HIVEHR LIMITED

Employee Voice by Hive

Hive is an employee voice platform and partnership. Our employee / staff engagement surveys, confidential employee feedback tools and expert people scientists help organisations amplify employee voice, improve staff engagement, gather insightful employee feedback, create a better employee experience and improve organisational performance.

Features

• Confidential, flexible, automated and real-time employee voice platform
• Powerful reporting: sentiment analysis, heatmaps, benchmarking & eNPS
• Expert, strategic and fully tailored Professional Services support
• Flexible staff surveying: ask what you want, when you want
• Hive Actions and key driver analysis to make impactful change
• Hive Fives: peer-to-peer recognition to drive culture and values
• Hive Open Door: always-on channel for employees to speak up
• Hive Messenger: respond to feedback through identity-protected virtual chats
• SMS text participation, language translation, data export and more
• Dedicated Account Management and Support teams based in the UK

Benefits

• Measure, understand and improve employee engagement on an ongoing basis
• Ask your people the right questions, at the right times
• Get actionable insights in real-time—less admin, more impact
• Equip managers with timely insights to drive agile decision-making
• Empower employees with a permanent, confidential voice
• Drive culture and values through ongoing peer-to-peer recognition
• Respond to confidential employee feedback directly and quickly
• Continually engage your workforce in organisational change
• Increase response rates with easily accessible and confidential online surveys
• Build a culture of listening, inclusivity and engagement

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@hive.hr. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

933163210290731

Contact

Lucy Mcleod
0333 305 8471
hello@hive.hr

About your service

• Service categories:

  Application Development and Deployment

  Analytics and business intelligence

  • Business Intelligence
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Our service has a small number of operational constraints that buyers should be aware of. Planned maintenance may occur outside core business hours and is always communicated in advance. The service requires a stable internet connection and modern web browser; performance may be affected on unsupported or legacy browsers. Support covers software and platform issues only and excludes buyer-specific hardware faults or local network problems. Where integration with third-party systems is required, delivery may depend on the availability or configuration of those external systems. No specialist hardware is required unless explicitly stated within the service definition.
• System requirements:
  • Requires stable internet connection for all user and admin activities.
  • Works on modern, supported browsers: Chrome, Edge, Safari, Firefox.
  • No local installations, plug-ins or client software required.
  • No specific antivirus or endpoint security tools needed.
  • Compatible with standard corporate firewalls allowing HTTPS traffic.
  • Optional integrations may require valid API keys or credentials.
  • Mobile access requires a current iOS or Android browser.
  • Users need devices with up-to-date operating systems.
  • Access requires unique user accounts with strong authentication.
  • Supports SSO where buyers have compatible identity providers.

User support

• Email or online ticketing support: Yes
• Support response times: Each support type request has a defined response time, these are between 1 and 10 working days. A full list can be found here: https://learn.hive.hr/knowledge/hive-support-service-level-agreement
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: No
• Support levels: We provide the same support for all customers, aligned with the SLAs linked above. We do not have different costs for levels of support. We do not provide a dedicated technical account manager or cloud support engineer. You can learn more here: https://learn.hive.hr/knowledge/hive-support-service-level-agreement
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Tailored and personalised online training and user documentation with full support from an assigned account manager and professional services representative.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: Our team provides reports throughout the process. Upon end of the contract, our data team provides the data collected. This data is anonymised for data protection.
• End-of-contract process: At the end of a contract, renewal is discussed. Each contract is tailored to the clients need before signing so no extra costs should incur unless the client decides to add to their selected package.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: TBC
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: The service is accessed through Hive’s secure, cloud-based web interface. Employees complete surveys via encrypted web forms that collect responses, demographics and free-text comments with only essential session cookies used. Administrators access a protected management console with MFA, VPN controls and role-based permissions to configure surveys, manage users and view aggregated dashboards. The analytics interface provides sentiment analysis, thematic clustering and downloadable reports, ensuring anonymity through reporting thresholds. Optional AI-assisted tools offer suggested actions based on aggregated data, with full human oversight. All interfaces operate within Hive’s AWS-hosted platform and are delivered entirely through modern web browsers.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: TBC
• API: No
• Customisation available: Yes
• Description of customisation: TBC

Scaling

• Independence of resources: We ensure users are not affected by demand from others through a scalable, multi-tenant architecture that automatically adjusts capacity to maintain performance. Workloads are isolated using resource throttling, workload separation and monitoring to prevent any single tenant from impacting others. Automated scaling increases compute, storage or bandwidth during peak periods, and performance thresholds are continuously monitored to trigger proactive adjustments. Our infrastructure provider’s SLAs, combined with our own performance controls, ensure consistent availability and response times regardless of overall system load.

Analytics

• Service usage metrics: Yes
• Metrics types: We provide comprehensive service usage metrics to help buyers monitor adoption, performance and overall utilisation. Administrators can access a real-time dashboard showing user activity, login frequency, feature usage and engagement trends. Reports can be exported in standard formats, enabling further analysis or integration with internal reporting tools. Metrics can be filtered by date range, user group or activity type, and alerts can be enabled to highlight unusual patterns. These insights support effective service management, evidence-based decision-making and ongoing optimisation of the service.
• Reporting types: Real-time dashboards
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Data Erasure

Data importing and exporting

• Data export approach: User administrators in a Hive are able to export all data out of Hive from the user section by using the 'Export Users' button. This is the user data, not survey data.
• Data export formats: CSV
• Data import formats:
  • CSV
  • Other
• Other data import formats: XSLX

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: We guarantee high availability through a resilient, cloud-based architecture. Our standard SLA commits to 99.9% monthly uptime, excluding planned maintenance windows that are communicated in advance. Availability is monitored continuously, with automated alerts to ensure rapid response to incidents. If availability falls below the guaranteed level, buyers are entitled to service credits based on the percentage of downtime experienced, applied against their next invoice. Service credits are the sole remedy for missed availability targets and are detailed in our service-specific terms.
• Approach to resilience: Our service is designed to be resilient through deployment on Amazon Web Services (AWS) EU-West-1, a cloud environment certified to ISO 27001, ISO 27017 and ISO 27018. AWS provides a highly available, fault-tolerant infrastructure with multiple availability zones and redundant power, networking and environmental controls. Daily encrypted backups are stored in a separate availability zone to support rapid recovery. Hive’s ISO 27001-certified ISMS provides continuous monitoring, vulnerability scanning and incident-response readiness, while encryption, access controls, logical separation of customer environments and automated security alerting maintain service integrity.
• Outage reporting: Our service provides transparent and timely outage reporting through multiple channels. We maintain a public status page that displays real-time service availability, ongoing incidents, historical uptime data and scheduled maintenance notifications. The status page is continuously updated as events progress, ensuring buyers have immediate visibility of any disruption.; ; Administrators can subscribe to automated email alerts for incident notifications, service degradation, planned maintenance and post-incident summaries. These alerts include status updates, affected components and expected resolution times.; ; For buyers requiring deeper integration with internal monitoring tools, we offer an API that exposes service-health information, allowing automated polling or dashboard integration. This enables organisations to consolidate our availability data into their own operational reporting.; ; All outages are logged within our incident-management system, which follows documented escalation and communication processes. After major incidents, we provide a summary detailing cause, impact, actions taken and measures to prevent recurrence.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces is restricted through role-based access control, ensuring only authorised administrators can perform configuration or management tasks. Administrative accounts require strong authentication and are monitored for unusual activity. Access is granted on the principle of least privilege and removed immediately when no longer required. Support channels are restricted to verified customer contacts, and identity checks are performed before making any changes or sharing sensitive information. All administrative and support actions are logged for audit and reviewed as part of our protective monitoring processes.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We operate an ISO 27001-certified Information Security Management System (ISMS) that governs all security policies and processes across our organisation. Our security framework includes policies covering governance, risk management, access control, asset management, incident response, business continuity, secure development, data protection, supplier management, and acceptable use. These policies follow recognised best practice, including ISO 27017 for cloud security and ISO 27018 for personal data protection.; ; Security processes include regular risk assessments, vulnerability scanning, penetration testing, change management, monitoring, and security awareness training. All staff must complete mandatory security training and follow defined operational procedures. Incidents are managed through a formal incident-response process with clear escalation, communication and post-incident review steps. Policies are reviewed at least annually or after significant change to ensure continuous improvement and alignment with legal, regulatory and customer requirements.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Hive HR manages configuration and change control through its ISO 27001 certified Information Security Management System. Service components are tracked across their lifecycle through formal asset management processes. Any platform change including new features, updates or client configurations goes through a security review and a Data Protection Impact Assessment to assess risks to confidentiality, integrity and availability. Changes follow a controlled workflow that includes risk assessment, approval, testing and audit logging, with implementation limited to authorised staff. Continuous monitoring, annual audits and privacy by design principles ensure all modifications remain safe, compliant and aligned with Hive’s security governance.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: We manage vulnerabilities through an ISO 27001-aligned process that combines continuous monitoring, automated scanning and regular penetration testing. Threats are assessed using risk-based criteria, including severity, exploitability and potential service impact. Critical vulnerabilities are patched as soon as practicable, typically within 24–72 hours, with high and medium risks addressed through defined SLAs and scheduled maintenance. All updates are tested before deployment to minimise disruption. We gather threat intelligence from trusted sources including AWS security bulletins, NCSC advisories, CVE feeds, vendor alerts and commercial threat-intelligence services. Our incident-response process ensures rapid escalation when emerging threats require immediate action.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: We use continuous monitoring, centralised logging and automated alerting to identify potential compromises, including anomalous activity, suspicious authentication, configuration changes and indicators of compromise. Events are analysed through our SIEM and correlated with threat-intelligence feeds to detect genuine threats. When a potential compromise is identified, it is immediately escalated through our incident-response process for investigation, containment and remediation. Critical incidents are responded to as soon as practicable, typically within minutes, with high-severity events handled within defined SLAs. Post-incident reviews ensure corrective actions and improvements are implemented.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: We operate a formal incident-management process with predefined procedures for common events such as service disruption, security alerts, access issues and data-handling incidents. All incidents follow clear stages: identification, assessment, containment, remediation and post-incident review. Users can report incidents through our support portal, email or service desk, where issues are logged, triaged and prioritised. High-severity incidents are escalated immediately to our on-call incident manager. For any major incident, we provide an incident report detailing root cause, impact, actions taken and measures to prevent recurrence. This process ensures consistent, timely and transparent handling of all incidents.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Approachable Certification Ltd
• ISO/IEC 27001 accreditation date: Friday 8 March 2024
• What the ISO/IEC 27001 doesn’t cover: Hive’s ISO/IEC 27001 certification covers the information security management system (ISMS) supporting the delivery, operation, hosting and support of the Hive service. As is standard for ISO/IEC 27001, the certification does not cover the following:; ; Customer-controlled environments, including customers’ internal systems, networks, devices, user accounts or access credentials.; ; End-user devices (such as laptops, mobiles or shared kiosks) that are not owned, managed or controlled by Hive.; ; Customer business processes or decisions, including HR, governance or organisational actions taken based on survey insights.; ; Data entered incorrectly by customer administrators or actions taken by customers within their own systems.; ; Third-party services that are not approved sub-processors within Hive’s documented supply chain.; ; Physical security of customer premises or infrastructure outside Hive’s operational control.; ; All systems, processes, personnel and approved sub-processors within the defined ISMS scope that support the Hive platform are fully covered by the certification.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 7253bc50-c173-4e05-beef-520442b86846
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 73b33da1-9781-4adb-82e0-6593192643a6
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@hive.hr. Tell them what format you need. It will help if you say what assistive technology you use.