JSBC LABS LTD

Software as a Service

A secure, cloud-hosted Software as a Service (SaaS) platform for recruitment and workforce management. It enables public sector organisations to manage candidates, vacancies, compliance, workflows and reporting through a single, configurable, web-based system with optional third-party integrations.

Features

• Cloud-hosted, browser-based SaaS platform
• Candidate and vacancy management
• Configurable workflows and automation
• Compliance and document management
• User roles and permission controls
• Reporting and data export
• API and third-party integrations
• Secure authentication and access control

Benefits

• Reduces administrative effort through automation
• Centralises recruitment and workforce data
• Improves visibility and reporting for decision-making
• Scales to support different organisational sizes
• Accessible remotely without specialist hardware
• Regular updates without customer intervention

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at jay.slinger@jsbclabs.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

995186133193504

Contact

Jay Slinger
02080409022
jay.slinger@jsbclabs.com

About your service

• Service categories:

  Applications

  Enterprise resource management

  Human capital management

  • Talent Management Applications
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Requires internet access and a supported modern web browser. Functionality dependent on configured integrations and user permissions.
• System requirements:
  • Modern web browser (Chrome, Edge, Firefox, Safari)
  • Internet connection

User support

• Email or online ticketing support: Yes
• Support response times: Email and ticket-based support provided during standard business hours, with prioritisation based on issue severity.
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: No
• Support levels: Tiered support model with defined response targets based on incident severity and impact.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Customers can start using the service following contract award and account setup.; Onboarding includes tenant creation, administrator access, initial configuration, and user setup. The supplier provides onboarding support to help configure workflows, roles, and compliance settings. Typical onboarding can be completed remotely without on-site activity.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: At the end of the contract, customers can export their data using built-in reporting and export tools or via the API.; Data can be extracted in commonly used formats such as CSV or other agreed formats to support migration to another system. The supplier will provide reasonable assistance to support data extraction if required.
• End-of-contract process: Upon contract termination, customer access is disabled following confirmation of data extraction.; Customer data is retained for a defined period in line with contractual and legal requirements, after which it is securely deleted. The supplier follows documented data deletion procedures to ensure data is removed securely and irreversibly.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Onboarding and offboarding documentation is provided electronically, typically via email, in PDF format. Documents are structured clearly with headings and consistent formatting to support readability. Where required, documentation can be re-issued or adjusted to meet reasonable accessibility needs, such as alternative formats or clarification support, on request.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Web-based user interface with role-based access and configurable workflows.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: The service has been tested internally using common assistive technologies, including keyboard-only navigation and screen reader compatibility checks. Accessibility considerations are built into the design and development process, and issues identified through user feedback are reviewed and addressed as part of ongoing platform improvements.
• API: Yes
• What users can and can't do using the API: The service provides a secure, RESTful API that allows authorised users to integrate with the platform and automate data exchange with third-party systems.; ; Using the API, users can:; ; Create, read, update and retrieve records such as candidates, vacancies, applications and related data; ; Synchronise data between the service and external systems (for example HR, finance or reporting tools); ; Trigger workflows and status updates based on defined business rules; ; Retrieve reporting data for analysis and export; ; The API is authenticated using secure credentials and role-based permissions. Access is limited to the data and actions authorised for each user or integration.; ; Users cannot:; ; Change core system configuration, security policies or platform-wide settings via the API; ; Bypass user permissions, audit controls or compliance rules; ; Perform administrative actions that are restricted to the web interface; ; API usage may be subject to rate limits and agreed usage thresholds to ensure platform stability and performance. Full API documentation is provided to customers as part of onboarding.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Users can customise the service through configuration options available within the platform.; ; What can be customised:; Users can configure workflows, fields, forms, compliance requirements, user roles and permissions, approval processes, reporting views, dashboards, notifications, and integrations with supported third-party systems via the API.; ; How users can customise:; Customisation is completed through the web-based administrative interface using configuration settings, without the need for coding. Changes can be applied in real time and adjusted as organisational needs evolve. API configuration is available for approved integrations.; ; Who can customise:; Customisation is carried out by authorised customer administrators with appropriate permissions. Where required, the supplier can support configuration during onboarding or by request, but ongoing configuration is typically managed by the buyer.; ; All customisation is non-destructive, does not alter the underlying platform code, and is fully supported within the standard SaaS offering.

Scaling

• Independence of resources: The service is delivered using a multi-tenant SaaS architecture designed to isolate customer data and workloads. Platform resources are managed centrally and scaled to meet demand, with controls in place to prevent any single user from impacting overall service performance. Usage is monitored continuously and capacity is adjusted proactively to maintain consistent availability and performance for all users.

Analytics

• Service usage metrics: Yes
• Metrics types: The service provides usage metrics including user activity, login history, record volumes, and system usage through built-in reporting and data exports. Additional usage information can be provided on request where required.
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure

Data importing and exporting

• Data export approach: Users can export their data directly from the platform using built-in export tools or via the API. Data exports can be requested at any time during the contract and at contract end, with support available if required.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The service is provided with a target availability of 99.9% per calendar month, excluding planned maintenance. Availability is monitored continuously. If availability falls below the agreed level, service credits may be applied in line with the contract. Planned maintenance is scheduled outside core business hours where possible and notified in advance.
• Approach to resilience: The service is hosted on resilient cloud infrastructure with redundancy across availability zones. It uses automated monitoring, regular backups, and failover mechanisms to minimise disruption. Infrastructure is managed and maintained by the cloud provider, with resilience controls and recovery procedures available on request.
• Outage reporting: Outages are communicated directly to customers via email notifications. Where relevant, updates are also provided through direct support channels. There is no public status dashboard or outage reporting API.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is restricted using role-based access control (RBAC) and the principle of least privilege. Only authorised staff are granted access based on job role. Authentication is enforced using strong passwords and multi-factor authentication (MFA). Access is logged and regularly reviewed, and user access is removed promptly when roles change or staff leave. Support requests are handled through controlled channels, with identity verification required before any account or data-related actions are performed.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: Security governance is led by a named board-level individual responsible for oversight of information security across all services. We follow documented security policies aligned with the UK Software Security Code of Practice, covering risk management, access control, secure development, incident management, and data protection. Security responsibilities are clearly defined, reviewed regularly, and embedded into day-to-day operations. We carry out periodic risk assessments, maintain audit logs, and ensure staff are trained in security and data protection practices. Security controls and policies are reviewed and updated in line with business changes, regulatory requirements, and emerging threats.
• Information security policies and processes: We follow documented information security policies covering access control, data protection, secure development, incident management, change management, and business continuity. Policies are aligned with recognised best practices and the UK Software Security Code of Practice.; ; Security governance is overseen by a named board-level individual, with day-to-day responsibility delegated to senior management and technical leads. All staff are required to follow security policies as part of their roles and receive regular security and data protection training.; ; Compliance is enforced through role-based access controls, audit logging, documented procedures, and regular internal reviews. Security incidents, risks, and policy breaches are reported through a defined escalation process to senior management and, where required, to the board. Policies are reviewed and updated periodically to reflect regulatory changes, operational updates, and emerging security threats.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: All service components are tracked using version control and internal change logs throughout their lifecycle, from development to deployment and decommissioning. Configuration items and changes are documented, reviewed, and approved before implementation. Changes are assessed for potential security, performance, and availability impact, with testing carried out in non-production environments where applicable. Access to make changes is restricted to authorised personnel, and all changes are auditable. Rollback procedures are in place to minimise risk if issues are identified.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We continuously assess vulnerabilities through a combination of automated monitoring, regular code reviews, dependency scanning, and periodic internal security testing. Potential threats are prioritised based on risk and impact. Security patches and updates are applied promptly following testing, with critical vulnerabilities addressed as a priority and typically deployed within agreed internal timelines. We monitor threat intelligence from trusted sources including vendor security advisories, industry best practices, and publicly disclosed vulnerability databases (such as CVEs). Changes are tracked and reviewed to ensure security risks are mitigated before deployment.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We use continuous monitoring and logging across our infrastructure to identify potential compromises, including alerting on unusual access patterns, errors, and system behaviour. Alerts are reviewed by authorised technical staff. When a potential compromise is identified, we follow a defined incident response process: the issue is investigated, affected components are isolated if required, and remediation actions are applied. Incidents are prioritised based on severity. Critical security incidents are responded to immediately, with initial investigation started as soon as an alert is raised, and customers are informed where relevant in line with our incident communication process.
• Incident management type: Supplier-defined controls
• Incident management approach: We have predefined incident management processes for common security and service events. Incidents can be reported by users via email or our designated support contact. All incidents are logged, assessed, and prioritised based on impact and severity. We investigate incidents promptly, take corrective actions, and communicate updates to affected users as required. Post-incident reports are provided on request and include root cause analysis, actions taken, and preventative measures to reduce recurrence.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 2.5%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 7.5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 12.5%
• Over £5,000,001: 15%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at jay.slinger@jsbclabs.com. Tell them what format you need. It will help if you say what assistive technology you use.