SMARTER TECHNOLOGIES GROUP LIMITED

Secure Enterprise Cloud-based Water Monitoring Software

A secure, enterprise cloud-based water management platform using real-time monitoring, automated meter data, and remote stopcock control to detect leaks and irrational consumption. The service enables rapid isolation of water incidents, reduces waste, supports compliance, and improves efficiency through dashboards, alerts, and secure API integration.

Features

• Real-time monitoring of water consumption and system behaviour
• Configurable alerts for abnormal usage, continuous flow, or safety events
• ISO-aligned service delivery covering security, quality, and resilience
• Two-way communication with connected water monitoring devices
• Automated routines to support water safety and system health
• Usage analytics and performance reporting to identify leaks and inefficiencies
• Long-term historical water usage records supporting compliance and audits
• Secure API integration for estates, FM, and reporting systems
• Role-based access control with single sign-on authentication
• Centralised dashboard for managing multiple sites and estates

Benefits

• Clear, real-time visibility of water usage across buildings and estates
• Earlier identification of leaks and abnormal consumption
• Improved compliance with water safety and monitoring requirements
• Reduced water waste and associated operational costs
• Aligned with ISO 27001, 20000-1, 14001, 9001, Cyber Essentials Plus
• Faster response to water issues, reducing damage and disruption
• Better-informed decisions for maintenance and asset planning
• Improved efficiency and resilience of water systems
• Reduced operational losses through continuous monitoring
• Scalable water management supporting changing organisational needs

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at enquiries@smartertechnologies.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

142090130371060

Contact

Elaine Glock
+44 (0)330 223 5000
enquiries@smartertechnologies.com

About your service

• Service categories:

  Applications

  Production and operations

  • Other operations
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: None
• System requirements: None

User support

• Email or online ticketing support: Yes
• Support response times: Within the hour
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AAA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AAA
• Web chat accessibility testing: Dragon and Jaws
• Onsite support: Yes
• Support levels: Smarter Technologies Group provides comprehensive, UK-based support across all services, aligned to ITIL best practice and customer requirements, with standard business hours support (09:00–17:30, Monday–Friday) included within the service price, covering incident, request, and change management via our Service Desk; extended or 24x7 support is available for mission-critical services at an additional, clearly defined cost agreed at contract or call-off stage based on service criticality, SLAs, and response requirements, with no hidden or per-incident charges. All our services are supported, at no additional cost, by a dedicated Technical Account Manager (TAM) who has over 20 years’ experience delivering successful transition and transformation services across the UK Public Sector, having operated on both the client and supplier side, and therefore bringing strong supplier management and communication skills at all levels. The TAM acts as the client’s first point of contact for any service issues, with a clear escalation route to the Client Director if required, and together the Client Director and TAM meet with clients on a regular basis to track service deliverables against requirements, manage risks, and ensure ongoing client satisfaction.
• Support available to third parties: Yes
• AI chatbot: No

Onboarding and offboarding

• Getting started: At service commencement, we configure the platform to customer requirements, set up user access, and deliver onboarding sessions aligned to agreed use cases. Training can be provided remotely or onsite where required and covers dashboards, data visualisation, APIs, data flows, and operational processes. We provide clear, role-based user documentation, including platform guides, runbooks, and operational procedures, which are maintained and updated throughout the service lifecycle. Online training materials and recorded walkthroughs are made available to support self-service learning and onboarding of new users. Where required, we deliver bespoke training sessions for technical, operational, and business users to ensure they can confidently access data, interpret insights, and integrate the platform into day-to-day operations. Ongoing support and guidance are provided through the Service Desk and a dedicated Technical Account Manager, who ensures users receive continued assistance, best-practice advice, and support as their use of the data platform evolves.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: At the end of the contract, we supports customers with a structured and secure data extraction and service exit process to ensure full access to their data and a smooth transition. All customer data remains the property of the customer and can be extracted in standard, open formats appropriate to the service, such as CSV, JSON, or agreed database exports, to support reuse and migration to alternative platforms. Data can be provided via secure transfer methods, including encrypted download links or secure file transfer services, in line with agreed security requirements.; ; The data extraction process is planned in advance as part of service off-boarding, with the scope, format, and timelines agreed with the customer to minimise disruption. We provide reasonable technical support during the exit period to assist with data validation, clarification of schemas, and handover to a replacement supplier if required. Once data extraction has been completed and formally confirmed by the customer, remaining customer data is securely deleted from our systems in accordance with contractual obligations, data protection legislation, and our information security policies.
• End-of-contract process: At the end of the contract, we follow a structured and transparent service exit process designed to ensure continuity, protect customer data, and minimise disruption. We work with the customer to agree an exit plan covering timelines, responsibilities, and dependencies, including data extraction, service wind-down, and transition to an alternative supplier or in-house operation if required. Customers are supported through the orderly decommissioning of services, removal of access, and confirmation of service cessation. All customer data remains the property of the customer and is handled in line with contractual and data protection requirements.; ; Included in the contract price is standard service off-boarding, including exit planning, coordination meetings, support for data extraction in agreed formats, and confirmation of secure deletion of customer data following customer sign-off. Reasonable administrative and technical support during the exit period is also included.; ; Additional costs may apply where the customer requests non-standard activities, such as extended exit periods beyond the contract end date, bespoke data transformation or migration support, additional documentation, or ongoing access to systems after service termination. Any additional costs are agreed in advance, are transparent, and are charged at pre-agreed rates to ensure clarity and cost control.
• Documentation accessibility standard: WCAG 2.2 AAA

Using the service

• Web browser interface: No
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
  • ChromeOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Optimised for mobile
• Service interface: No
• User support accessibility: WCAG 2.2 AAA
• API: No
• Customisation available: No

Scaling

• Independence of resources: We ensure independence of resources through a segmented, cloud-based service architecture designed to prevent one customer’s demand from impacting another. Services are deployed using logical separation of environments, role-based access controls, and controlled resource allocation to isolate workloads. Platform capacity is actively monitored, with auto-scaling and threshold alerts used to manage demand peaks and maintain performance. We apply capacity management and forecasting as part of our service management process to ensure sufficient headroom is maintained at all times. Where required, customers can be supported using dedicated resources or environments, agreed at contract stage, to provide additional assurance for mission-critical services.

Analytics

• Service usage metrics: Yes
• Metrics types: Metrics include service availability and uptime, incident volumes and resolution times, SLA compliance, and mean time to respond and restore (MTTR). We also report on change success rates, platform performance and capacity, and security and compliance indicators where applicable. Customer experience is measured through service review feedback and trend analysis. Metrics are reviewed regularly with customers via dashboards and service review meetings to ensure transparency, accountability, and continuous service optimisation.
• Reporting types: Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest: Physical access control, complying with CSA CCM v4.0
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Users export their data through secure, controlled, and standardised mechanisms designed to support reuse and portability. Data can be exported directly via platform APIs, allowing users to retrieve live or historical data programmatically in common, open formats such as JSON or CSV. For non-technical users, data exports can be generated from platform dashboards or reporting tools, enabling scheduled or ad-hoc downloads of datasets. Where larger volumes of data are required, we support bulk data exports delivered via secure file transfer methods, such as encrypted download links or secure transfer services. Export permissions are governed by role-based access controls.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: Private network or public sector network
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: We design our services to deliver high availability and resilience, aligned to ISO/IEC 20000-1 service management standards. Availability targets and service levels are defined per service and agreed contractually with each customer.; ; For cloud-based and managed services, we target 99% service availability, excluding planned maintenance, with proactive monitoring and incident management in place to minimise disruption.; ; Availability is supported by:; ; Redundant cloud architectures and monitored third-party dependencies; ; Defined incident response and escalation SLAs; ; Tested service continuity and disaster recovery arrangements with service-specific RTOs and RPOs; ; Service Credits / Refunds; ; Where availability falls below the contractually agreed SLA, we apply service credits or fee adjustments in line with the customer contract. Credits are proportionate to the level and duration of SLA breach and are applied to subsequent invoices. Chronic or major breaches trigger formal service reviews, corrective actions, and improvement plans through the Service Management framework; ; Final availability guarantees and remedies are always confirmed in the applicable Statement of Work or Call-Off Contract.
• Approach to resilience: We design our services to meet the intent of NCSC Cloud Security Principle 2: Asset Protection and Resilience, ensuring services continue to operate in the face of faults, failures, or malicious activity. Our services are delivered using resilient cloud architectures designed to avoid single points of failure, with critical components deployed with redundancy and protected through secure configuration and access controls.; ; We implement defence in depth, including monitoring, alerting, and automated recovery mechanisms, to detect issues early and enable rapid response. Regular backups are performed, and tested recovery procedures are in place to restore services and data within agreed Recovery Time and Recovery Point Objectives. Capacity management and scaling controls ensure that unexpected demand or component failure does not degrade service availability.; ; Resilience is supported by documented incident management and service continuity processes, which are regularly reviewed and tested to ensure ongoing effectiveness.; ; Our services are hosted on high-availability cloud infrastructure, using resilient datacentre designs with geographic separation and fault tolerance appropriate to the service. Detailed information on datacentre locations, redundancy models, and resilience controls is available on request to support customer assurance and security assessments in line with NCSC guidance.
• Outage reporting: We report service outages through a clear, timely, and multi-channel communication approach designed to ensure customers are promptly informed and kept up to date. Where appropriate, customers are provided access to a service status dashboard that shows current service health, planned maintenance, and any active incidents, giving visibility of impact and progress in near real time.; ; For customers requiring system-to-system integration, API-based status information can be made available to allow service health and incident updates to be consumed directly into customer monitoring or service management tools.; ; During an outage or service degradation, email alerts are issued to agreed customer contacts, providing confirmation of the incident, an initial impact assessment, and regular status updates until resolution. Notifications are aligned to agreed SLAs and escalation procedures to ensure the right stakeholders are informed at the right time.; ; In addition, outages are logged and tracked through our IT service management platform, with updates available via the Service Desk and the customer’s Technical Account Manager. Following resolution, customers receive a summary of the incident and, where appropriate, a post-incident review outlining root cause, actions taken, and any preventative measures implemented.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: We use role-based access control (RBAC), least-privilege principles, and strong authentication. Access to administrative and management interfaces is limited to authorised personnel only and protected using multi-factor authentication, secure credentials, and network controls. Permissions are granted based on job role and regularly reviewed.; ; Support channels are controlled through authenticated service desk access, with user identity verified before any action is taken. Segregation of duties is enforced to prevent unauthorised or inappropriate changes, and all access to management interfaces and support systems is logged and auditable. Access rights are promptly revoked when no longer required.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: You control when users can access audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: You control when users can access audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We follow a comprehensive set of information security policies and processes aligned to recognised standards and best practice, including ISO/IEC 27001 principles, ISO/IEC 20000-1 service management, NCSC guidance, and the UK Government’s Cyber Essentials and Cyber Essentials Plus schemes. Our policies cover information security governance, risk and asset management, access control, secure configuration, incident management, supplier security, data protection, and service continuity, and are supported by documented procedures that define how controls are implemented and operated across all services.; ; Accountability for information security sits with senior management, with clear reporting lines from operational and service teams through Service Owners to the CTO, who has overall responsibility for security, risk, and compliance. Security risks, incidents, and compliance status are reported through defined escalation paths and reviewed within regular management and service review forums.; ; We ensure policies are followed through mandatory staff security training, adherence to Cyber Essentials technical controls, role-based access management, formal change and incident management processes, and regular internal audits and assurance activities, including Cyber Essentials and Cyber Essentials Plus assessments. Policies and processes are reviewed at least annually, or following significant change, to ensure continued effectiveness and compliance.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: We adhere to ISO/IEC 20000-1, ISO/IEC 27001, Cyber Essentials and Cyber Essentials Plus. All service components are recorded within a controlled configuration management system and tracked throughout their lifecycle from design and deployment through to change and decommissioning. Configuration items are version controlled, auditable, and aligned to security baselines.; ; All changes are managed through a formal change management process aligned to ISO 20000-1, with mandatory security impact assessment in line with ISO 27001 and Cyber Essentials controls. Each change is assessed for risk to confidentiality, integrity, availability, and compliance before approval, tested prior to release, and subject to post-implementation review.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: We operate a structured vulnerability management process aligned to ISO 27001, ISO 20000-1, and Cyber Essentials / Cyber Essentials Plus. Potential threats are assessed through continuous monitoring, vulnerability scanning, and risk assessment against the confidentiality, integrity, and availability of our services. We prioritise vulnerabilities based on severity and impact, applying patches in line with defined SLAs, with critical security patches deployed as soon as practicable following validation and testing. Information on emerging threats is sourced from vendor security advisories, NCSC guidance, CERT alerts, and trusted industry sources, with findings reviewed by technical and security leads to ensure effective remediation.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Potential compromises are identified through continuous monitoring of systems, logs, and alerts using security monitoring and SIEM tooling, combined with automated alerting and analyst review. Indicators such as anomalous behaviour, unauthorised access attempts, or configuration changes trigger investigation.; ; When a potential compromise is identified, incidents are logged and managed through our formal security incident response process, including containment, impact assessment, remediation, and escalation to senior technical and security leads where required. High-severity security incidents are responded to immediately, with rapid containment actions initiated and customers informed in line with agreed SLAs, followed by root cause analysis and corrective actions.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Our formal incident management processes align to ISO/IEC 20000-1 and ITIL best practice, with pre-defined procedures for common incident types to enable rapid and consistent response. Users can report incidents via our Service Desk, using email, phone, or our IT service management platform, which provides a single point of contact and full audit trail. Incidents are categorised, prioritised, and managed against agreed SLAs, with clear escalation paths for high-impact issues. Customers are kept informed through regular updates during an incident, and incident reports are provided following resolution, including impact, root cause (where applicable), actions taken, and any preventative measures implemented.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 5%
• Over £5,000,001: 7%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Peers Quality Assurance Limited
• ISO/IEC 27001 accreditation date: Saturday 30 March 2024
• What the ISO/IEC 27001 doesn’t cover: NA
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Alcumus ISOQAR
• ISO 9001 accreditation date: Tuesday 6 June 2023
• What the ISO 9001 doesn’t cover: NA
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 5d246ce1-a8c5-4f64-8b5b-36e02b3ae9a6
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 1fa1061b-dee9-48b5-8a88-b499d9478d90
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at enquiries@smartertechnologies.com. Tell them what format you need. It will help if you say what assistive technology you use.