Blue Prism

Service scope

Software add-on or extension: Yes, but can also be used as a standalone service
What software services is the service an extension to: BPM, ERP, ITSM, CRM and multiple Clinical Systems such as EMR and EHR,
Cloud deployment model: Public cloud

Private cloud

Hybrid cloud
Service constraints: Consumption of our Cloud Service requires site to site VPN establishment.
System requirements: For Blue Prism Cloud, site to site VPN

For Blue Prism On Premise, Hybrid, Virtual and/or Physical hosting

User support

Email or online ticketing support: Email or online ticketing
Support response times: Priority 1

Response within one hour.

Blue Prism will use Continuous Effort, within Service Hours, to resolve the Fault within 12 Service Hours.

Priority 2

Response within three hours.

Fault resolved by the end of the following three Business Days.

Priority 3

Response within one Business Day.

Bug fix scheduled for the next available release.

Priority 4

Blue Prism shall consider such issues or requests in the light of other Customer requirements and will advise what action will be taken to address the issue.
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: None or don’t know
Phone support: No
Web chat support: No
Onsite support: Yes, at extra cost
Support levels: SS&C Blue Prism customers are supported by all in-house resources. Standard support is included in the annual license for no additional fee.

All customers have access to our full database of online troubleshooting and training resources and can open cases using the customer web portal.

Enterprise Support:
In addition to all the resources available in our Standard Support program, Enterprise Support includes authorisation for up to five contacts to open support tickets and guaranteed phone and email support during normal business hours for the country of purchase. For urgent issues, our support staff will respond within one hour. You will also receive a full on-boarding of our online support resources from our dedicated support staff remembers.

Global Enterprise Support:
Global Enterprise Support is designed to meet the needs of customers who have deployed mission-critical automations, guaranteeing 24x7 support and availability and prompt response time and resolutions. In addition to quarterly meetings and regular reviews of support cases, you will benefit from a designated support team who will be familiar with the specifics of your deployment and can quickly provide customised support to ensure that you are receiving the maximum benefit and success from your Blue Prism investment.
Support available to third parties: Yes

Onboarding and offboarding

Getting started: Blue Prism University contains free training curriculum available to anyone who registers.

Available courses include Product Induction, Foundation and more. These courses are offered online (CBT) via our Portal.

On-site, in-person training is also available via our third party training partners. Consult Blue Prism's website for a full listing of all accredited training partners.

In addition to this, comprehensive documentation covering all aspects of Blue Prism is provided electronically via the Blue Prism customer portal.

Blue Prism also provides a customer forum and knowledge base to encourage collaboration, support and idea sharing.
Service documentation: Yes
Documentation formats: HTML

PDF

Other
Other documentation formats: Searchable Knowledgebase accessible via internet using web browser.

Online Customer forum accessible via internet using web browser.
End-of-contract data extraction: SS&C Blue Prism does not pertain or archive data used by automations during processing.

Audit logs are exportable as .CSV

SS&C Blue Prism Automation process designs are exportable as XML based export formats.
End-of-contract process: In the case of a clients using SS&C Blue Prism cloud platform, platforms are deleted after 90 days, including the AWS or Azure subscription that they align to.

Any configuration information of logs requests will be shared at the end of the contract.

For both On-Premise or Cloud based deployments, access to support services and updates ceases on end of contract.

Using the service

Web browser interface: Yes
Supported browsers: Internet Explorer 11

Microsoft Edge

Firefox

Chrome

Safari
Application to install: No
Designed for use on mobile devices: No
Service interface: Yes
User support accessibility: WCAG 2.1 AA or EN 301 549
Description of service interface: SS&C Blue Prism features are securely accessed via Web Browser based applications or, in the case of some administrative tasks, remote client applications assessed via secure Remote Desktop Connection
Accessibility standards: WCAG 2.1 AA or EN 301 549
Accessibility testing: User interfaces have been designed along WCAG AA guidelines and our QA process includes compatibility checking.
API: Yes
What users can and can't do using the API: SS&C Blue Prism can expose any object or process via SOAP/REST requests to enable external applications to call automations, and can interact with existing applications and services API in various manners, including a built in REST capability.

SS&C Blue Prism digital workers are not limited to interacting with target applications via the GUI, and can also interact via API.

The Blue Prism Digital Exchange (DX) provides an online "marketplace" of prebuilt API integrations; these cover a variety of intelligent automation skills (learning, vision, problem solving, collaboration, planning & sequencing, and knowledge & insight) and enable drag-and-drop integration into ML/AI APIs offered by the likes of Google, Amazon, Microsoft, and even custom-built solutions.
API documentation: Yes
API documentation formats: HTML

PDF
API sandbox or test environment: No
Customisation available: Yes
Description of customisation: SS&C Blue Prism allows appropriately permissioned users to create custom automations suitable to the buyers needs as well as provide a host of administrative and operational functions to configure the environment specifically to the buyers needs.

Examples include (but are not limited to)

- Custom Process Discovery, Capture and Design
- User/Group/Role configuration
- Configure Operational and Business reporting
- Environment Configuration and Management

SS&C Blue Prism provides a variety of methods to do this suitable to the role and needs of the users or groups involved.

Scaling

Independence of resources: SS&C Blue Prism Cloud is provisioned to our customers on AWS or Azure to provide a unlimited scalability and performance regardless of customer demand, growth or operational pattern. Blue Prism's operations team monitor the solution continuously to proactively manage and resolve any service issues.

Analytics

Service usage metrics: Yes
Metrics types: SS&C Blue Prism provides a number of secure and auditable options for reporting metrics, KPIs and analytics.

Dashboard: An information dashboard is presented to each user. Its configurable and enables users to define and present graphical reports that are relevant to their role.
System MI: Provides the capability to analyse process execution data and return valuable insights regarding the process. The output can take various forms including XLS, DOCX, PDF, CSV, etc and external BI tools
In process reporting: It is possible to use automation processes themselves to generate reports allowing the automatic generation of relevant information.
Reporting types: API access

Real-time dashboards

Regular reports

Resellers

Supplier type: Not a reseller

Staff security

Staff security clearance: Other security clearance
Government security clearance: Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom
User control over data storage and processing locations: Yes
Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency: At least every 6 months
Penetration testing approach: Another external penetration testing organisation
Protecting data at rest: Physical access control, complying with CSA CCM v3.0

Physical access control, complying with SSAE-16 / ISAE 3402

Physical access control, complying with another standard

Encryption of all physical media

Scale, obfuscating techniques, or data storage sharding
Data sanitisation process: Yes
Data sanitisation type: Explicit overwriting of storage before reallocation

Deleted data can’t be directly accessed
Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach: Appropriately permissioned users can export log and process data via Secure Remote Desktop connection to the platform.

Blue Prism Automations can also provide data exports as part of their operation in a number of formats and delivery mechanisms (such as as operational reports via email)
Data export formats: CSV
Data import formats: CSV

Other
Other data import formats: XML

Tab Delimited

Excel

PDF

Data-in-transit protection

Data protection between buyer and supplier networks: Private network or public sector network

TLS (version 1.2 or above)

IPsec or TLS VPN gateway
Data protection within supplier network: TLS (version 1.2 or above)

IPsec or TLS VPN gateway

Legacy SSL and TLS (under version 1.2)

Availability and resilience

Guaranteed availability: Service Level Standard

SS&C Blue Prism Cloud Services will be
available to Customer for normal use no less
than 99.9% of the Scheduled Uptime.

Calculation
a. (Actual Uptime / Scheduled Uptime) *
100 = Percentage Uptime (as calculated by
rounding to the second decimal point)

Performance Credit
a. Where Percentage Uptime is equal to
or greater than 99.9%, no service credit will be
due to Customer.
b. Where Percentage Uptime is less
than 99.9%, Customer shall be due a service
credit.
c. The service credit shall be in the
amount of 5% of the monthly subscription fee (if
the subscription fee is invoiced annually, the
monthly fee is calculated by dividing the annual
fee by twelve; the service credit is as calculated
on a monthly basis for the reporting month).
d. The service credit shall increase by a
further 5% for each full 1% reduction in
Percentage Uptime, up to a maximum of 15%.
Approach to resilience: Both SS&C Blue Prism Cloud and On Premise versions are designed, architected, delivered and managed as Enterprise class applications.

Further information on exactly how this is achieved is available from Blue Prism on request.
Outage reporting: SS&C Blue Prism Cloud provides a service status page as well as proactive service notifications via email to nominated customer contacts.

SS&C Blue Prism solutions provide various web based UI's to allow appropriately permissioned users to monitor, alert and resolve service outages as they occur.

SS&C Blue Prism Automations themselves can be configured to provide any technical or business notifications during operation, via any channel (email, web page, API call, pdf report, etc) to allow bespoke service outage, issue or exception reporting during processing.

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Public key authentication (including by TLS client certificate)

Limited access network (for example PSN)

Dedicated link (for example VPN)

Username or password

Other
Other user authentication: Other forms of authentication utilised by Blue Prism includes secure key card applications used extensively by the NHS, DoD, etc.
Access restrictions in management interfaces and support channels: SS&C Blue Prism provides detailed software security features that enable a secure environment and methodology. These mechanisms result in the only Enterprise RPA platform that can withstand increasing regulatory compliance and non-repudiation requirements.
• Centrally managed user access control, limiting access to named individuals only
• Role based access according to the principle of least privilege
• Multi-Factor security, such that no individual can make changes without secondary approval
• A complete retrospective audit/changelog of all activity
• Segregation of environments with separate controls governing each
• Infrastructural security
Access restriction testing frequency: At least every 6 months
Management access authentication: 2-factor authentication

Public key authentication (including by TLS client certificate)

Dedicated link (for example VPN)

Username or password

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: User-defined
Access to supplier activity audit information: Users have access to real-time audit information
How long supplier audit data is stored for: User-defined
How long system logs are stored for: User-defined

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: BSI
ISO/IEC 27001 accreditation date: 12/07/2021
What the ISO/IEC 27001 doesn’t cover: N/A
ISO 28000:2007 certification: No
CSA STAR certification: Yes
CSA STAR accreditation date: 04/06/2016
CSA STAR certification level: Level 2: CSA STAR Attestation
What the CSA STAR doesn’t cover: Covers Azure or AWS infrastructure on which Blue Prism is provisioned only
PCI certification: No
Cyber essentials: Yes
Cyber essentials plus: No
Other security certifications: No

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001
Information security policies and processes: In compliance with its ISO27001 and FedRAMP obligations, SS&C Blue Prism conducts annual risk assessments and maintains disaster recovery/COOP plans to ensure continued functionality in the event of an emergency. Compliance is tracked a number of ways; Human Resources tracks employee compliance with required training, IT tracks employee compliance with hardware and software policies, and independent third-party audits are conducted annually to ensure compliance with ISO27001

Operational security

Configuration and change management standard: Supplier-defined controls
Configuration and change management approach: SS&C Blue Prism offers an integrated Release Manager which applies structure, governance, and control to the Change and Release Management processes.

Release Manager controls the promotion of automations between environments as well as ensuring that this process is only carried out by authorised users, with all actions fully audited.

Every time a package is created or edited, this is recorded in the audit trail.

Customers with particularly strict information assurance requirements may have different Release Managers for each environment so that, for example, one user can create and export a Release from the Development environment
Vulnerability management type: Supplier-defined controls
Vulnerability management approach: For every new platform release we perform penetration testing and vulnerability testing.

We remediate High and Medium issues before releasing to customers.

We also utilise a vulnerability management solution (Qualys) as part of our platform agents to feed into our Security, Information and Event Management (SIEM) solution.
Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach: SS&C Blue Prism operates a comprehensive protective monitoring process across its services and internal operations.

In the interests of security, further details on these practices are available on request.

To date, all threats are identified and mitigated in our operations before they become an issue.
Incident management type: Supplier-defined controls
Incident management approach: Under Blue Prism's ISO/IEC 27001:2013 compliant ISMS, every single security Incident is logged, tracked, managed, and resolved under a documented process. Blue Prism operates a no-blame policy ensuring that all issues are immediately reported and the Incident Management process is initiated at point of reporting.

Blue Prism has a comprehensive IS strategy and documented policies across a number of areas such as employee vetting, etc.

Security and Vulnerability Assessments are carried out periodically which validate the appropriateness of controls which are in place and these include input validation and sanitisation; authentication and access control; audit; and management of sensitive information.

Secure development

Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks: Yes
Connected networks: Public Services Network (PSN)

Police National Network (PNN)

NHS Network (N3)

Scottish Wide Area Network (SWAN)

Health and Social Care Network (HSCN)

Fighting climate change: Fighting climate change

Extensive further details regarding our our "Blue Prism for Good" and corporate initiatives to tackle climate change through reduced carbon footprint, lower energy consumption, etc are available on request. Please see https://www.blueprism.com/about-us/social-responsibility/blue-prism-for-good/ for further information.
Covid-19 recovery: Covid-19 recovery

Extensive further details regarding our our global "Blue Prism for Good" and corporate initiatives both during the pandemic and helping businesses to recover are available on request. Please see https://www.blueprism.com/about-us/social-responsibility/blue-prism-for-good/ for further information.
Tackling economic inequality: Tackling economic inequality

Extensive further details regarding our our "Blue Prism for Good" and corporate initiatives to tackle economic inequality are available on request. Please see https://www.blueprism.com/about-us/social-responsibility/blue-prism-for-good/ for further information.
Equal opportunity: Equal opportunity

Extensive further details regarding our our "Blue Prism for Good" and corporate initiatives to promote equal opportunity and inclusion are available on request. Please see https://www.blueprism.com/about-us/social-responsibility/blue-prism-for-good/ for further information.
Wellbeing: Wellbeing

Extensive further details regarding our our "Blue Prism for Good" and corporate initiatives to promote employee and social wellbeing are available on request. Please see https://www.blueprism.com/about-us/social-responsibility/blue-prism-for-good/ for further information.

Pricing

Price: £8,000.00 a licence a year
Discount for educational organisations: Yes
Free trial available: Yes
Description of free trial: 30 Day trial of platform available via registration on SS&C Blue Prism website.
Link to free trial: https://www.blueprism.com/free-trial/

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

Blue Prism

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents