CycleStreets Ltd

CycleStreets: Cycle routing / data API

Cycle routing API, providing optimal cycle route from A-B, offering a choice of route types (quietest route, fastest route, balanced route; circular leisure route also available).

Features

• Bicycle routing for apps, websites and research
• Cycle-friendly routes from A-B
• Different routing types available (quietest, fastest, balanced, e-bike, leisure)
• Intermediate waypoints (A-B-C...)
• Circular leisure routes also available (at additional cost)
• Elevation-aware routing
• Routing that 'thinks like a cyclist'
• Regularly-updated data
• Modern JSON interface
• Takes account of very many street attribute types

Benefits

• Enables people to plan safer cycle routes
• Enables people to plan faster cycle routes
• Encourages active transport
• Assists promotion of healthy cities and healthy transport
• Provides clear mapping of cycle infrastructure
• Easy to embed within apps and websites
• Cycle map data uses dedicated cycle infrastructure
• Use of open data, enabling additions and corrections easily

£2,999 a licence

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@cyclestreets.net. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

201776775166316

Contact

Mr. M. Lucas-Smith
01223 701901
info@cyclestreets.net

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: None.
• System requirements: Standard coding environment able to consume JSON data

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Within 48 hours, or sooner. Naturally we aim to answer questions as soon as possible and most queries are handled same-day.; ; Weekend responses are not guaranteed, but we often work weekends and pick up enquiries.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Support is provided by e-mail during the daytime, with questions answered by direct employees who run the service. We are happy to be called by phone also.; ; The service is an API, with documentation. Our support is aimed at helping implementors use the API as efficiently as possible.; ; Support is provided by the lead developers / directors of the company, rather than a separate technical account manager.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Read documentation at:; https://www.cyclestreets.net/api/; ; Obtain a key from:; https://www.cyclestreets.net/api/apply/; ; We are happy to answer queries about the API service. These are regularly folded into the documentation to provide additional clarity.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: There is no data to extract.
• End-of-contract process: No special activity takes place - the API service will keep running but customers are expected to remove their integration if they do not wish to renew for a further period, and we reserve the right to withdraw service.; ; Customers may renew for a further period if wished.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: None - this is an API.
• Service interface: Yes
• User support accessibility: WCAG 2.1 AA or EN 301 549
• Description of service interface: A basic control panel simply giving usage rates is available, but configuration is otherwise not necessary.
• Accessibility standards: WCAG 2.1 AA or EN 301 549
• Accessibility testing: The interface is compatible with speech browsers, e.g. JAWS. The service uses standard HTML4/5 page generation, and is not dependent on Javascript. Proper semantic structures are used. Usage graphs are also described as text-based tabular data.
• API: Yes
• What users can and can't do using the API: The service itself is an API.; Users obtain an API key to access the API service.
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: Implementors can specify routing types, cycling speed, and other options.; ; We are able to undertake consultancy work to add new types of routing beyond the standard types available.

Scaling

• Independence of resources: The service is spread over multiple hosts. Where usage is non-trivial, customers are put on a specific load-balanced endpoint, isolating them from other customers.

Analytics

• Service usage metrics: Yes
• Metrics types: Number of routes planned, over various time periods. These are accessed as real-time charts via the API key control panel.
• Reporting types: Real-time dashboards

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Staff screening not performed
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: In-house
• Protecting data at rest: Other
• Other data at rest protection approach: There is no personal data processed in relation to the API provision.
• Data sanitisation process: No
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: There is no data to export.
• Data export formats: Other
• Other data export formats: There is no data to export.
• Data import formats: Other
• Other data import formats: There is no data to upload.

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: SSH.

Availability and resilience

• Guaranteed availability: Standard SLA contract has 99.5% uptime.; ; In practice we have consistently achieved above 99.9%.; ; In the event of not meeting the uptime requirement, customers have the option to be refunded for time lost, at a twice pro-rata rate.
• Approach to resilience: Users sign up to an SLA which ensures we are contractually obliged to meet service standards.; ; Redundancy is present, so in the event of a serious outage, we are able to switch to another endpoint in a different data centre.; ; Multiple data centres are used geographically.; ; Uptime monitoring by an external service, and internal API format monitoring, are both in place.
• Outage reporting: The API itself returns a status output.; ; SMS alerting can be provided if necessary at extra cost.

Identity and authentication

• User authentication needed: Yes
• User authentication: Other
• Other user authentication: Use of an API key.
• Access restrictions in management interfaces and support channels: Username and password.
• Access restriction testing frequency: At least every 6 months
• Management access authentication: Username or password

Audit information for users

• Access to user activity audit information: You control when users can access audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: You control when users can access audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber essentials plus: No
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: Security is run by a Director (a direct employee) who is also an engineer involved in running the service. No aspect of security governance is outsourced.
• Information security policies and processes: Machines are patched regularly by the hosting provider, with alerting for high-risk security alerts. Internal developers also are able to patch directly.; ; Those involved in installation and deployment of services are in-house staff and are trained in security patching and resilient coding practices.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Both code and configuration are each (separately) committed to Git repositories.; ; Deployment is done on a continual rather than big-bang basis.; ; Code is reviewed regularly by other employees.; ; Code uses libraries developed over many years which have withstood the test of time.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Patch availability for machine-level software is notified regularly by the hosting company. Patches of a high urgency nature are usually applied by the host very shortly after, although this sometimes expedited by our in-house employees.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: DoS attacks are dealt with by the hosting company.; ; Application-level error logging is enabled.; ; Server performance logging for multiple attributes is checked regularly.; ; SMS alerting is set to detect slow responses, which tend to be an indication of potential problems.; ; Potential compromises are assessed for severity. In the case of the routing API, the threat potential is low as no personal data is involved.; ; Incidents are dealt with as top priority, displacing other work.
• Incident management type: Supplier-defined controls
• Incident management approach: Users can report incidents via e-mail or our feedback system.; ; In the event of a significant downtime incident, the initial response is to reconfigure the endpoints to avoid loss of service. Users would be notified by e-mail beyond this.; ; No personal data is being processed by the routing API.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Social Value

• Fighting climate change:

  Fighting climate change

  Our API specifically aims to facilitate increased levels of cycling, one of the most sustainable forms of transport.
• Covid-19 recovery:

  Covid-19 recovery

  Our API specifically aims to facilitate increased levels of cycling, a form of transport identified by the government as important as part of COVID-19 recovery.
• Tackling economic inequality:

  Tackling economic inequality

  Our API specifically aims to facilitate increased levels of cycling, a form of transport which enables people on lower incomes to have significantly greater freedom, as it is an independent form of transport which is low-cost, and which can enable people to access a wider range of employment/other opportunities.
• Equal opportunity:

  Equal opportunity

  Our API specifically aims to facilitate increased levels of cycling, a form of transport which is accessible to everyone, regardless of gender, economic status, ethnicity, and often physical disability.
• Wellbeing:

  Wellbeing

  Our API specifically aims to facilitate increased levels of cycling, a form of transport which is widely acknowledged as promoting positive mental and physical health for individuals, as well as reduced pollution/noise for society at large.

Pricing

• Price: £2,999 a licence
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Any user is welcome to register an API key for evaluation purposes. This is not feature-restricted, but usage levels are expected to be low.
• Link to free trial: https://www.cyclestreets.net/api/

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@cyclestreets.net. Tell them what format you need. It will help if you say what assistive technology you use.