Bizzmine

Enterprise Quality, Health, Safety, and Environmental Software (QHSE)

Bizzmine is a enterprise cloud-based quality, health and safety, risk and compliance management platform supporting governance and operational performance. It provides configurable workflows for document control, audits, corrective preventative actions (CAPA), risk and change management, incidents, complaints and supplier oversight, with training, asset-related processes and AI-assisted features.

Features

• Highly customisable forms, workflows, dashboards and reports with no-code configuration
• Cross-platform accessibility – desktop, tablets and mobiles
• Dashboard interface, analytics dashboards and compliance analytics
• Document control, version control and document workflows with offline access
• Integrated risk management, supplier and third-party risk management
• CAPA management, corrective action management and preventive actions
• Audit management, audit scheduling and audit actions
• Supplier management, vendor management and supplier relationship management workflows
• Equipment maintenance management and calibration management
• AI-assisted workflows, document retrieval and interrogation

Benefits

• Improves organisational compliance through consistent, auditable processes
• Reduces operational risk with clear visibility of issues and controls
• Improve audits with traceable evidence and documented actions
• Enables rapid process improvement without custom software development
• Improves cross-team coordination using shared workflows and dashboards
• Real-time Reporting and KPI tracking enabling better decision making
• Increases accountability across teams, services and third-party suppliers
• Scales best practice across departments without changes to underlying infrastructure
• Decrease data silos with interconnected information across business
• Decrease wasted man hours - Improve operational efficiency

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hiren@bizzmine.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

109610046104929

Contact

Hiren Gandhi
01772 217089
hiren@bizzmine.com

About your service

• Service categories:

  Applications

  Enterprise resource management

  • Enterprise performance management
  • Project and portfolio management
  • Asset life-cycle management
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: The service is delivered as a cloud-based SaaS solution and requires internet connectivity and a supported web browser. Some functionality may be limited when offline and may depend on configuration choices and user permissions. The service does not include bespoke development and is configured using no-code tools within the standard product capabilities. The service is supported on current versions of major web browsers and is suitable for use within NHS and wider public and private sector environments.
• System requirements:
  • Access to Modern Browser - Firefox, Chrome, Edge, Safari
  • Internet Connectivity - Some offline functionality available
  • Allow HTTPS traffic

User support

• Email or online ticketing support: Yes
• Support response times: Severity 1 (Critical): Service, or a critical component, is unavailable and operations are significantly impacted. No workaround is available. ; Reporting methods : Phone; Target first response: 2 business hours; 24/7; ; Severity 2 (High): Critical component of the service is unavailable, but a workaround exists. Service use is partially impacted.; RM: Support ticket, email; TFR: 4 business hours; ; Severity 3 (Medium): Service remains operational, but users experience functional issues or inconvenience.; RM: Support ticket, email; TFR: 6 business hours; ; Severity 4 (Low): Issue has no material impact on service operation or users.; RM: Support ticket, email; TFR: 16 business hours
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: We provide a single support level that includes access to an account manager and technical support via email, ticketing system, and telephone. Telephone support is reserved for Severity Level 1 issues. 24 hours a day, 7 days a week for Severity 1 (Critical) incidents. All other severity levels are handled during normal business hours.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We can provide onsite training, online training and access to a reference material portal
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: Upon termination, all customer data will be deleted within 30 days. A request to receive a; backup of the data can be made and will be provided as an MS SQL database.bacpac file.; We can also provide services to export data into spreadsheets or other data formats.
• End-of-contract process: The software provides functionality to export data from views into CSV files.; Documents can be extracted individually.; Custom data exports for specific views requested by the customer will incur additional costs.; Bulk data exports will also incur additional charges.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Formal onboarding and offboarding documentation is not currently provided. Support is delivered directly by the supplier through email, telephone, and optional training sessions.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The service is delivered as a single, consistent application using responsive design. The same functionality is available across supported devices, with end-user activities designed for use on different screen sizes. Administrative configuration functions are best accessed using larger screens for usability.
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: The service is accessed through a secure, browser-based user interface, including administrative interfaces for configuration and management.
• Accessibility standards: None or don’t know
• Description of accessibility: The service is accessed through a secure, browser-based user interface designed to support accessibility features provided by modern web browsers and assistive technologies. Users can navigate the interface using standard keyboard controls and adjust browser settings such as text size and contrast.
• Accessibility testing: None
• API: Yes
• What users can and can't do using the API: Users can configure an API in the Bizzmine settings. An API key can be generated with a defined validity period. The API can either act on behalf of a specific user or use the default API user.Through the API, users can create, update, and export records, execute tasks, and upload attachments.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: The service includes a no-code backend configuration system accessible to administrators and designated process owners, with all configuration controlled through role-based, permission-based access. Fields, workflow logic, notifications, reports, dashboards and branding can be configured without custom development, allowing the service to align with organisational processes and user roles.

Scaling

• Independence of resources: Based on the monitored metrics, resources can be scaled up when required. Performance issues are logged and monitored, and notifications are sent to the infrastructure team when action is needed.

Analytics

• Service usage metrics: Yes
• Metrics types: We monitor CPU usage, memory consumption, and the overall performance of our services. While we do not provide real-time dashboards or periodic reports, metrics can be shared upon request.
• Reporting types: Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Data Erasure

Data importing and exporting

• Data export approach: Bizzmine is fully created with Microsoft technology. All data is stored in a Microsoft Azure SQL database and a Storage account for the files. Bizzmine can export data in CSV lists.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The service is designed to provide a target availability of 99.9%, excluding planned maintenance and scheduled downtime, which is communicated to users in advance where possible. Availability is measured on a monthly basis. Where availability does not meet the stated target, the Buyer may raise the issue through the agreed support process. Any remedies, including service credits or refunds, are handled in accordance with the terms of the Call-Off Contract and agreed service levels.
• Approach to resilience: The service is designed to be resilient and is hosted on cloud infrastructure with built-in redundancy and fault tolerance. Backup and recovery processes are in place with defined recovery objectives, including a target Recovery Point Objective (RPO) aligned to the service architecture. Service availability and performance are continuously monitored to support timely incident detection and response. Further details on infrastructure resilience and recovery objectives are available to buyers on request.
• Outage reporting: Email alerts to customers

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is restricted using role-based access control and the principle of least privilege. Administrative access is limited to authorised personnel only and protected by strong authentication, including multi-factor authentication where supported. Access rights are reviewed regularly and removed promptly when no longer required. Support channels are restricted to nominated contacts and verified users. All access is logged and monitored, with audit trails maintained to detect and investigate unauthorised activity.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: The service is operated in line with documented information security policies covering areas such as access control, data protection, incident management, change management and supplier security. These policies are aligned with recognised good practice, including the principles of ISO/IEC 27001, and are documented within the organisation’s Security Assurance Plan.; ; Information security governance is overseen by a dedicated security team, with overall accountability held by a Risk & Compliance Director. Security risks, incidents and compliance matters are reported through defined management and governance channels and reviewed as part of regular operational oversight.; ; Information security policies are communicated to relevant staff and supported by role-based access controls and documented operational procedures. Compliance is monitored through ongoing operational checks, incident reviews and periodic internal reviews, as defined in the Security Assurance Plan.; ; Information security policies and processes are reviewed regularly and updated as required to reflect changes in risk, technology or regulatory requirements.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Possible improvements are tracked through different channels and are discussed in the periodic security board. Changes follow the change management process that contains a risk assessment, 4 eyes principle, and other necessary steps. All our assets/software are being tracked both manually and automatically.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Code is monitored by an external tool for vulnerabilities and there're also periodic penetration tests. Findings that are critical and high are fixed asap and are added in hotfixes. Other findings are planned on the roadmap.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We have defined multiple alert rules on our critical systems and when triggered these are pushed to a Slack channel that's monitored by multiple people. These alerts are processed immediately and classified according to importance. They follow our Information Security Incident process.
• Incident management type: Supplier-defined controls
• Incident management approach: We've created a process in our own software (Bizzmine) that follows the best practices of the ISO27035. Users can report incidents in the software through a simple form. Reported incidents are either handled as an incident when the CIA is affected or are handled as an event. They follow the processes for Information Security Incidents.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: DNV
• ISO/IEC 27001 accreditation date: Friday 26 April 2024
• What the ISO/IEC 27001 doesn’t cover: None
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: DNV
• ISO 9001 accreditation date: Monday 19 August 2024
• What the ISO 9001 doesn’t cover: None
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 7e9d0dbf-7414-4d57-8c61-c01dc40351a7
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 454b46d2-c3e0-4bdd-abe4-3c022af8d37d
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of issues relating to entering the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hiren@bizzmine.com. Tell them what format you need. It will help if you say what assistive technology you use.