setup process that includes step-by-step wizards for configuring compliance policies, workflows, and user roles. Pre-built templates for audits, risk assessments, and reporting allow organizations to start quickly without building processes from scratch.; QCS provides a comprehensive knowledge base, video tutorials, and interactive help center for self-service learning, while live support via chat, email, or phone ensures immediate assistance when needed. Role-based dashboards display relevant tasks and compliance metrics, helping users focus on priorities from day one.; Administrators can customize branding, notification settings, and integrations through a simple settings panel. For advanced needs, QCS offers API connectors and custom workflow builders, enabling seamless integration with HR, ERP, or document management systems.; Premium support tiers include dedicated onboarding specialists who deliver personalized training sessions and compliance health checks. This combination of automation, resources, and expert guidance ensures users can confidently manage compliance from the start, reducing complexity and accelerating adoption.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
  • Other
• Other documentation formats:
  • Knowledge Base Centre
  • Vidoes
  • Quick Start Guides
• End-of-contract data extraction: QCS ensures clients retain full control of their data when a contract ends. We provide secure and efficient data extraction options to meet compliance and portability requirements. Clients can export all relevant information, including audit logs, compliance reports, policy documents, and user activity records. Data is available in multiple formats such as CSV, Excel, PDF, or JSON, ensuring compatibility with other systems.; The extraction process is initiated by authorized administrators through the QCS dashboard or via a formal request to our support team. For advanced needs, API-based extraction is available to integrate directly with client systems. All transfers are encrypted and delivered through secure download links or SFTP to maintain confidentiality.; We follow strict retention policies, typically allowing 30–90 days for data retrieval before permanent deletion, in compliance with GDPR and other regulations. Clients can also request customized data sets or structured reports tailored to their requirements.; Our support team provides detailed documentation and guidance throughout the process, ensuring a smooth transition and complete data integrity. This approach guarantees transparency, security, and compliance even after service termination.
• End-of-contract process: When a QCS contract ends, clients retain full access to their data for a defined period (typically 30–90 days) to allow secure extraction. Data can be exported in standard formats such as CSV, Excel, PDF, or JSON. After this period, data is permanently deleted in compliance with GDPR and other regulations. Support is available during this phase to assist with data migration and ensure a smooth transition.; Included in the Price; ; The contract price covers core QCS features: compliance dashboards, audit management, risk assessment tools, document control, reporting, and standard support. It also includes regular updates, security patches, and access to the knowledge base and help center.; Additional Costs; ; Optional services such as premium support (24/7 assistance, dedicated account manager), custom integrations via API, advanced workflow customization, and tailored compliance training sessions may incur extra charges. Data extraction beyond standard formats, extended retention periods, or bespoke reporting also fall under additional costs.; This structure ensures transparency, giving clients flexibility to choose the level of service and customization they need while maintaining compliance and security throughout the contract lifecycle.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Mobile QCS offers on-the-go access with simplified interfaces, enabling quick compliance checks, document viewing, and task approvals from smartphones or tablets. It focuses on convenience, real-time notifications, and offline functionality for field teams. Desktop QCS provides a full-featured experience with advanced tools for audit management, reporting, and integration capabilities. It supports complex workflows, bulk data handling, and detailed analytics, ideal for administrative and compliance managers. While mobile enhances flexibility and responsiveness, desktop ensures comprehensive functionality and deeper control. Together, they deliver a seamless compliance ecosystem across devices, improving efficiency and accessibility for all users.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: QCS interface is a user-friendly, web-based dashboard designed for efficiency and accessibility. It features intuitive navigation with clearly defined sections for audits, policies, risk management, and reporting. Users can access real-time compliance metrics through interactive charts and widgets, while advanced search and filtering tools simplify document retrieval. Role-based access ensures personalized views for administrators, auditors, and staff. The interface supports mobile responsiveness, enabling seamless use across devices, and includes accessibility features compliant with WCAG standards. Integrated help options, notifications, and API connectivity enhance usability, making compliance management streamlined, transparent, and adaptable for diverse organizational needs.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: To ensure accessibility and inclusivity, the QCS interface undergoes rigorous testing with assistive technology users. This process validates compliance with WCAG 2.1 guidelines, Section 508, and EN 301 549 standards. Testing includes compatibility checks with screen readers such as JAWS and NVDA, ensuring all interface elements are properly announced and navigable. Keyboard-only navigation is verified to guarantee full functionality without a mouse, while color contrast and font adjustments are assessed for users with visual impairments. Voice recognition tools and alternative input devices are also tested to support individuals with mobility challenges.; Beyond automated audits, usability sessions with real assistive technology users identify practical barriers and improve overall user experience. These sessions focus on critical tasks such as accessing compliance dashboards, reviewing documents, and submitting audit reports. ARIA roles and semantic HTML are implemented to enhance dynamic content accessibility.; This comprehensive approach ensures QCS is perceivable, operable, and understandable for all users, fostering an inclusive compliance environment. Accessibility testing is an ongoing commitment, integrated into every update cycle to maintain standards and deliver equitable access across desktop and mobile platforms.
• API: Yes
• What users can and can't do using the API: Our APIs allow our customers to securely manage and query users and to manage and query carer allocations.
• API documentation: Yes
• API documentation formats:
  • ODF
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: QCS offers flexible customization options to meet diverse organizational needs. Users can personalize dashboards, workflows, and reporting formats to align with internal compliance processes. Key customizable elements include policy templates, audit schedules, risk assessment criteria, and notification settings. Branding options such as logos and color schemes allow organizations to maintain a consistent identity across the platform.; Customization is managed through an intuitive settings panel accessible via the web interface. Users can configure permissions, assign roles, and define approval hierarchies to ensure secure and efficient operations. Advanced users or administrators can integrate QCS with third-party applications through API connectors, enabling seamless data exchange with HR, ERP, or document management systems.; Who can customize? Typically, system administrators and compliance managers have full customization rights, while standard users can adjust personal preferences like dashboard layout and alert preferences. This role-based approach ensures flexibility without compromising security or compliance integrity.; By empowering organizations to tailor workflows, reporting, and branding, QCS delivers a scalable solution that adapts to unique regulatory requirements and operational practices, enhancing usability and compliance efficiency.

Scaling

• Independence of resources: QCS guarantees consistent performance through a scalable cloud architecture. We use load balancing, auto-scaling, and resource isolation to ensure demand from one client does not impact others. Each organization operates in a secure, dedicated environment with real-time monitoring and proactive resource allocation. Redundant infrastructure and strict SLAs maintain uptime and responsiveness, even during peak usage. This approach ensures uninterrupted service, compliance integrity, and optimal user experience across all tiers.

Analytics

• Service usage metrics: Yes
• Metrics types: QCS provides detailed user metrics to monitor engagement and performance. Key metrics include login frequency, task completion rates, and audit participation, helping organizations track compliance activity. Policy acknowledgment rates ensure staff review critical documents, while training completion metrics confirm competency. Usage analytics highlight most-accessed modules and identify areas needing improvement. Administrators can view role-based performance dashboards, export reports in formats like CSV or PDF, and schedule automated summaries. These insights support compliance oversight, resource planning, and continuous improvement, ensuring transparency and accountability across all user levels.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Staff screening not performed
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: In-house
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: QCS allows data export through its web dashboard, enabling users to download compliance reports, audit logs, and policy documents in PDF or Excel formats. Advanced tiers support bulk exports and integration with analytics tools like Qlik Sense. Export permissions are role-based, restricted to administrators for security and GDPR compliance.; QCS Care Management provides export options for care plans, assessments, and rostering data in CSV or PDF formats. Offline data syncs to the cloud before export. Managers or administrators initiate exports via the portal, and API integration is available for automated transfers to external systems, ensuring NHS and PRSB compliance.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • PDF
  • Excel
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • XML
  • TXT
  • JSON
  • PDF

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)

Availability and resilience

• Guaranteed availability: 99.9% availability guaranteed between 0800 and 1800 weekdays.
• Approach to resilience: Information available upon request.
• Outage reporting: Email alerts to customers.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: RBAC and MFA combined with username/password.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: Cyber Essentials Plus
• Information security policies and processes: We maintain and regularly update a suite of information security policies which are communicated to and clearly understood by our staff.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Application manifest (virtualised infrastructure and application codebase) maintained. ; ; All changes are assessed for potential security impact as part of our SDLC and deployment processes.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Monitor threat intelligence feeds from industry sources (CISA, CERT, security vendors); Conduct vulnerability scanning and penetration testing; Review security logs for anomalies; Track CVE databases and vendor security advisories; ; Patch Deployment Speed:; Critical security patches: Often within 24-48 hours for urgent vulnerabilities; High-priority patches: Typically 7-30 days depending on testing requirements; Routine patches: Monthly or quarterly cycles; Speed depends on patch testing, change management processes, and system criticality; ; Information Sources:; National vulnerability databases (NVD, CVE); Vendor security bulletins; Security research communities; Internal security teams and monitoring
• Protective monitoring type: Undisclosed
• Protective monitoring approach: Identifying Potential Compromises:; Network traffic analysis for anomalies or suspicious patterns; File integrity monitoring; Regular security audits and forensic analysis; ; Incident Response Process:; Identification: Confirm and classify the incident severity; Containment: Isolate affected systems to prevent spread; Eradication: Remove the threat and close vulnerabilities; Recovery: Restore systems and verify they're clean; Lessons Learned: Post-incident review and process improvement; ; Response Timeframes:; Critical incidents (active breach, ransomware): Immediate response, 24/7 on-call teams; High-severity alerts: Response within minutes to hours; Medium-severity: Response within hours to 24 hours; Low-severity: Response within days, during business hours
• Incident management type: Supplier-defined controls
• Incident management approach: We maintain incident response playbooks for commonly anticipated incidents as well as a full suite of incident response policies. ; ; Users can report incidents by email or telephone 24/7. ; ; We provide written incident reports once the incident has been resolved. These reports include the root cause, mitigating steps taken and steps taken to prevent recurrence in future.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 10%
• Between £250,000 and £500,000: 10%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: None of the criteria
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 34d8f76f-14bb-49eb-bf76-de63292b660c
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at laura@carebeans.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.