WORLDLINE IT SERVICES UK LIMITED

Fund Disbursement Solution

Our solution delivers a sovereign, closed-loop digital platform for fund disbursement to targeted public programs.
It enables secure issuance, eligibility checks, and fund disbursement across large-scale programs (energy, housing, mobility, culture, healthy foods).

Features

• Beneficiary e-portal/apps : Registration, eligibility, wallet status, transactions
• Administration e-portal: eligibility criteria, approval/refuse beneficiary
• Funding campaign and budget management, Dashboards, partners management
• Partner Merchant e-portal : offfers, transactions
• Multi-channel funds disbursement: paper, card, wallet (web, mobile), PSP
• Integration with subsystems from administrations
• Real-time authorization and payment processing
• End2End traceability within closed-loop payment network
• Hosted in sovereign infrastructures
• Compliant with public sector standards

Benefits

• Simplified aid access: Beneficiaries automatically access eligible personalized aids
• Transparent tracking: Real-time consultation balances, history, file status
• Multi-channel payments: Mobile, card, web, paper, electronic wallet
• Administrative automation: Reduced manual work file validation data synchronization
• Budget visibility: Dashboards indicators consumption rates collection management
• Complete traceability: Audit trail decisions transactions guaranteeing regulatory compliance
• Partner management: Digital conventions, offers, integrated transactions reimbursements
• Aid scalability: Add new aids audiences without system overhaul
• Data protection and security aligned with public sector standards.
• Optimized ROI: Targeted aid distribution measure impact reduce waste

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at WLopportunities@worldline.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

972542852369008

Contact

Christine Best
+447812325539
WLopportunities@worldline.com

About your service

• Service categories:

  Application Development and Deployment

  Application development

  • Development languages, environments and tools
  • Software construction components
  • Business rules management
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: The service may be subject to routine maintenance windows and updates. These operations do not require buyer-side action.
• System requirements: None

User support

• Email or online ticketing support: Yes, at extra cost
• Support response times: Response time must be proportionate to the urgency of the situation and do not exceed 2 working days.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes, at an extra cost
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: Screen reader compatibility for interface navigation and form inputs; Keyboard-only navigation testing to ensure full functionality without mouse dependency
• Onsite support: Yes, at extra cost
• Support levels: End-user support (level 1): option available on demand.; ; Technical support (Level 2): included in the License; Expert & Strategic Support (Level 3): included in the License
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: We provide onsite training to key users of the buyer. Additionnal trainings may be discussed as part of the call-off contract.; We provide training material (user guide, service description) and can add tooltip on the service (at extra cost). ; For end-customers, we can provide online training (at extra cost)
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: The reversibility phase is part of the project, the details have to be discussed when elaborating the call-off contract. Data can be extracted via API or through extractions provided by our company.
• End-of-contract process: Transfer of documentation and data is included in the contract.; Technical support and training of the new service provider come with additional costs.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Our service follows a responsive design philosophy — one unified service that adapts seamlessly to any device. ; Some functionality may be activated on mobile or desktop based on device capability.
• Service interface: Yes
• User support accessibility: WCAG 2.2 A
• Description of service interface: The interfaces will be developed using a design thinking approach with our UX/UI experts, tailored to your needs for the different user groups (beneficiaries, merchants, and administration). ; The interfaces typically include a public section to present the program and an eligibility simulator, plus an authentication-enabled area that enables users to view and manage their aid according to the rules defined by the agency.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Accessibility is seamlessly integrated from the very beginning of the product design phase, supported by our team of experts formally trained in WCAG 2.0 standards. During the first design deliverables, our ergonomists and UX specialists ensure that all key accessibility principles—such as intuitive navigation, consistent terminology, robust interaction methods (including error‑handling in forms), and proper page semantics like heading hierarchy—are already fully applied.; Our devloppers are also trained on this standard to ensure that the requirement are taking into account during the whole process of creating an interface.; Our Q&A specialists are certified in accessibility evaluation and WCAG 2.0 compliance, they play a crucial role during the audit phase. ; Theses expertises guarantee that both the design groundwork and the subsequent accessibility assessment are aligned with international best practices, ensuring a reliable, comprehensive approach from concept to final audit.
• API: Yes
• What users can and can't do using the API: Each feature of the service is available through API.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Our platform supports extensive customization to match each public authority’s branding and operational needs. Customizable elements include visual identity (logos, colors, imagery), user interface layout (menus, dashboard widgets), local-language text, workflow configuration (eligibility rules, approval processes, campaigns), region-specific merchant networks, reporting dashboards with authority KPIs, and API integrations with existing government systems.; ; Users customize via a client-selected implementation partner. Our company or a chosen web agency collaborates with the public authority during deployment to design and configure the interface based on requirements, design iterations, and testing.; ; Who can customize: government administrators configure eligibility rules and campaign settings post-launch through the admin portal; the implementation partner designs and builds the custom interfaces during deployment; system administrators manage merchants and reporting parameters.; ; This approach ensures sovereignty and brand alignment while maintaining platform security and regulatory compliance across all instances.

Scaling

• Independence of resources: Measures depend on the chosen hosting type at call-off: a dedicated instance or a tenant on a multi-client platform.; In the case of a multi-tenant platform, several measures ensure isolation and performance for each tenant, such as:; ; - applicative thresholds to protect against abusive usage of the features (thresholds set according to agreed usage); - use of microservices to maximise scalability of the core features; - capacity planning to ensure permanent overscaling of the platform to absorb traffic peaks; - use of scalable infrastructures

Analytics

• Service usage metrics: Yes
• Metrics types: We can provide a range of metrics covering:; - use of aids by campaign and by zone; - use of aids by campaign and by merchant or merchant type; - volume of support by day and by zone and by type (chat, phone, ticket); More metrics can be produced on demand, specific feeds or BI tools can also be deployed for more flexibility
• Reporting types:
  • Real-time dashboards
  • Regular reports
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: Logical access control is also used for protecting data (databases can only be accessed through the predefined channels and according to user permissions)
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: The client can export his data through API or by request to the service provider
• Data export formats:
  • CSV
  • Other
• Other data export formats: JSON
• Data import formats:
  • CSV
  • Other
• Other data import formats: JSON

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Availability of the Services (monthly uptime): 99.5%.; ; Incident management; Mean Time to Notify (MTTN) Service Level for all Services: 30 minutes for Severity 1 incidents from Worldline awareness .; ; Mean Time to Restore (MTTR) Service Level for all Services:; ; - 4 hours for Severity 1 incidents;; - 1 Business Day for Severity 2 incidents, if no Change Management Process is needed;; - 3 Business Days for Severity 3 incidents, if no Change Management Process is needed.; ; Service support availability:; - Level 1 support: 24/7/365.; - Level 2: Business Hours (on duty for Severity 1 incidents).; - Level 3: Business Hours (on duty for Severity 1 incidents).; ; Incident Severity Definition; -Severity 1: An error that disables or materially impairs major service function or the Customer’s operations. If a workaround exists, reclassified as Severity 2.; - Severity 2: An error reducing performance in any non-critical process.; - Severity 3: An error visible only on a single end-user system or non-essential components.
• Approach to resilience: We offer the ability to host the service across multiple data centres, availability zones or geographic regions.; We implement a recovery plan founded on regularly scheduled data backups.; More information and option available on request.
• Outage reporting: Incidents are tracked using a ticketing tool with an alerting mechanism.; ; Our service delivery teams inform customers according to agreed contractual terms.

Identity and authentication

• User authentication needed: Yes
• User authentication: Multi-Factor Authentication (MFA)
• Access restrictions in management interfaces and support channels: Access restriction in management interfaces is managed through Role Based Access Control and permission management.
• Access restriction testing frequency: At least once a year
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Worldline has established and certified an Information Security Management System (ISMS) in accordance with the ISO/IEC 27001:2013 standard, covering its operations and the projects entrusted to it by its clients. All services and deliverables provided under this engagement are included in the ISMS and benefit from all associated security measures—both technical and organizational—based on current best practices as well as the legal and regulatory requirements applicable to Worldline and its clients.; All employees receive mandatory training in security policy.; Security incidents can be reported either via the line manager or the project's CISO, or via a dedicated mailbox.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Change management is a formal process for handling modifications to the platform, including software updates and configuration changes to adapt to evolving circumstances, regulations, and technologies. It relies on strict documentation and application version control, as well as validation steps with clearly identified responsibilities as defined in the quality assurance plan. These validation steps include risk management, specifically security risks, for updating the risk register and implementing appropriate actions for each case.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Weekly security scans are conducted on IP addresses exposed to the internet. The results are sent to the Security Officer responsible for project security for analysis.; Technical updates are also carried out at least twice a year to keep the service up to date and resolve known vulnerabilities .; Known vulnerability tracking is carried out in collaboration with the Security Officer, and deployment decisions are made according to the severity of the threat: from deployment within 24 hours to periodic updates.; Security scans are based in particular on OWASP, Qualys and SonarQube references.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Worldline’s security incident management policy outlines procedures for response, categorisation, handling, and communication of events affecting Worldline’s or clients’ data. Incident priority is determined by scope and impact on information systems. ; For attacks involving client data, Worldline delivers a preliminary incident report within 48 hours, detailing investigation status, understanding of the attack, scope, impact, and mitigation actions taken. Relevant logs or traces are provided once the incident is confirmed. ; Additionally, Worldline can deploy a Security Operations Centre (SOC) to correlate log sources and quickly detect potential malicious behaviour affecting data.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Application and platform monitoring is carried out 24/7 by operational teams who can be contacted at any time via phone or ticketing. ; The monitoring centre analyses and categorises incidents, taking appropriate action according to the type of event and established procedures. ; Incident tracking is available through the ticketing system, and a post-incident report is produced for major or critical incidents.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 1%
• Between £500,001 and £1,000,000: 1.5%
• Between £1,000,001 and £2,500,000: 2%
• Between £2,500,001 and £5,000,000: 2.5%
• Over £5,000,001: 3%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: EY CertifyPoint
• ISO/IEC 27001 accreditation date: Tuesday 1 August 2023
• What the ISO/IEC 27001 doesn’t cover: Nothing
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: EY CertifyPoint0
• ISO 9001 accreditation date: Tuesday 1 August 2023
• What the ISO 9001 doesn’t cover: Nothing
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: USD AG
• PCI DSS accreditation date: Wednesday 16 October 2024
• What the PCI DSS doesn’t cover: All Worldline services which are not part of a card payment solution (PCI DSS only applies to card payment related services). All Worldline teams are nevertheless trained to PCI DSS requirements and the Worldline Information Security Management System is aligned with PCI DSS requirements
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: A4af5190-7f45-41c3-ab5a-c40a1557bd92
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at WLopportunities@worldline.com. Tell them what format you need. It will help if you say what assistive technology you use.