ZENGENTI LIMITED

Contensis - Digital Experience Platform (DXP) & Content Management System (CMS) - Local Government

Contensis is a flexible, modern DXP/CMS with a headless, API-first architecture and an integrated deployment platform for development using any programming language. Contensis is the foundation for accessible and responsive websites, intranets, apps and digital systems. It’s used extensively across local government, higher education, the NHS, and emergency services.

Features

• User-friendly, fully accessible, form-based editing experience
• Create structured content easily before re-using and publishing it anywhere
• Headless, API-first architecture - develop using any language or framework
• Publish personalised, mobile-responsive content to any digital channel
• Validation tools catch mistakes and prevent accessibility issues
• Thoroughly documented and supported APIs allow almost limitless development opportunities
• Comprehensive content scheduling and lifecycle management
• Audit trail, version control, track changes, dual-page previewing
• Productivity features for content authors, tasks lists, reminders
• Workflow: simple, powerful, easy to set up

Benefits

• Develop using your favourite languages and frameworks
• Deliver content to websites, apps and any other digital systems
• Website visitors can access your websites from any device
• Benefit from maximum uptime and resilience on our cloud infrastructure
• Easily comply with, and maintain, WCAG accessibility standards
• Reduce costs and improve customer engagement through digital transformation
• Learn from, and share with, a thriving user community
• Improve content governance with sophisticated workflow and role-based permissions
• Create, translate, and manage content in multiple languages
• Integrate back-office systems to surface important data in one place

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@zengenti.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

117054906332715

Contact

Stef Robinson / Ola Andersson
01584 824202
tenders@zengenti.com

About your service

• Service categories:

  Applications

  Content workflow and management

  • Capture
  • Document
  • Media Services
  • Creative

  Content services

  • Enterprise Content Management Applications
  • Content Sharing and Collaboration Applications

  Persuasive content management

  • Website Software
  • Digital Asset Management Applications
  • Product Content Management Applications
  • Content Marketing Applications
  • Video Platforms
  • Digital Adoption Platform

  Enterprise portals and digital workspaces

  • Multi-Audience Portals
  • Integrated Employee Workspaces
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Private cloud
  • Hybrid cloud
• Service constraints: Contensis has three licence types: Starter, Plus and Enterprise. Each licence type differs in the scale of infrastructure it operates on, the number of separate projects, websites and systems it supports, and the amount of bandwidth, storage and concurrent users it includes. In all other respects, the Contensis software provided at each licence level is identical and provides users with the same functionality.
• System requirements:
  • Users editing in Contensis need one of the following browsers:
  • Google Chrome (latest)
  • Safari (latest)
  • Firefox (latest)
  • Microsoft Edge (latest)

User support

• Email or online ticketing support: Yes
• Support response times: The response time SLA for support tickets are: 1) Critical - These are handled 24/7/365, response is within 1 hour and resolution within 8 hours. 2) High - These are handled during business hours between 9am and 5.30pm, response is within 4 hours and resolution within 2 working days. 3) Normal - These are handled during business hours between 9am and 5.30pm, response is within 8 hours and resolution within 3 working days. 4) Low - These are handled during business hours between 9am and 5.30pm, response is within 8 hours and resolution within 3 working days.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: The response time SLA for support tickets are: 1) Critical - These are handled 24/7/365, response is within 1 hour and resolution within 8 hours. 2) High - These are handled during business hours between 9am and 5.30pm, response is within 4 hours and resolution within 2 working days. 3) Normal - These are handled during business hours between 9am and 5.30pm, response is within 8 hours and resolution within 3 working days. 4) Low - These are handled during business hours between 9am and 5.30pm, response is within 8 hours and resolution within 3 working days. As part of our G-Cloud service, we also provide an uptime SLA of between 99.9% and 99.99%, depending on the licence type and resilience options, for all the websites you publish from Contensis. Unlimited support is provided within the licence cost. We provide the same level of support regardless of the licence type. We allocate an engineer to each issue who will communicate with you until the issue is resolved.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Once a call-off contract has been agreed, our engineers will undertake all the work to provision your Contensis environment within 48 hours. Your key users will also be given access to the system and to our help desk portal. Zengenti will support you in whatever way you require to get you up and running. For example, you may have in-house developers who will work with the system, and we can train them to implement and launch your websites as required. The majority of our training can be delivered remotely online, at your premises, or at our Ludlow headquarters. Extensive user guides and documentation are also available on our contensis.com website to support any formal training. Zengenti also offers a full UX website design and build service via G-Cloud, through our in-house professional services team, which has extensive experience delivering complex websites and digital systems across local government, higher education, and the wider public sector.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: On request, we can provide a complete export of all content and data stored in the CMS in an agreed format.
• End-of-contract process: The standard export is provided at no cost. We can provide clients who are off-boarding with bespoke exports if required, although this would be chargeable.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The full range of editorial and administrative features is available across both mobile and desktop devices. However, certain complex authoring tasks (for example, large-scale content modelling, bulk operations, or extensive form configuration) are more practical on larger screens such as laptops or desktops. This is due to usability considerations rather than technical restrictions. Published websites are designed to operate on any mobile device.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AAA
• Description of service interface: Contensis includes a comprehensive, easy-to-use editing user interface based on content types and entries. Contensis is designed for casual use and for users to start using the interface without having completed an extensive training course. With many of our clients, we see that the system is so easy to use that very little training is required for day-to-day, basic content editing.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: We perform manual testing of all user interfaces using JAWS, NVDA and VoiceOver. Contensis has also been independently tested by the Digital Accessibility Centre, who had their staff carry out various content tasks to ensure they can use the system successfully.
• API: Yes
• What users can and can't do using the API: Contensis is a headless and API-first DXP/CMS which supports development using any programming language or framework. Contensis has a number of powerful APIs. The Contensis Delivery API is a platform-agnostic API that focuses on delivering content created in the system to your websites or applications. The Management API allows you to import, integrate and manage content between the system and any third-party systems. The Image API lets you manipulate and apply image transformations to images stored in the system as well as speeding up image delivery and ensuring images are fully optimised for use in your systems. To support multi-channel publishing and API-first content delivery, all content you create in Contensis is stored as well-structured, clean JSON, which can be accessed by our APIs. We have support examples and full API documentation for three different broad technology stacks - .NET, HTTP and Javascript which are all documented on our contensis.com website.
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Contensis is an entirely browser-based DXP and CMS that enables you to build, publish, and manage multiple websites, intranets, apps, and digital systems from a single environment. It is a headless and API-first platform which supports development using any programming language or framework. All aspects of your websites can be managed using Contensis including the creation and amendment of content and data, uploading of media and assets, metadata and site structure. Users can publish and unpublish any type of content or data, and can undertake content governance and reporting as required. Each Contensis environment can support any number of websites and digital systems, subject to the appropriate licence type. Each website can separate all users, permissions, assets, content types, entries, workflow and configuration as required. Users with the appropriate permissions can easily switch between projects as required and can create and manage any content and data in the system.

Scaling

• Independence of resources: Each client environment is deployed to separate physical network segments, with all data segregated to separate virtual disks presented to our VMware infrastructure. The servers each client operates from are solely for their use. Each environment is also scaled appropriately to handle specific peaks in demand. The level of demand and appropriate resources would be discussed and agreed with each client during implementation. We have processes in place to monitor for any significant increase in traffic, including DDoS attacks. If traffic exceeds certain thresholds, we isolate the target website, avoiding risk to other customers on our infrastructure.

Analytics

• Service usage metrics: Yes
• Metrics types: We can provide clients with website uptime reports, and reports on help desk and ticket performance. Users can also access a cloud status dashboard that summarises the current state of the service.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: On request, we can provide a complete export of all content and data stored in the system in an agreed format. All content and data are also accessible through our APIs.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • JSON
  • XML
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • JSON
  • XML

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Our G-Cloud services have an uptime of between 99.9% and 99.99%, depending on licence type and resilience options, for all published websites, measured monthly. This includes planned maintenance. If we fail to meet the monthly SLA, service credits are calculated based on the difference between the SLA availability and the actual availability achieved that month. For example, service credits = (100 - a) x b, where a = the actual percentage availability of the platform during the relevant calendar month, and b = the charges payable in respect of access to the platform during the relevant calendar month (exclusive of VAT and other taxes).
• Approach to resilience: The service operates from multiple Tier 3 data centres and multiple Tier 1 carriers, with multiple entry points into each data centre. We’re not reliant on a single supplier or location to deliver the service. We also have our own resources at our headquarters in Ludlow, which can be brought into use at short notice if required. The platform is designed with resilience at every aspect, from incoming connectivity to switches to firewalls, storage, hosts, load balancers, cache servers, web servers and database servers. This ensures that even if we do have an issue, the service will continue to work with the resilient pair of an item. Varnish cache, equipped with an intelligent cache invalidation system and a grace period, also ensures that even if a catastrophic issue occurs with code, configuration, or both, the majority of the website will continue to serve stale resources while issues are promptly resolved. The service also features over 400 monitored data points, providing early warnings and deep insights into any potential problems before they impact client environments. We also offer (at additional cost) optional disaster recovery environments and extended DDoS protection for clients who require additional resilience.
• Outage reporting: The Contensis service has over 400 monitored data points, providing early warnings and deep insights into any issues before they impact client environments. Outages, therefore, are rare, and if they do occur, they typically involve a single client. Our help desk is the first point of contact for any client issues. Any number of users can be set up with access to the help desk to raise tickets on your behalf. Support is available 24/7/365 for any critical tickets. For any wider outages that affect multiple clients, we have an incident management process which includes additional resources to handle both technical and communication aspects. One of our incident managers will keep all parties informed and provide updates through our Zengenti Cloud Status page, detailing any service outages. Clients can sign up to receive email notifications of any service outage and status updates. Following the incident, we will also issue an incident report, which will include a description of the problem, the timeline, and any possible mitigation measures to avoid a similar issue in the future.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Registering for access to the help desk requires a valid email address associated with your client account. Once registered, it can only be accessed by registered users who authenticate.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Zengenti has an Information Security Management System (ISMS) comprising related policies and procedures, based on ISO27001:2022, with regular internal and external audits to ensure compliance. All Zengenti staff take security and data protection very seriously, and have formal training under our ISO27001 system to aid with this. New staff are put on information security and data protection training as part of their induction and refresher courses are delivered annually for all staff. All our staff also undergo baseline security screening and background checks to meet the BS7858:2019 standard.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: The platform is entirely managed using configuration management, so all operations are fully automated, requiring no human intervention to deploy and configure infrastructure. Any changes that relate to underlying shared infrastructure are managed in accordance with Zengenti’s change control processes. We always notify clients of any such changes, providing two weeks' notice unless it’s an emergency change. Any tickets or requests that require a change to the infrastructure are defined as requiring CAB approval, if not previously agreed with a documented agreed procedure. Our processes can be aligned with a client’s internal change processes where required too.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: The platform has many levels of security that provide a barrier to intrusions. These include firewalls, monitoring for DDoS attacks and regular infrastructure patching with security updates. We use internal and external monitoring and perform vulnerability scans on our central infrastructure with each Contensis release. We have regular penetration tests too. We assess potential vulnerabilities through proactive monitoring of logs and via security advisories from the security sector. Whenever a vulnerability is recognised, we make an immediate decision about the potential consequences and how it should be addressed. If a patch was critical, we would apply this immediately.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: The platform has over 400 monitored data points, providing early warnings and deep insights into any issues before they impact client environments. We use enterprise network monitoring tools both internally and externally, and have systems in place to monitor for any increase in website and network traffic over specified thresholds, including DDoS attacks or similar. We proactively monitor logs for any unexpected events too. Any potential compromise would trigger our incident management processes.
• Incident management type: Supplier-defined controls
• Incident management approach: The majority of incidents are handled through our help desk helping to streamline incident management, tracking and resolution. For critical issues, we have a comprehensive incident management process used for security incidents, vulnerabilities and outages. The process ensures our clients are regularly notified of what is happening and keeps everyone in the loop. Our incident managers are responsible for client communications via our Zengenti Cloud status page and ensuring the team is following the agreed procedures. As with all our policies and procedures, our incident management process is regularly reviewed and assessed by our ISO27001 auditors.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: We can provide a sandbox version of Contensis that includes all functionality. Typically, we would expect the trial version to be available for no more than 3 months.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: NQA
• ISO/IEC 27001 accreditation date: Tuesday 1 July 2025
• What the ISO/IEC 27001 doesn’t cover: Our ISO27001:2022 certification covers all company operations.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: NQA
• ISO 9001 accreditation date: Tuesday 1 July 2025
• What the ISO 9001 doesn’t cover: Our ISO9001 certification covers all company operations.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 150a9ced-d172-426e-a0c1-23bcbe2e8af7
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@zengenti.com. Tell them what format you need. It will help if you say what assistive technology you use.