KERV DIGITAL LIMITED

Digital Microsoft Power Platform CoPilot Studio Agents

Power Platform Copilot Studio Agents deliver secure, low‑code AI automation services. Organisations can design, deploy, and govern intelligent agents that streamline workflows, enhance user experience, and integrate across Microsoft environments, supported by robust governance, analytics, and scalable cloud operations

Features

• Discovery-led analysis defines requirements and aligns technical solution.
• Low-code agent development enabled by Microsoft CoPilot Studio's generative capabilities.
• Integration with Dataverse for secure structured data storage and retrieval.
• Automated workflows built in PowerAutomate improve process optimisation and consistency.
• Multi-channel publishing across Teams, web chat, email, and external platforms.
• Governance setup including Data policies, environment strategy, access controls.
• Real-time insights through structured logging, monitoring,operational analytics dashboards.
• Feedback loops and iterative agent performance tuning for continuous improvement.
• Enterprise-grade support with ticketing, phone availability, structured SLA response.

Benefits

• Accelerate efficiency automating repetitive tasks and eliminating uneccessary manual work.
• Improve decision making with real‑time insights delivered directly within workflows.
• Free staff capacity shifting effort from administration to value‑adding activity.
• Enhance customer satisfaction through consistent AI‑generated responses and timely support.
• Reduce operational errors by automatically extracting, processing structured document data.
• Enhance collaboration by integrating intelligent agents across platforms.
• Boost transparency with auditable workflows and clearly governed agent operations.
• Rapidly scale services from prototypes to enterprise deployments without redevelopment.
• Lower support demand through effective self‑service for staff and customers.
• Accelerate innovation through rapid integration without complex coding or middleware.

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at frameworks@kerv.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

164959306171178

Contact

Saad Khattak
01212815309
frameworks@kerv.com

About your service

• Service categories:

  Application Development and Deployment

  AI platforms

  AI life cycle

  • AI Build Software

  AI software services

  • Conversational AI Software Services
  • Computer Vision AI Software Services
  • Generative AI Software Services
  • Document AI Software Services
  • Anomaly Detection AI Software Services
  • Personalize AI Software Services
  • Forecast AI Software Services
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Our Copilot Studio agent service extends Microsoft Power Platform solutions, including Power Apps, Power Automate, Power Pages and Microsoft 365 services such as Teams. It enhances these products by adding intelligent automation, conversational agents and AI‑driven workflows while still operating independently if/when required.
• Cloud deployment model: Public cloud
• Service constraints: Copilot Studio Agents operate within the Microsoft Power Platform and inherit its security, licensing and environment constraints. Agents require appropriate Power Platform, Dataverse and Power Automate capacity, and their behaviour depends on available connectors, data sources and policies applied by administrators. Access to external systems must be configured via connectors, custom APIs or plugins before agents can interact with them. Agents cannot perform unsupported long‑running operations without additional orchestration. Usage limits, message quotas and environment governance may affect throughput. Capabilities depend on Microsoft’s service availability, and certain features may require premium licences or Managed Environments configuration.
• System requirements:
  • Base Licences required.
  • Power Apps licence required when deploying custom applications alongside agents.
  • Power Automate licence needed for automation workflows supporting agent behaviour.
  • Web browser required for accessing web-based CoPilot Studio interfaces.
  • Desktop operating system required for running connected desktop-based components reliably.
  • Azure DevOps licence may be required for pipeline development activities.
  • Dataverse capacity for storing agent data and operational logs.
  • CoPilot Studio licence for authoring, publishing, maintaining enterprise AI agents.
  • Appropriate Power Platform environment licences to enable Managed environments.
  • Power BI Pro licence when sharing operational analytics reports externally.

User support

• Email or online ticketing support: Yes
• Support response times: P1: Critical – Response time: 2 hrs ; P2: Major – Response time: 4 hrs ; P3: Important – Response time: 8 hrs ; P4: Minor – Response time: varies on request
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Kerv offers predefined support packages incidents as follows: (9am – 5pm), core+ (8am – 6pm), extended (6am – 10pm) with 24/7 (10am – 6am) available. support packages for core business hours (9am – 5pm). Incidents are classified as P1 (Production System Down), P2 (Production System Impaired), P3 (System Impaired), P4 (General Guidance & Requests) with associated SLAs for response times. Response times are as follows: ; P1: 1 Hour Response ; P2: 2 Hour Response ; P3: 4 Hour Response ; P4: 2 Day Response ; ; Support for defect repair is available as a bolt on service. Support is provided directly via a team of dedicated DevOps Engineers. Technical support options come in various costs and benefits, depending on the needs of the customer.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: We provide a structured onboarding process designed to help buyers adopt M365 CoPilot quickly and confidently. Onboarding begins with a discovery and alignment session to confirm objectives, required capabilities, compliance considerations and deployment environments. We provide guided setup support, including environment preparation, licensing guidance, security and governance configuration, and validation of any additional required components. ; ; Users receive access to documentation, learning paths, familiarisation materials and best‑practice guidance tailored to their organisation. We offer online training sessions covering agent design, knowledge management, workflow creation, publishing, and analytics. Optional onsite training can be provided where hands‑on, team‑wide enablement is required.; We remain available throughout early adoption to help refine the agent, support iterative improvements, and answer configuration or design questions. This approach ensures organisations become self‑sufficient in managing and extending their Copilot Studio agents while maintaining a high standard of quality, security and operational readiness.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • Other
• Other documentation formats:
  • Self-help resources, E-books, training videos and E-learning.
  • We personalise the user assistance by tailoring the in-product Help.
  • Learning Paths are also available to speed up onboarding.
• End-of-contract data extraction: The Power Platform provides numerous ways to extract any information stored within it. There are out-of-the-box methods to – through a guided process – automatically extract all information (point in time and ongoing near real-time) out to CSVs. Alternatively structured exports, dataflows exist as part of the platform and API access enables extraction from any modern tooling. ; For guidance with this and help with the tooling, users could get in contact with Kerv upon completion of contract and we will work through this with them.
• End-of-contract process: No more than 180 days after expiration or termination of Customer’s use of an Online Service, Microsoft will disable the account and delete Customer Data from the account. Transfer of Customer Data. Unless Customer has opted out of the Standard Contractual Clauses, all transfers of Customer Data out of the European Union, European Economic Area, and Switzerland shall be governed by the Standard Contractual Clauses. Microsoft will abide by the requirements of European Economic Area and Swiss data protection law regarding the collection, use, transfer, retention, and other processing of personal data from the European Economic Area and Switzerland.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • MacOS
  • Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Form factor differences, no plugins supported on mobile, more limited control of styling.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: The service is accessed through the MS CoPilot Studio interface, providing a low‑code, graphical environment for building, testing and deploying conversational agents. Users interact through a browser‑based canvas offering natural‑language authoring, dialogue management, integration configuration and publishing controls. The interface supports iterative design, governance, analytics and multi‑channel deployment, enabling organisations to quickly create and refine AI agents within a secure, managed Power Platform environment.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: We have worked with users who have assistive technology needs as part of consultations and user research. ; ; Although we seek opportunities to do so at the right times, we have not had opportunity to engage users with assistive technology needs in formal accessibility test execution. However, our test team use assistive technology, such as screen readers, as part of the accessibility test execution which we carry out.
• API: Yes
• What users can and can't do using the API: Our service provides API integration through Microsoft Copilot Studio’s Direct Line APIs, enabling external applications to securely interact with deployed agents. These APIs allow systems to send and receive messages programmatically, trigger actions, and orchestrate conversations with the agent from custom applications, portals, or engagement hubs. They also support escalation workflows, enabling seamless hand off to live agents where required. ; ; Users can connect their own applications to a Copilot Studio agent, exchange conversational messages, trigger workflows, surface responses in custom interfaces, and embed the agent within existing digital services. They can integrate with back‑end systems, enabling advanced automation and business logic. ; ; API usage requires appropriate licensing and security configuration in Copilot Studio. It does not provide full administrative control of agent configuration; authoring, publishing and lifecycle management must still be carried out within the Copilot Studio interface.
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: We provide a structured onboarding process designed to help buyers adopt Copilot Studio agents quickly and confidently. Onboarding begins with a discovery and alignment session to confirm objectives, required capabilities, compliance considerations and deployment environments. We provide guided setup support, including environment preparation, licensing guidance, security and governance configuration, and validation of required Power Platform components. ; ; Users receive access to documentation, learning paths, familiarisation materials and best‑practice guidance tailored to their organisation. We offer online training sessions covering agent design, knowledge management, workflow creation, publishing, and analytics. Optional onsite training can be provided where hands‑on, team‑wide enablement is required. ; ; During onboarding we also assist with initial agent build activities, such as creating core topics, integrating data sources, designing conversation flows and preparing a minimum‑viable agent ready for early testing. Our team ensures that governance, Data Policies (formerly DLP), analytics, and operational controls are correctly implemented before handover.

Scaling

• Independence of resources: The service operates multiple scale groups in each data centre and automatically provisions new customers into a scale group. The architecture of scale groups is designed to meet the many needs of operating a service at scale, including security, scalability, performance, tenant isolation, serviceability and monitoring. Each customer has their own individual database, separate from other customers’ databases. Data processing is logically segregated through capabilities specifically developed to help build, manage and secure multi-tenant environments.

Analytics

• Service usage metrics: Yes
• Metrics types: This is service dependent and based on customer requirements.
• Reporting types: Real-time dashboards
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Microsoft

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: Microsoft ensures that data stored on its Azure Storage accounts is encrypted by default using AES-256 encryption. Additionally, customers can manage their encryption keys through Azure Key Vault to provide an additional layer of security.
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: The Power Platform provides numerous ways to extract any information stored within it. There are out-of-the-box methods to – through a guided process – automatically extract all information (point in time and ongoing near real-time) out to CSVs. Alternatively structured exports, dataflows exist as part of the platform and API access enables extraction from any modern tooling. ; ; For guidance with this and help with the tooling, users could get in contact with Kerv upon completion of contract and we will work through this with them.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • CSV
  • Parquet
  • JSON
  • XML
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • JSON
  • XML

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
  • Other
• Other protection between networks: Please see https://docs.microsoft.com/en-us/azure/security/azure-network-security .
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
• Other protection within supplier network: Please see https://docs.microsoft.com/en-us/azure/best-practices-network-security

Availability and resilience

• Guaranteed availability: For SaaS and PaaS, we back-to-back SLAs to vendors and what they provide accordingly (MS, AWS etc) and we can offer a management wrapper to enable a single point of contact for our clients. ; ; For bespoke development/solutions we can provide a range of solutions and accompanying support offerings and SLAs up to the client's resilience needs and subject to their budget. ; ; We also provide a standard set of SLAs and availability figures in our support and CI contract.
• Approach to resilience: https://docs.microsoft.com/en-us/azure/architecture/resiliency/disaster-recovery-azure-applications
• Outage reporting: Via the service status portal, email, alerts or mobile application.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Role based access control is used to restrict access, enforcing the principle of least privilege. For management interfaces, only authorised roles can configure systems, with granular permissions and audit trails ensuring compliance. For support channels, tiered roles restrict visibility and actions, preventing unauthorised access to sensitive data or functions.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: ISO 9001:2015 ; Cyber Essentials & Cyber Essentials Plus accreditation.
• Information security policies and processes: Kerv ensures robust security, auditability and compliance across all operations with particular emphasis on AML, complaints handling, data protection, least-privilege access and controlled releases. Our approach is underpinned by certified frameworks, proactive governance and traceable artefacts. ; ; Kerv maintains an Information Security Management System certified to ISO9001, ISO 27001 and ISO27701 standards.; ; We can provide the following artefacts to support audit and compliance variation: ; - ISO 27001 / ISO 27701 / ISO 9001 certification reports ; - Internal audit reports and DPIAs ; - Role-based access control matrices and access logs ; - Security incident and breach management reports ; - Change control logs and release documentation ; - AI governance artefacts (e.g. Prompt Approval templates, Exception Review Procedures) ; - Supplier security policies and onboarding protocols.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Our change control procedure considers: ; - The identification and documentation of planned change. ; - An assessment process of possible change impact. ; - Change testing in approved non-production environment. ; - Change management approval process. ; - Identification and recording significant changes. ; - Planning and testing changes. ; - Assessment of potential impacts, including security impacts, of such changes. ; - Formal approval procedure for proposed changes. ; - Communication of change details to relevant persons. ; - Fallback procedures, including procedures and responsibilities for aborting and recovering from unsuccessful changes and unforeseen events. ; - Validation and acceptance of each change by engineering teams.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Kerv’s architectural approach removes the need for infrastructure vulnerability management through the exclusive use of platform-as-a-service and software-as-a-service products from Microsoft. A platform inventory will be created so any emerging risks or reported vulnerabilities for vendor services, e.g. Microsoft Power Platform, can be quickly identified and managed by Kerv and operational teams. ; ; Updating and patching systems - We develop and implement policies for regular updates and patch management. Our vulnerability management policy and process ensure all patches are prioritised based on the common vulnerability scoring system (CVSS) Version 3 or vendor priority e.g., Microsoft.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: See - https://docs.microsoft.com/en-us/azure/security/azure-threat-detection
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Kerv has an Incident Management Procedure in place that defines how we record, define, mitigate and report incidents. Upon discovery of an incident, staff are required to follow this procedure, and customers and external parties are given contact details of how to report this. ; ; The Senior Management Team are responsible for this policy and its implementation. ; ; Incident reports are provided to customers and other stakeholders on a periodic basis to meet contractual requirements.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: This is dependent on the licencing agreement with Microsoft that each public sector organisation has but MS do provide free trials for CoPilot.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 2%
• Between £250,000 and £500,000: 4%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 6%
• Between £2,500,001 and £5,000,000: 7%
• Over £5,000,001: 7%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: NQA
• ISO/IEC 27001 accreditation date: Friday 4 October 2024
• What the ISO/IEC 27001 doesn’t cover: A 8.30 Outsources development
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: NQA
• ISO 9001 accreditation date: Friday 4 October 2024
• What the ISO 9001 doesn’t cover: N/A
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 2fbdbdf0-e870-4fbe-aa2d-7662ec986a6d
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 700337e5-63af-42f0-bb4c-577dcad1c30b
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Working conditions which promote an inclusive working environment and promote retention and progression

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at frameworks@kerv.com. Tell them what format you need. It will help if you say what assistive technology you use.