CANTIUM BUSINESS SOLUTIONS LIMITED

EmploymentCheck E-Bulk Online Disclosure and Barring Service (DBS) Umbrella Platform

The EmploymentCheck solution provides an accredited cloud-based e-Bulk platform to support all DBS check levels. Our Umbrella status allows organisations to utilise a compliant e-bulk platform under our DBS registration supported by DBS experts. Checks can be fully managed via the online portal, with real time updates and extensive functionality.

Features

• DBS approved E-Bulk system via an accredited Umbrella provider.
• Online application, ID verification, and submission process.
• Integrated Update Service Module for ongoing check management.
• Integrated postcode lookup tool for accurate address entry.
• Fully hosted, maintained and DBS compliant system.
• Comprehensive reporting suite with dashboards and analytics.
• Integrated online verification module (Digital ID for DBS).
• Intelligent auto-validation ensures accurate data submissions.
• Flexible email suite with reminders and notifications.
• Supports full range of DBS checks seamlessly.

Benefits

• Error-free applications through smart validation technology.
• Reduced abandonment with automated applicant email reminders.
• Expert support offered by dedicated internal team members.
• Fast results via an efficient online platform.
• Real-time application management through dashboards and reporting.
• Smartphone and tablet accessible for mobile convenience.
• Unlimited online DBS checks without restrictions.
• Continuous improvements from internal development teams.
• Simple transactional billing with transparent pricing.
• No downloads required, instant cloud-based access.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bids@eis.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

129600182118586

Contact

EIS Bids
03301650000
bids@eis.co.uk

About your service

• Service categories:

  Applications

  Enterprise resource management

  Human capital management

  • Core Human Resources Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Hybrid cloud
• Service constraints: Organisations must process at least 100 DBS checks per year to utilise the Umbrella service.
• System requirements:
  • Internet connection
  • Use of a modern web browser/mobile device

User support

• Email or online ticketing support: Yes
• Support response times: We will respond to service related incidents and/or within the following time frames: Within 8 hours (during business hours) for issues classified as High priority. Within 48 hours for issues classified as Medium priority. Within 5 working days for issues classified as Low priority. Remote assistance will be provided in-line with the above timescales dependent on the priority of the support request.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: For all customers, ongoing user support is provided as standard as part of the service provision for no additional cost via our service desk. Additionally, during the onboarding process, we provide comprehensive user guides and operational videos. As part of our BAU support lifecycle, customers have access to operational experts who offer guidance and advice on best practice. We provide support to users via telephone and email channels. For telephone enquiries, support can be accessed from 8:30 A.M. to 5:00 P.M. Monday – Friday, excluding bank holidays and concessionary days. For email enquiries, support can be accessed from 8:30 A.M. to 5:00 P.M. Monday – Friday, Excluding bank holidays and concessionary days. Emails received outside of office hours will be collected and responded to as per the SLA. For users engaging with the platform, integrated assistance is provided through intuitive tooltips, validation prompts, and informative popups displayed on screen. The system is carefully designed with usability as a core principle, ensuring simplicity, clarity, and effortless user experience.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: New customers are provided extensive support which includes training videos, user guides and access to raise calls to our teams of DBS operational and technical experts. New users are guided through simple and easy to follow workflows, minimising support requests logged to internal team. Intelligent validation, tooltips and information popups are embedded into efficient workflows to guide users through the application journey.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
  • Other
• Other documentation formats: Word
• End-of-contract data extraction: Upon notification of contact end, a clearly defined exit plan will be produced to outline key dates and events. In coordination with the customer, copies of data can be provided upon request upon contract end. The extracted data for the client can be provided as a SQL Schema, this will contain all the required data in plain English using the ASCII codeset. Alternative data extracts can be provided in a custom format, requirements for which can be defined by the customer and implemented by technical support teams. Data extracts can be securely shared with customers offboarding from the service, ensuring personal data exported from the system remains protected in transit between the parties.
• End-of-contract process: The end of contract process is included as part of the standard service provision at no additional cost. A clearly defined off boarding plan will be agreed between the customer and the EmploymentCheck support team. The plan will cover revocation of system access at an agreed date, including the option for limited view only access which can be granted to a select group of users to allow for the management of applications processed prior to the end of contract to continue for a limited period. Copies of the data stored within the system can also be provided to the customer in an agreed format. All data will be destroyed in line with contractual agreements at contract end after the minimum retention period.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: System documentation is produced with accessibility in mind, with the aim to ensure all users can access relevant documentation in a suitable format. Documentation is made available in a variety of easily accessible formats such as html, word and pdf. Plain language is used throughout such documentation and the format follows a clear and organised structure, providing a logical flow and table of contents. Descriptive wording used for links and text displayed is a clear format, standard fonts, and generic text colours to ensure that documents are legible.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: All features are available through mobile or the desktop implementations. The interface is optimised for smaller screens which accessed through mobile devices. Mouse and keyboard actions can be completed via touch-based navigation through mobile devices.
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: The EmploymentCheck platform is designed with security and usability at its core. Users access clear workflows and intuitive dashboards through a modern, browser-based interface on any internet-enabled device. Real-time updates are captured in audit logs and reflected across responsive dashboards, supported by flexible, customisable features. Role-based permissions safeguard sensitive information, while built-in notifications, tooltips, search functionality, and intelligent validation enhance productivity. The interface combines powerful functionality with an accessible design, ensuring maximum efficiency and ease of use.
• Accessibility standards: None or don’t know
• Description of accessibility: EmploymentCheck is committed to continually improving accessibility across our platform. We aim to develop functionality with accessibility in mind, with the goal that all content is designed to be easy to use, read, and understand . Our accessibility statement outlines our current position, including areas where ongoing development is required. We recognise there are aspects we can improve, and we are actively implementing major system upgrades to enhance accessibility across all areas of the platform. Ensuring we offer an accessible platform is an ongoing commitment which is a key component of our software development lifecycle.
• Accessibility testing: To assess and improve the accessibility of the EmploymentCheck web application interface on an ongoing bases, a combination of automated tools, manual checks, and user testing has been, and continues to be, undertaken against the standards outlined under Web Content Accessibility Guidelines (WCAG). To complement these methods, structured interface testing has been conducted with users of assistive technologies, including screen readers, voice recognition software, and alternative input devices. This process focused on validating that navigation, form completion, and dashboard interactions are perceivable, operable, and understandable across different user needs. Testing also included scenarios with high‑contrast modes, keyboard‑only navigation, and magnification tools to ensure compatibility and responsiveness.
• API: No
• Customisation available: Yes
• Description of customisation: Customers can opt for a chargeable option to implement bespoke customisation that allows them to select colours, images and content of their instance to reflect their organisation branding. Brand identity can be retained and extensive customisation options are provided as part of the standard service provision. Technical teams will work with customers to ensure the build of the platform meets customer requirements and maintains a familiar look and feel. Customers can also specify sub-domain preference for their unique instance of the platform, to accompany the colours, images and homepage content made visible to front end users. Customers are also provided with the ability to customise the set up of their system, tailoring the system to suit the needs of customer.

Scaling

• Independence of resources: EmploymentCheck uses a multi-tenanted approach for its platform and each customer has its own separate database to ensure segregation and security both from other clients and third parties. Load balanced application servers are used to manage traffic and dynamically distribute load at busy periods. The platform is built on eCloud Virtual Private Cloud (VPC) infrastructure. The infrastructure is provisioned and supported by ANS Group Ltd, a market leading infrastructure partner. The solution is designed with high availability and resilience as a key objective and operates cross isolated subnets, Internal IP ranges control access in line with firewall rules.

Analytics

• Service usage metrics: Yes
• Metrics types: Customers are able to run service usage reports directly from the system as standard - these management information reports are included as part of the standard report suite offered to all customers.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: Data can be exported from the system in CSV or PDF format. Use of the system includes access to a bespoke report builder and a set of standard reports which cover key metrics, the data output can be saved locally in a CSV of PDF format. Four bulk upload functions exist on the system, each requires the completion of a template CSV file which allows for applications, users and Business Units to be uploaded in bulk to the system.
• Data export formats:
  • CSV
  • Other
• Other data export formats: PDF
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: We commit to minimum service availability of at least 99.9% over a 24/7 365 schedule. All planned maintenance is conducted outside of core business ours (9-5 across a Mon-Fri schedule). All planned maintenance which requires system downtime is communicated at least working 20 days in advance of the planned implementation date. Service credits for unavailability are not included as standard.
• Approach to resilience: The EmploymentCheck solution is architecturally designed with resilience and high availability in mind, enterprise grade infrastructure and load-balanced, multi-tenanted solutions are deployed to provide effective resilience to minimise service disruption wherever possible. Additional information is available on request in relation to our approach to resilience. A market leading infrastructure provider offer robust and reliable infrastructure, ensuring critical data and applications are always available and secure. The ISO-certified data centres operate with redundant power; every site has uninterruptible power supply systems and standby diesel generators to keep the site functioning in case of mains supply failure. N+1 redundancy giving 100% uptime SLA on power, cooling and fire suppression systems.
• Outage reporting: Unplanned service disruptions are handled as part of a clearly defined business continuity and disaster recovery plan. Should the plan be invoked, email alerts are issued to all key customer contacts, advising customers of the identified issue and planned resolution, additional updates are provided throughout the incident as part of a robust incident management process conducted in line with ISO 27001. Planned maintenance for system changes which will impact system access are conducted outside of core business hours (9-5 across a Mon-Fri schedule) are communicated at least 20 days in advance of the planned change. All key customer contacts are notified via email of the planned outage, reason for outage and any additional information which needs to be shared. In such instances, a visible notification banner is also placed across the system in advance of the implementation date to provide notice to end users.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Full role based access controls are implemented across the platform, this offers a clear and robust structure for protecting sensitive data from unauthorised access. Management interfaces are restricted to named individuals, with access controls in place to prevent external access. Technical security measures such as MFA, IP address whitelisting as well as organisation policies are adopted to protect access to management interfaces. Support channel credentials are only provided to named customer contacts and account restrictions ensure that access to these support channels is managed and contained.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
  • Other
• Description of management access authentication: IP Address whitelisting

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: The EmploymentCheck solution is maintained by an ISO 27001 accredited provider, by ITIL certified support staff. All aspects of service delivery are conducted in line with obligatory requirements as part of ISO 27001 which covers the security processes followed by all members of staff. All staff are fully aware of their own information security requirements; these include but are not limited to the following: • Ongoing E-learning Training - all employees are required to undertaken regular E-learning courses covering a range of topics including GDPR, Information Governance and Information Security. • Policies and procedures –staff have access to a range of procedure documents relating to their own specific roles and responsibilities, these are reviewed on an ongoing basis to ensure they are up to date. • Locked devices – Part of our information security policy stipulates that all devices are locked when an employee leaves their desk for any reason, this remains true when working remotely to avoid sharing of confidential information.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: EmploymentCheck operates a ‘process-based approach’ regarding Change Management. Through standard, repeatable, documented processes we will be able to improve quality of outputs (reduce errors and make processes more efficient) and deliver a consistent, positive experience to customers. This also helps us plan and understand the impact of changes. The ISO framework underpins how we approach and manage change, for the EmploymentCheck solution, risk is carefully considered and assessed as part of any future change, full impact assessments are undertaken where required to ensure the full scale of the change is considered, particularly when changes could impact upon customer data.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: The EmploymentCheck utilise daily tenable scans to monitor the ongoing security posture of the application. This provides comprehensive visibility of the internal and external threat factors. Using these comprehensive scans, we are able to identify and remediate potential risks at an earlier stage. This enables us to act swiftly on any vulnerabilities, reducing exposure time and strengthening overall resilience against cyber threats. EmploymentCheck commits to annual penetration testing undertaken by third parties with CREST accreditations to ensure independent verification of the software.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: The EmploymentCheck solution has active monitoring in place to detect attacks from malicious IP address ranges, IP blocklists are applied within the firewall service if required. Each login attempt which is made is recorded in a comprehensive audit log, visible only to EmploymentCheck analysts and developers. The audit log includes both successful and unsuccessful login attempts, with a timestamp recorded for each attempt. The IP address of the user attempting to login to the system is recorded, this information is purged in line with GDPR.
• Incident management type: Supplier-defined controls
• Incident management approach: EmploymentCheck has a clearly defined incident management process based on the ITIL principles. This procedure guides staff through the Major Incident (MI) process. To ensure all members of staff are familiar with all processes and procedures in relation to the management of a MI. EmploymentCheck is responsible for ensuring the confidentiality, integrity, and availability of the data and information assets that it processes and stores in its ICT systems.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Assessment Bureau
• ISO/IEC 27001 accreditation date: Friday 6 June 2025
• What the ISO/IEC 27001 doesn’t cover: ISO27001 covers all of Cantium Business Solutions
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: British Assessment Bureau
• ISO 9001 accreditation date: Wednesday 28 May 2025
• What the ISO 9001 doesn’t cover: ISO9001 covers the whole of Cantium Business Solutions
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: D8622e27-9cc0-48e4-9808-4fa6670c679b
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 5f64c651-a6e5-4b29-894e-c4524a15e389
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Ensuring new workers are informed of their right to join a trade union
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain
    • How the supplier will work with NGOs, trade unions or other businesses to address modern slavery risk
    • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering
    • Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Plans for engaging a diverse range of businesses in engagement activities prior to appointing subcontractors (including activities prior to award of the main contract and during the contract term)

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bids@eis.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.