CycleStreets Ltd

CycleStreets: Cycle routing / data API

Cycle routing API, providing optimal cycle route from A-B, offering a choice of route types (quietest route, fastest route, balanced route; circular leisure route also available).


  • Bicycle routing for apps, websites and research
  • Cycle-friendly routes from A-B
  • Different routing types available (quietest, fastest, balanced, e-bike, leisure)
  • Intermediate waypoints (A-B-C...)
  • Circular leisure routes also available (at additional cost)
  • Elevation-aware routing
  • Routing that 'thinks like a cyclist'
  • Regularly-updated data
  • Modern JSON interface
  • Takes account of very many street attribute types


  • Enables people to plan safer cycle routes
  • Enables people to plan faster cycle routes
  • Encourages active transport
  • Assists promotion of healthy cities and healthy transport
  • Provides clear mapping of cycle infrastructure
  • Easy to embed within apps and websites
  • Cycle map data uses dedicated cycle infrastructure
  • Use of open data, enabling additions and corrections easily


£2,999 a licence

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Tell them what format you need. It will help if you say what assistive technology you use.


G-Cloud 13

Service ID

2 0 1 7 7 6 7 7 5 1 6 6 3 1 6


CycleStreets Ltd Mr. M. Lucas-Smith
Telephone: 01223 701901

Service scope

Software add-on or extension
Cloud deployment model
Private cloud
Service constraints
System requirements
Standard coding environment able to consume JSON data

User support

Email or online ticketing support
Email or online ticketing
Support response times
Within 48 hours, or sooner. Naturally we aim to answer questions as soon as possible and most queries are handled same-day.

Weekend responses are not guaranteed, but we often work weekends and pick up enquiries.
User can manage status and priority of support tickets
Phone support
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
Onsite support
Yes, at extra cost
Support levels
Support is provided by e-mail during the daytime, with questions answered by direct employees who run the service. We are happy to be called by phone also.

The service is an API, with documentation. Our support is aimed at helping implementors use the API as efficiently as possible.

Support is provided by the lead developers / directors of the company, rather than a separate technical account manager.
Support available to third parties

Onboarding and offboarding

Getting started
Read documentation at:

Obtain a key from:

We are happy to answer queries about the API service. These are regularly folded into the documentation to provide additional clarity.
Service documentation
Documentation formats
End-of-contract data extraction
There is no data to extract.
End-of-contract process
No special activity takes place - the API service will keep running but customers are expected to remove their integration if they do not wish to renew for a further period, and we reserve the right to withdraw service.

Customers may renew for a further period if wished.

Using the service

Web browser interface
Supported browsers
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
Application to install
Designed for use on mobile devices
Differences between the mobile and desktop service
None - this is an API.
Service interface
User support accessibility
WCAG 2.1 AA or EN 301 549
Description of service interface
A basic control panel simply giving usage rates is available, but configuration is otherwise not necessary.
Accessibility standards
WCAG 2.1 AA or EN 301 549
Accessibility testing
The interface is compatible with speech browsers, e.g. JAWS. The service uses standard HTML4/5 page generation, and is not dependent on Javascript. Proper semantic structures are used. Usage graphs are also described as text-based tabular data.
What users can and can't do using the API
The service itself is an API.
Users obtain an API key to access the API service.
API documentation
API documentation formats
API sandbox or test environment
Customisation available
Description of customisation
Implementors can specify routing types, cycling speed, and other options.

We are able to undertake consultancy work to add new types of routing beyond the standard types available.


Independence of resources
The service is spread over multiple hosts. Where usage is non-trivial, customers are put on a specific load-balanced endpoint, isolating them from other customers.


Service usage metrics
Metrics types
Number of routes planned, over various time periods. These are accessed as real-time charts via the API key control panel.
Reporting types
Real-time dashboards


Supplier type
Not a reseller

Staff security

Staff security clearance
Staff screening not performed
Government security clearance

Asset protection

Knowledge of data storage and processing locations
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
Datacentre security standards
Supplier-defined controls
Penetration testing frequency
At least once a year
Penetration testing approach
Protecting data at rest
Other data at rest protection approach
There is no personal data processed in relation to the API provision.
Data sanitisation process
Equipment disposal approach
A third-party destruction service

Data importing and exporting

Data export approach
There is no data to export.
Data export formats
Other data export formats
There is no data to export.
Data import formats
Other data import formats
There is no data to upload.

Data-in-transit protection

Data protection between buyer and supplier networks
TLS (version 1.2 or above)
Data protection within supplier network
  • TLS (version 1.2 or above)
  • Other
Other protection within supplier network

Availability and resilience

Guaranteed availability
Standard SLA contract has 99.5% uptime.

In practice we have consistently achieved above 99.9%.

In the event of not meeting the uptime requirement, customers have the option to be refunded for time lost, at a twice pro-rata rate.
Approach to resilience
Users sign up to an SLA which ensures we are contractually obliged to meet service standards.

Redundancy is present, so in the event of a serious outage, we are able to switch to another endpoint in a different data centre.

Multiple data centres are used geographically.

Uptime monitoring by an external service, and internal API format monitoring, are both in place.
Outage reporting
The API itself returns a status output.

SMS alerting can be provided if necessary at extra cost.

Identity and authentication

User authentication needed
User authentication
Other user authentication
Use of an API key.
Access restrictions in management interfaces and support channels
Username and password.
Access restriction testing frequency
At least every 6 months
Management access authentication
Username or password

Audit information for users

Access to user activity audit information
You control when users can access audit information
How long user audit data is stored for
Access to supplier activity audit information
You control when users can access audit information
How long supplier audit data is stored for
How long system logs are stored for
At least 12 months

Standards and certifications

ISO/IEC 27001 certification
ISO 28000:2007 certification
CSA STAR certification
PCI certification
Cyber essentials
Cyber essentials plus
Other security certifications

Security governance

Named board-level person responsible for service security
Security governance certified
Security governance approach
Security is run by a Director (a direct employee) who is also an engineer involved in running the service. No aspect of security governance is outsourced.
Information security policies and processes
Machines are patched regularly by the hosting provider, with alerting for high-risk security alerts. Internal developers also are able to patch directly.

Those involved in installation and deployment of services are in-house staff and are trained in security patching and resilient coding practices.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Both code and configuration are each (separately) committed to Git repositories.

Deployment is done on a continual rather than big-bang basis.

Code is reviewed regularly by other employees.

Code uses libraries developed over many years which have withstood the test of time.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Patch availability for machine-level software is notified regularly by the hosting company. Patches of a high urgency nature are usually applied by the host very shortly after, although this sometimes expedited by our in-house employees.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
DoS attacks are dealt with by the hosting company.

Application-level error logging is enabled.

Server performance logging for multiple attributes is checked regularly.

SMS alerting is set to detect slow responses, which tend to be an indication of potential problems.

Potential compromises are assessed for severity. In the case of the routing API, the threat potential is low as no personal data is involved.

Incidents are dealt with as top priority, displacing other work.
Incident management type
Supplier-defined controls
Incident management approach
Users can report incidents via e-mail or our feedback system.

In the event of a significant downtime incident, the initial response is to reconfigure the endpoints to avoid loss of service. Users would be notified by e-mail beyond this.

No personal data is being processed by the routing API.

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks

Social Value

Fighting climate change

Fighting climate change

Our API specifically aims to facilitate increased levels of cycling, one of the most sustainable forms of transport.
Covid-19 recovery

Covid-19 recovery

Our API specifically aims to facilitate increased levels of cycling, a form of transport identified by the government as important as part of COVID-19 recovery.
Tackling economic inequality

Tackling economic inequality

Our API specifically aims to facilitate increased levels of cycling, a form of transport which enables people on lower incomes to have significantly greater freedom, as it is an independent form of transport which is low-cost, and which can enable people to access a wider range of employment/other opportunities.
Equal opportunity

Equal opportunity

Our API specifically aims to facilitate increased levels of cycling, a form of transport which is accessible to everyone, regardless of gender, economic status, ethnicity, and often physical disability.


Our API specifically aims to facilitate increased levels of cycling, a form of transport which is widely acknowledged as promoting positive mental and physical health for individuals, as well as reduced pollution/noise for society at large.


£2,999 a licence
Discount for educational organisations
Free trial available
Description of free trial
Any user is welcome to register an API key for evaluation purposes. This is not feature-restricted, but usage levels are expected to be low.
Link to free trial

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Tell them what format you need. It will help if you say what assistive technology you use.