PAYBYPHONE LIMITED

Cashless Parking Service

PayByPhone makes parking easy for motorists. We enable clients to increase revenue whilst reducing costs. With over 115 million users globally and 11 payment options the service is secure and highly accessible. A B2C marketing plan ensures a high take up of the service whilst helping tackle climate change.

Features

• IOS, Android, Mobile Web, Google/Apple Pay, Text SMS & IVR
• Cash Payments Service via PayPoint retailer network
• Power BI Management Reporting Back-Office System & Dashboards
• Multiple mobility payments platform EV charging, fuel & micro mobility
• Payment Acquisition: Financial Reconciliation, Chargebacks, Refund Settlement & Payout
• Emissions Based Charging for high & low polluting vehicles
• Customisable Parking Rights – Touchless Parking & Autopay options
• Real-time space availability & mapped EV charging & Fuel locations
• Extend parking remotely: optional reminder/confirmation messages
• Virtual Visitor Vouchers: residents & businesses with automated permissions

Benefits

• Collects clients' parking revenues securely, circa £1 billion per annum
• Environmental – Reduces vehicle mileage – encourages electric vehicle adoption
• Reduces costs by enabling reduction/removal of Pay & Display machines
• Real-Time Dashboard Reporting & Insights
• Security – Level 1 PCI Certified
• Infrastructure: Amazon Web Services, 99.9% Uptime
• Account Management & 24/7/365 Live Agent Support
• Individual Global Account – UK, Europe, North America
• Financial Reconciliation: Payment Acquisition, Chargebacks, Refund Settlement, Payout
• Parking and mobility payments provider

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at uktenders@paybyphone.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

169830972061612

Contact

Mat Birch
07812 057911
uktenders@paybyphone.com

About your service

• Service categories:

  Applications

  Production and operations

  • Other operations
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: There are no constraints in relation to our core service.
• System requirements: There are no system requirements PayByPhone is a SaaS Model.

User support

• Email or online ticketing support: Yes
• Support response times: Standard SLA response is 2 working days.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: The website facility has been tested for assistive technology users. (e.g. audio support)
• Onsite support: Yes
• Support levels: We will respond to questions from clients by close of business the next working day. Clients will get full access to our UK-based client account management team. Our service definition document provides more information about our response times and service level agreement.
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: Our implementation process takes between two and six weeks depending on the complexity of the integrations. We’ll put together a bespoke implementation plan for you after the kick off meeting. This plan will include signage, training, marketing, and pre-launch activities.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: You'll be able to download any extractable data (including historic usage reports) using our Back-Office System. You will not, however, be able to extract motorists' data because this data belongs to PayByPhone.
• End-of-contract process: We will assist you in transitioning the service to your new service provider at the end of the contract. If PayByPhone acts as the merchant, then we will agree a cut-off date and transfer any outstanding parking fees (less any agreed service fees) to your bank account. If you act as the merchant, then we will agree a cut-off date and raise a final invoice for the agreed service fees. These services will be provided free of charge.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • MacOS
  • Windows
  • Other
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: There are no differences between our mobile and desktop websites
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: We can integrate our solution with your existing enforcement solution using our application program interface (API). We offer out-of-the-box integrations with Imperial Civil Enforcement Solutions, Conduent, Chipside, Civica, Spur, and Taranto System. We can also use this API to put in place more advanced integrations (including with your existing bay sensor and automatic number plate recognition solutions).; ; Cloud Technology: By moving towards scalable, cloud-based services, we can deliver faster, more reliable solutions across markets. This shift strengthens our technical foundations, allowing us to innovate quickly, support global customers, and scale new products with ease. ; ; Open APIs and Partner Integration: We are opening up our ecosystem through APIs, allowing partners such as car-share, car-hire, and mobility providers to connect directly with PayByPhone services. This allows our technology to power broader mobility experiences and positions us as the payments engine behind connected mobility.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: We’ll replace our standard background image with an image of your choice. This feature is called “dynamic labelling”. You could also use this feature to generate additional income by promoting local businesses and events. Our service definition document provides more information about this feature. ; ; The PayByPhone service is also customised to reflect each Parking Operator's tariff configuration.

Scaling

• Independence of resources: PPayByPhone processes more than 320 million transactions per annum. Our system capacity is on average, less than 50% utilised and can be scaled according to needs that future transaction growth demands.

Analytics

• Service usage metrics: Yes
• Metrics types: We can provide a range of metrics covering:; - Revenue (By Location/Zone/Overall); - Transaction Volumes (By Location/Zone/Overall); - Parking Durations (By Location/Zone/Overall); - Usage/Registration Statistics (By Platform); - Motorist Demographics; - Payment Methods
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: You'll be able to download any extractable data (including historic usage reports) using our Back-Office System. All data is handled in line with applicable legislation (GDPR, DPA2018 etc).
• Data export formats:
  • CSV
  • Other
• Other data export formats: XLS
• Data import formats:
  • CSV
  • Other
• Other data import formats: XLS

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Our service SLA stipulates the following targets for availability:; - Smartphone Applications: 99.9%; - Mobile Website: 99.9%; - Desktop Website: 99.9%; - Back-Office System: 99.9%; - Parking Enforcement API: 99.9%; - Payment Processing: 99.9%; - Time Synchronisation: 99.9%; ; Our service definition document provides more information about our service SLA.
• Approach to resilience: PayByPhone's service is designed for resilience by leveraging AWS cloud infrastructure with multiple geographically diverse Availability Zones for redundancy and fault tolerance. Load balancers and auto-scaling groups manage traffic spikes and instance health. Data is backed up daily, weekly, and monthly, encrypted, and stored redundantly across zones. Disaster Recovery and Business Continuity plans are in place and restoration tests are conducted periodically, with a 24-hour RTO and RPO for critical services. The environment is continuously monitored, and all infrastructure is managed as code for rapid recovery.
• Outage reporting: PayByPhone delivers >99.9% uptime. There is no need for clients to monitor the service. PayByPhone monitors and logs all security events using industry standard Security information and event management (SIEM) infrastructure.; In the rare instance of an outage notifications are sent to clients via automated processes with updates provided every 30 minutes until resolution. ; ; Public facing channels utilised are Mobile Apps, IVR, Website, 24/7 call centre and Social Media platforms, alerting end users offering advice/assistance as applicable.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces is restricted using role-based access control (RBAC) and the principle of least privilege. Administrative access requires just-in-time approval and is time-limited, with all activities logged and monitored. Multi-factor authentication (MFA) is enforced for all privileged accounts. Support channels are monitored, and only authorised personnel can access sensitive information. Access rights are regularly reviewed, and shared IDs are prohibited.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: PCI DSS 4.0.1 and SOC 2 Type II
• Information security policies and processes: PayByPhone maintains documented information security and data protection policies aligned with PCI DSS 4.0.1 and SOC 2 Type II. The Security team, led by the CISO, develops and maintains policies, with management approval. Security awareness training is mandatory for all staff. Compliance is ensured through regular audits, continuous monitoring, and strict access controls. Incidents are reported to Legal and Security, with clear procedures for investigation and remediation. Non-compliance may result in disciplinary action. Oversight and accountability are clearly defined, and policies are regularly reviewed and updated.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: All service components are tracked throughout their lifecycle using configuration management controls, including gold container images in a private repository and asset inventory. Changes are managed via a formal, documented process: all changes are logged in a ticketing system, reviewed, tested, and approved by separate personnel. Security professionals assess changes for potential security and privacy impacts, with risk assessments and compliance checks. Rollback plans and post-deployment monitoring are standard, ensuring integrity and security.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Vulnerabilities are assessed through daily automated scans, weekly external scans using Tenable, and quarterly PCI-DSS ASV scans to maintain compliance. Threat intelligence is gathered from AWS Security Hub, Tenable and Snyk, which are industry standards to ensure proactive risk management. Critical and high vulnerabilities are remediated promptly, with system hardening and patching completed within 30 days. Operating system base images are updated within one week of vendor release, and services are deployed with the latest images within three weeks. Continuous monitoring, alerting, and incident response processes enable rapid detection, containment, and mitigation of threats, ensuring a secure and resilient environment.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Protective monitoring is performed using Datadog for real-time anomaly detection, AWS CloudTrail for logging, and AWS Security Hub for monitoring and alerting. Potential compromises are identified through automated alerts and daily log reviews. When a potential compromise is detected, the Incident Response team is immediately notified via paging. Incidents are triaged, contained, and remediated according to documented procedures. Response to incidents is initiated promptly based on incident severity, ensuring rapid containment and resolution.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: PayByPhone has a documented incident management process with pre-defined procedures for common events, including identification, categorisation, prioritisation, containment, remediation, recovery, and post-incident review. Users report incidents via email to Security, DPO or Legal teams. Incident reports are documented and issued to appropriate management and stakeholders, with legal handling external communications. All processes are regularly reviewed and assessed for compliance.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Citation ISO Certification Limited
• ISO/IEC 27001 accreditation date: Friday 8 April 2022
• What the ISO/IEC 27001 doesn’t cover: Design
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Citation ISO Certification Limited
• ISO 9001 accreditation date: Friday 8 April 2022
• What the ISO 9001 doesn’t cover: Nothing
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: A-LIGN
• PCI DSS accreditation date: Thursday 13 November 2025
• What the PCI DSS doesn’t cover: N/A PayByPhone is PCI DSS Level 1 Compliant
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: You do not have a current and valid Cyber Essentials Plus certificate, or will not have in place within 12 months of the date of award but have an IASME certified equivalent.
• Other security certifications: Yes
• Any other security certifications: SOC 2 Type II Attestation

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at uktenders@paybyphone.com. Tell them what format you need. It will help if you say what assistive technology you use.