PHONEHUB IO LTD

Phonehub Integrated Communication System

Phonehub Integrated Communication System is a secure end-to-end encrypted service purpose built to improve communication channels between prisoners, patients, and the outside world. It encompasses telephony, email, instant messaging, photo messaging, voicemail/voice messaging and video calling into one secure mobile app, whilst ensuring that all communications remain identity-verified and auditable.

Features

• Secure telephone calls that cannot be diverted or conferenced.
• Secure view calls, emails, and instant messaging.
• Identity‑verified recipient accounts.
• Automatic content scanning.
• Automated and manual booking capabilities (for scheduling video calls).
• Flexible configurations, policy enforcement and access.
• Configurable retention and deletion policies.
• Administrative dashboard for reviewing activity, managing access, and management information.
• End‑to‑end encryption.
• Transcription, translation, and subtitling.

Benefits

• Manage Estate Wide Contact From One Intuitive System.
• Reduced Security Risk and Stronger Safeguarding.
• Greater Confidence in Who Is Communicating.
• Early Identification of Risk Behaviours and Safeguarding Concerns.
• Reduced Manual Monitoring Burden.
• Clear Audit Trails and Accountability.
• Improved Operational Control and Staff Efficiency.
• Consistent and Efficient Policy Enforcement Across the Estate.
• Better Decision-Making Through Management Information.
• Improved Emotional Wellbeing, Stability, and Strengthen Social Bonds..

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@phonehub.io. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

188267660638611

Contact

Alex Redston
01603340589
info@phonehub.io

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Healthcare
  • Public Order and Safety
  • Police
  • Defence
  • Other
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: None
• System requirements:
  • Android 6+ or iOS 10.2 and above for external user.
  • Internet speed 0.8Mbps up, 1.6Mbps down per monitoring terminal.
  • Chromium based Browser or Android tablet for prisoners, or residents.

User support

• Email or online ticketing support: Yes
• Support response times: During normal business hours we aim to respond within 2 hours.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), 7 days a week
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: Our web chat is an extension of our email ticketing system powered by Zendesk, who endeavour to meet or exceed WCAG 2.1 AA wherever possible.
• Onsite support: Yes
• Support levels: We provide support for both prison staff by email and telephone call with remote access via VPN for technical support staff where required. All prisons have a direct named contact who can be reached 7 days of the week. Phone and email support goes directly to both technical and customer service team. All queries responded to rapidly, typically within 1 hour. Technical support available within similar timeframes. We operate as a social venture putting social impact above profit, therefore we do not charge for technical support where it is our software or service which is at fault. Where equipment may have been damaged by prisoners or another external cause we will charge an appropriate amount to cover our reasonable expenses and the replacement of any items which have physically failed or been broken.
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: Onsite installation and training is provided for prison staff and management. Detailed documentation is included for reference, including training videos. Documentation and instruction materials are provided for end users, including video guides.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: Staff can extract all required data on video calls, including call records and any available recordings, directly from the service portal. Data can be downloaded in standard formats suitable for secure storage or transfer. If additional assistance is required at the end of the contract, we will support staff in completing data extraction and confirming that all necessary information has been retrieved. After the contract ends, data is retained or deleted in line with contractual and statutory requirements. At the customer’s request, we can provide confirmation of deletion once retention periods have been met. These extraction capabilities are included within the service; optional bespoke exports outside the standard portal tools can be provided at additional cost if required.
• End-of-contract process: At the end of the contract, mobile app functionality and access to the service can be disabled either across all sites or at specific prisons with minimal disruption. Equipment not owned by the customer will be returned to the supplier. We support a managed offboarding process that includes confirming deactivation dates, coordinating with operational contacts and ensuring a smooth transition. All customer data held within the service is handled in line with contractual and statutory requirements. At the customer’s request, data can be exported before contract closure or securely deleted once retention obligations have been met. These activities are included within the contract price. Optional work outside the agreed scope (for example, bespoke data extracts or additional consultancy) can be provided at additional cost if required.
• Documentation accessibility standard: EN 301 549

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Staffa access the admin and monitoring portal via a web browser. Professional users (communicating with a prisoner/resident) can use the service from their work laptops, mobiles or tablets. Social users can access it from their mobile device / tablet via an app. Both communication methods are similar in user experience.
• Service interface: Yes
• User support accessibility: EN 301 549
• Description of service interface: The service interface is a secure web dashboard that allows staff to review, manage and monitor both current and archived communciations between residents and their approved contacts. Users can search and filter scheduled or ongoing calls/video calls, manage permissions, view communication histories, and review previous calls, emails, messages, or video calls. Access is role-based and requires governor approval where necessary.
• Accessibility standards: None or don’t know
• Description of accessibility: Our service interface has been built using the GOV.UK Design System. We took this decision to build on the Design System’s strong accessibility foundations and its alignment with WCAG 2.2 AA requirements. Additionally, we test key user journeys against the WCAG principles to ensure the interface is perceivable (clear structure and readable content), operable (keyboard-accessible), understandable (consistent layouts and predictable interactions) and robust (compatible with assistive technologies).
• Accessibility testing: We have carried out basic accessibility testing using screen-reader and text-to-speech tools to ensure key user journeys can be completed non-visually. This included checking page structure, form labels, focus order and navigation. Issues identified during testing were addressed to improve clarity and compatibility with assistive technologies.
• API: Yes
• What users can and can't do using the API: The API allows establishments to integrate the service into their existing systems and automate key workflows. Through the API, users can generate usage reports, schedule visits, upload identity documents, retrieve and manage contact lists, edit relationships, and view or update restrictions on resident communications. The API can also be used to customise certain elements of the service to meet local operational needs.
• API documentation: Yes
• API documentation formats:
  • HTML
  • ODF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Service behaviour can be customised at a jurisdiction level, individual establishment level or for an individual prisoner. Customisation can include service parameters, AI behaviour, end user device integration, custom network configuration, booking systems, user management and general service portal operation API integration including Open ID connect or O-Auth or service user information may also be customised. All customisations are managed through regular service review meetings. Restrictions can be managed by prison staff with the appropriate role. Customisations are made by our in-house, full-time development team and we will consider all suggestions made by customers.

Scaling

• Independence of resources: Our service runs on Kubernetes in Google Cloud. Each product environment has its own cluster and project, which keeps workloads separate and avoids customers affecting each other. We set resource limits on each cluster so that no single process can use all the CPU or memory. Capacity automatically scales to meet scheduled demand. All hardware and network connections are chosen to be highly scalable. If demand increases, we can scale the cluster to add more capacity, so one customer’s usage doesn’t impact anyone else.

Analytics

• Service usage metrics: Yes
• Metrics types: Number of emails, messages, video calls, telephone calls, voicemails and duration of video calls or telephone calls/voicemails by time period. Scheduling and capacity usage. Security incidents, reasons for denied, paused, or terminated visits. Data can be provided by individual user. Other custom analytics can be provided upon request.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Approved staff with the relevant role-based access control can export data in an encrypted format directly from the dashboard at any time using built-in export tools. Data can be downloaded in CSV or video formats without needing technical support.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • .MP3
  • .MP4
  • .MOV
  • .WAV
• Data import formats: Other
• Other data import formats: N/A

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Services are available 365 days x 24 hrs with guaranteed SLA of 99.9% of availability.
• Approach to resilience: Available on request.
• Outage reporting: Email alerts and a public dashboard where applicable.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Two-factor authentication required to access management interfaces and support interfaces. Access is restricted using Role Based Access Control to approved user accounts, VLAN on the network and access to the network interface. Routing restrictions are in place with registered MAC addresses on switch ports and access to the admin LAN is restricted to admin's only. VPN's are in place to ensure the data is secure during transit.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We follow security processes as documented in our Information Security Management System (ISMS) Policy Manual, based on ISO27001 standards.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Phonehub IO Ltd has a formal documented Change Management process in place as defined in its ISO27001 management system. The Change Management Board (CMB) meet weekly to approve or reject requests for changes, to ensure the integrity of the process.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: For known product vulnerabilities we regularly apply all operating system and software updates. Daily automated third party vulnerability scanning using tenable.io
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Pervasive security controls with Next Generation Antivirus (NGAV); Endpoint Protection and Response (EDR); and Threat Graph.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Phonehub IO Ltd has a set of defined policies and procedures for incident management in accordance with ISO27001 best practice. The Information Security team will assess the seriousness of any situation and will take necessary action to limit any potential impact. All incidents are logged and reviewed.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Our 90-day free trial includes integration consultancy, secure voice and video calling, messaging, email, and voicemail capabilities, with up to 2 secure video calls per user per month. Customers receive 24/7 technical support, comprehensive staff training, detailed usage and activity reports. One trial per new customer. Terms apply.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 3%
• Between £1,000,001 and £2,500,000: 5%
• Between £2,500,001 and £5,000,000: 7%
• Over £5,000,001: 9%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: LRQA
• ISO/IEC 27001 accreditation date: Thursday 28 November 2024
• What the ISO/IEC 27001 doesn’t cover: The scope of our ISO27001 approval does not have any exclusions.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Eff8f530-c361-4261-9610-331aaae65c9d
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 9235c2de-5e8a-4631-a5da-b42c2510f91a
• Other security certifications: Yes
• Any other security certifications: IT Health Check

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
    • Other measures to offer development opportunities for the target cohort(s) in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@phonehub.io. Tell them what format you need. It will help if you say what assistive technology you use.