QES

SurveySphere

A flexible AI-powered inspection tool for residential and commercial properties. It analyses images and video to identify objects, hazards, damp, mould, and defects, and more. Inspections can be delivered remotely via two-way video, used on-site offline by inspectors, or completed through occupier-led data capturing or uploads.

Features

• AI-driven remote video inspection tool
• Whitelabelling to enable customer branding
• AI to automatically analyse images and videos
• Auto-blurring to redact faces
• Optional phase files available to support surveys
• Occupier-led option for occupier to manage property data capture
• Offline app enables inspector to capture information at property
• Automatic generation of the final inspection report
• Syncs with calendars to pull through inspector availability for bookings
• Hazard detection, including damp, mould and condensation

Benefits

• Secure and UK GDPR compliant
• Enhance the efficiencies and reduces costs
• Saves significant time, enabling more inspections in the same time
• Reduce your carbon footprint through less travel
• Future proofed with regular product evolution
• Supported with our customer care team, including training
• Auditing with GPS coordinates for insurance
• Fully customisable to configure fields/forms
• Improve quality of data collected on properties
• Two-way remote calls, solo on-site inspections or occupier-led

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at emmamoreton@qes-online.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

853632523462877

Contact

Emma Moreton
07889 435679
emmamoreton@qes-online.com

About your service

• Service categories:

  Application Development and Deployment

  AI platforms

  AI software services

  • Generative AI Software Services
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Uses latest microsoft-support browsers. Requires internet connection.
• System requirements:
  • Internet connection
  • Latest microsoft-supported browsers

User support

• Email or online ticketing support: Yes
• Support response times: Same day
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: A Customer Success Manager is appointed to your principle point of contact, along with access the Customer Success Service Desk to raise questions or issues. They will provide support, including initial administrative training, hosting, maintenance and support. All support is done remotely, unless on-site chargeable support is required.; Support is available Mon-Fri 9:00-17:00 excluding bank holidays.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Virtual training to adminstrative users, along with user guidance documents.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: QES will provide all data back to the client at the end of the contract period in a user-friendly format.
• End-of-contract process: At contract end, QES will ensure the safe return of customer data and removing their system. Backups will be retained a 30 day period, at which point a full decommissioning of the service will take place, with all databases deleted, including backups.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Mobile devices are used for capturing the data only, whether that is on the remote two-way call, offline app or occupier led.; ; For remote two-way call inspections, the inspector can only use a laptop/computer, not a mobile device.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Web-based application
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: The system has a user-friendly interface to navigate across, so multi-agency users can access the relevant data and reporting.; QES are compliant to WCAG 2.2 AA standards, using SonarQube to conduct automated checks and flag any non-compliance to developers to rectify. QES use the Chrome plugins: WCAG colour contract checker and wave evaluation tool. QES also use Google Chrome Lighthouse which has an accessibility review tool.
• API: Yes
• What users can and can't do using the API: Users can connect their data sources to SurveySphere using the open API to to import data, including property data, bookings and more. Changes to the API connection can be made by contacting their appointed Account Manager.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: SurverySphere is highly customisable, including whitelabelling of the report, the forms and fields, areas and sub-areas, report format, AI commands and more. Users can customise these themselves, or can work with their appointed Account Manager to do this.

Scaling

• Independence of resources: Each customer’s data is stored in a completely separate, dedicated SQL database with strict access controls, meaning data is logically isolated and cannot be seen, accessed, or affected by any other client.

Analytics

• Service usage metrics: Yes
• Metrics types: Real-time reports available on series of fields from the inspections within the system, including pie charts, bar charts, heat maps, statistic tiles, etc. All available in real-time with filters and ability to extract. AI is used to generate these reports and can be built on request directly into the system.; Usage metrics can also be provided on request via email if needed including audit information. API is also available to connect back in to your reporting solutions.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: Physical access control - NCSC access control
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Using the data extract system within the system, allowing users to extract all data.
• Data export formats: CSV
• Data import formats: Other
• Other data import formats:
  • API where applicable
  • Manually, directly onto the system

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: QES have an uptime of 99.99% with the exception of planned maintenance. RPO - service would be reinstated to within 5 minutes of when the event occurred. RTO - return to service time will be <1 hour. Planned outages are completed outside of business hours, and completed within 5 minutes of downtime.
• Approach to resilience: QES use Microsoft Azure data centre, with the primary data centre in Cardiff, Wales and secondary site in London, England. All data remains in the UK. QES use Microsoft Azure's highly secure data centre protocols which can be found on their website or can be sent by us on request.
• Outage reporting: Email alerts will be provided by the customer care team.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
  • Other
• Other user authentication: Microsoft single sign on.
• Access restrictions in management interfaces and support channels: The application is limited onto the inspector/ management roles who will be able to access management interfaces. The occupier/tenant is only able to access their limited view of the inspection during the call only.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
  • Other
• Description of management access authentication: Microsoft single sign on.

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Our information security policies are externally audited during our ISO 27001 annual audits. QES also regularly review these internally during management reviews. The DPO is responsible for the maintenance of the security policy, who reports to the COO and then to the MD. All 3 staff members meet regularly throughout the year to ensure these policies are followed, assigning actions, and monitoring actions to track progress and completion where needed. Our policies are also compliant with UK GDPR, Cyber Essentials, and CE+ standards.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: We have a change management team who review all change requests raised by our user group, and schedule them into a product evolution sprint. All changes are subject to a series of automated test controls (SonarQube static application security testing), build validation, release validation, unit tests requiring 100% pass rate, open source library versions, open source library vulnerabilities, open source library licenses and manual test controls including code review, quality assurance review and project management review.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: QES use a 3rd party testing company to annually assess the vulnerability of our solutions. All issues are resolved within 1 month of being raised and the application is re-tested with a pass in the same period. We also use SonarQube in our automated DevOps pipeline to scan for vulnerabilities within our code every time we make a change using OWASPs top 10 vulnerabilities.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Microsoft defender for cloud provides threat detection and prevention across the application. QES are notified through the Azure defender portal as well as email and teams alerts. We deploy patches to medium-critical issues within 24 hours and agree a schedule of works for the others.
• Incident management type: Supplier-defined controls
• Incident management approach: Users will raise system issues through the QES customer care team and their appointed account manager, via email or phone call. The issues will be fixed within the SLA, testing with our QA team and released back to the client's environment with release notes. We complete root cause analysis reviews to assess common events, and update the systems back with any fixes to known common events across multiple systems.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Assessment Bureau
• ISO/IEC 27001 accreditation date: Tuesday 8 July 2025
• What the ISO/IEC 27001 doesn’t cover: The certification covers all operations, assets and personnel involved in the delivery and management of our product services. No controls relevant to the delivery of this service have been excluded. Exclusions are limited strictly to controls deemed non-applicable by our Statement of Applicability (e.g. physical security of data centres managed by Microsoft Azure).
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: British Assessment Bureau
• ISO 9001 accreditation date: Tuesday 8 July 2025
• What the ISO 9001 doesn’t cover: The ISO 9001:2015 certification covers all processes and operations related to the design, delivery and operations related to our products. There are no exemptions within the defined scope. Any requirements of the standard deemed not applicable (such as Clause 7.1.5 if monitoring/measuring equipment is not used) are justified within our Quality Manual and do not affect our ability to ensure product/service conformity.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Ab2a5f87-d68e-4c58-bf63-9f34f2104902
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at emmamoreton@qes-online.com. Tell them what format you need. It will help if you say what assistive technology you use.