Healthcare and NHS SMS

Service scope

Software add-on or extension: Yes, but can also be used as a standalone service
What software services is the service an extension to: Zapier, Magento, Magento 2, Opencart, VirtueMart, Woocommerce, Wordpress, Shopify, OSCommerce, RDB Pronet.
Cloud deployment model: Hybrid cloud
Service constraints: The constraints are those imposed by existing SMS technology.
System requirements: Internet Access

Windows/MacOS/Linux Browser

User support

Email or online ticketing support: Email or online ticketing
Support response times: We endeavour to contact the Customer within 4 hours of email
User can manage status and priority of support tickets: No
Phone support: Yes
Phone support availability: 9 to 5 (UK time), Monday to Friday
Web chat support: Web chat
Web chat support availability: 9 to 5 (UK time), Monday to Friday
Web chat support accessibility standard: None or don’t know
How the web chat support is accessible: Users can contact the team via the web chat on any page of the portal or front end website. Text, images and files can be shared.
Web chat accessibility testing: N/A
Onsite support: Yes, at extra cost
Support levels: Support is available 24 hours a day, 7 days a week. Telephone/email/ticket/live chat support is at no extra cost. On site support is provided volume dependent. A Technical Account Manager will be assigned.
Support available to third parties: Yes

Onboarding and offboarding

Getting started: The VoodooSMS portal is directly accessible through your secure HTTPS web browser, making the on-boarding process as easy as possible. If necessary, one account can have many users with separate log-in details if more than one member of staff needs access to the platform. It is also possible to create sub-accounts of the main account that can be managed and monitored. Once signed up, you can start sending SMS straight away using the 500 free trial credits. Online and telephone training is provided free of charge, and on site training is available as per the pricing document.
Service documentation: Yes
Documentation formats: HTML

PDF
End-of-contract data extraction: Download of data via CSV / XLS
End-of-contract process: If the user is pre-paid, there is no extra cost at the end of the contract. Credits do not expire but are refundable if unused. If the user is post-paid, then they will be invoiced on the 1st of the following month after the contract has ended on 30 day terms. There are no additional costs to export data or close the account.

Using the service

Web browser interface: Yes
Supported browsers: Internet Explorer 11

Microsoft Edge

Firefox

Chrome

Safari

Opera
Application to install: No
Designed for use on mobile devices: Yes
Differences between the mobile and desktop service: The Voodoo SMS website is fully responsive, with all desktop features being available on the mobile site.
Service interface: Yes
User support accessibility: None or don’t know
Description of service interface: The HTTPS portal allows users to create accounts, send and receive SMS, retrieving delivery receipts, creating/managing contact lists, viewing account balance/spend and short URL tracking to name a few of the most common features. Our 'help' section documentation is available to view online which will answer many questions users may have and our support team can help 24/7 via phone and email-based support tickets.
Accessibility standards: None or don’t know
Description of accessibility: Users can interact with the Voodoo SMS portal via a web browser, any accessibility tools available via the computer's OS/browser can be used.
Accessibility testing: None in the current version.
API: Yes
What users can and can't do using the API: Users can issue an API key when an account is created which can be managed in the portal. API keys can be added or removed from within the account. Our API documentation is available to view online and our in-house team of developers can help facilitate an integration. API features include IP security, quiet times, truncate sender ID and auto-remove invalid characters which can all be amended through the API section of the portal. The API allows for the sending and receiving of SMS, retrieving delivery receipts, retrieving contact lists, adding to a contact list, retrieving balance information, transferring credits between accounts, auto-list and short URL tracking. Limitations are imposed only by that of current SMS technology, i.e. 11 character sender ID, maximum message length is 918 characters.
API documentation: Yes
API documentation formats: HTML

PDF
API sandbox or test environment: Yes
Customisation available: Yes
Description of customisation: Outbound messages and sender IDs are created by the user, and inbound message configuration such as forwarding, listing and replying can be fully customised by the user depending on their requirement.

Scaling

Independence of resources: We ensure enough resources are available.

Analytics

Service usage metrics: Yes
Metrics types: Full reporting is provided including contact number, sender ID, sent time, delivery time, delivery status and click tracking if using short URLs.
Reporting types: API access

Real-time dashboards

Resellers

Supplier type: Not a reseller

Staff security

Staff security clearance: Other security clearance
Government security clearance: Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom
User control over data storage and processing locations: Yes
Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency: At least every 6 months
Penetration testing approach: Another external penetration testing organisation
Protecting data at rest: Physical access control, complying with another standard
Data sanitisation process: Yes
Data sanitisation type: Deleted data can’t be directly accessed
Equipment disposal approach: A third-party destruction service

Data importing and exporting

Data export approach: Via the Portal and/or API
Data export formats: CSV

Other
Other data export formats: PDF
Data import formats: CSV

Other
Other data import formats: VCF

ZIP

XLS

XLXS

Manually entered

Copy / Paste

Data-in-transit protection

Data protection between buyer and supplier networks: TLS (version 1.2 or above)
Data protection within supplier network: TLS (version 1.2 or above)

Other
Other protection within supplier network: Data encryption where required, physical access limitation, VPN access to backend servers.

Availability and resilience

Guaranteed availability: We target 99.95%+ up time and currently tracking at 99.99% for Q2 2022. Compensation is given in the form of credits for any user affecting service outages.
Approach to resilience: Available upon request.
Outage reporting: Via email alerts, we also provide a status website which users can access 24/7.

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Identity federation with existing provider (for example Google Apps)

Username or password
Access restrictions in management interfaces and support channels: Access is by least permission basis, access is logged and regularly reviewed. Alerts are in place for specific account types logging in from unknown IP addresses along with limitations on access via unknown IP address. VPN access is required for core management.
Access restriction testing frequency: At least every 6 months
Management access authentication: 2-factor authentication

Dedicated link (for example VPN)

Username or password

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: At least 12 months
Access to supplier activity audit information: Users have access to real-time audit information
How long supplier audit data is stored for: At least 12 months
How long system logs are stored for: Between 1 month and 6 months

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: UKAS
ISO/IEC 27001 accreditation date: 05/12/2019
What the ISO/IEC 27001 doesn’t cover: There are no exclusions to our ISO 27001 accreditation.
ISO 28000:2007 certification: No
CSA STAR certification: No
PCI certification: Yes
Who accredited the PCI DSS certification: Trustwave
PCI DSS accreditation date: 23/12/2019
What the PCI DSS doesn’t cover: All relevant aspects are covered.
Cyber essentials: Yes
Cyber essentials plus: No
Other security certifications: No

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001
Information security policies and processes: Following ICO and Ofcom guidelines along with company policy regarding information security, data protection policy.

Operational security

Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach: Changes are tracked via various methods, including documented change management methods, support tickets with suppliers and change process control.
Vulnerability management type: Undisclosed
Vulnerability management approach: Hardware, O/S and application vulnerabilities are addressed on a case by case basis. Hardware, O/S and application updates in relation to an identified vulnerability are tested by our hosting provider, UKFast, within their R&D environment prior to release onto our platforms.
Protective monitoring type: Undisclosed
Protective monitoring approach: At the network and application level, we employ various techniques to monitor our platform. These include Intrusion Detection, file change tracking, access attempts etc. Application access is monitored and auto lockouts are in place for multiple attempted access using incorrect usernames and/or passwords. Alerting is in place for all methods using a variety of tools to inform the management and support teams. Response is usually within minutes of an alert.
Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach: Under our ISO27001 framework, we have several pre-defined processes to deal with incidents. These are reviewed and tested on a regular basis with changes made and documented as required.

Secure development

Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

Connection to public sector networks: No

Equal opportunity: Equal opportunity

VOODOO is committed to providing a working environment in which employees are able to realise their full potential and to contribute to business success. In order to create conditions in which this goal can be realised, the VOODOO is committed to identifying and eliminating discriminatory practices, procedures, and attitudes throughout the organisation. Specifically, VOOODOO aims to ensure that no employee or job applicant is discriminated against, either directly or indirectly, on the grounds of age, disability, gender reassignment, marital or civil partner status, pregnancy or maternity, race, colour, nationality, ethnic or national origin, religion or belief, sex or sexual orientation. Equal Opportunities practice is developing constantly as social attitudes and legislation change. VOODOO will keep its policies under review and will implement changes where these could improve equality of opportunity. This commitment applies to all of the VOODOO’s policies and procedures, not just those specifically connected with equal opportunity. VOODOO recognises that pay systems must be transparent and based on objective criteria in order to achieve equitable pay. This policy concentrates on removing inequality of pay on grounds of sex. VOODOO is committed to the principle of equal pay for men and women. In this context “pay” includes not only remuneration but also other benefits of employment such as promotion and training opportunities and access to facilities provided within the employment package from time to time. Women and men employed by us are entitled to equal pay if they are undertaking work which is substantially similar or is of equal value to VOODOO unless there are specific and clear reasons unconnected with their sex which explain and justify any differential in pay. In some cases, colleagues carrying out similar work may receive different salaries because of seniority, incremental points, qualifications and other such factors.

Pricing

Price: £0.02 to £0.03 a unit
Discount for educational organisations: No
Free trial available: Yes
Description of free trial: The VoodooSMS portal is available to trial free of charge with 500 free test credits. All services apart from inbound SMS are available with the free trial service by default, though inbound SMS trials can be arranged. There is no limited time period for the free trial.
Link to free trial: Www.voodoosms.com/free-account

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

Healthcare and NHS SMS

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents