Smart Mobility Platform and App for Multi-modal Public Transport

UrbanThings is an innovative, UK-based technology company specialising in modular integrated mobility. The company provides a range of smart ticketing, multi-modal travel information & journey planning and MaaS solutions worldwide, with our products powering more than 130 million passenger journeys each year.


  • Smart mobile ticketing app and website
  • Secure mobile and print-at-home tickets with QR code integration
  • Back office reporting for retail management and customer support
  • Journey planning and real time passenger information
  • Driver app for ticket validation and vehicle tracking
  • Revenue protection and ID verification for concessionary travel
  • Integration with contactless cEMV
  • Tap In Tap Out fare support including CiBo automatic tap-out
  • Multi-modal integrations for Mobility as a Service
  • Modular technology platform for phased deployments


  • Reduce costs by moving to digital retail
  • Improve passenger satisfaction with reduced boarding times and better journeys
  • Provide real time travel information via app and web
  • Improve operational efficiencies with live network usage analytics
  • Increase ridership with access to new retail channels and demographics
  • Future-proof your systems and move to MaaS
  • Interoperable across transport modes and operators
  • Encourage behavioural change and sustainable travel
  • Protect revenue with anti-fraud security
  • Fulfil live journeys with demand-responsive transport and ride hailing


£15,000.00 to £250,000.00 an instance a year

  • Education pricing available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bids@urbanthings.co. Tell them what format you need. It will help if you say what assistive technology you use.


G-Cloud 13

Service ID

2 2 6 6 4 3 6 0 7 0 3 3 0 6 6


UrbanThings Guy Sutherland
Telephone: 02070431680
Email: bids@urbanthings.co

Service scope

Software add-on or extension
Cloud deployment model
Public cloud
Service constraints
UrbanThings is not aware of any applicable constraints
System requirements
  • Web browser: Chrome, Safari, Firefox, Edge or IE11
  • Passenger or Staff app: Android or iOS Smartphone

User support

Email or online ticketing support
Email or online ticketing
Support response times
UrbanThings provides a SLA as standard that guarantees timely responses to customer issues raised.

Response times to critical issues in Business Hours are within 1 hour, with a resolution plan within 4 hours. 24/7 monitoring and alerting is provided.

UrbanThings will provide upon request its full standard support SLAs which can be varied as required by the contracting authority.
User can manage status and priority of support tickets
Phone support
Web chat support
Onsite support
Yes, at extra cost
Support levels
UrbanThings has a multi-channel support ticketing system in place to log and track customer issues raised. Dedicated technical account managers monitor this system, and tickets can be filed either by email or within a dedicated web portal.

Our standard SLA commits us to respond in line with the following levels of service:

P1 (critical): first response < 1 hour, resolution plan < 4 hours
P2: first response < 2 hour, resolution plan < 8 hours
P3: first response < 4 hours, resolution plan < 16 hours
P4: first response < 8 hours, resolution plan < 16 hours
P5: first response < 3 days

This standard SLA is included at no extra cost with a cap on ticket volume. An enhanced SLA can be agreed if required, with prices ranging from £1,000 to £10,000 per month depending upon requirements such as ticket volume and response times.
Support available to third parties

Onboarding and offboarding

Getting started
We provide a comprehensive onboarding experience via a dedicated delivery manager. This includes telephone and email support, a project kick-off meeting and help to ensure that transit information is correctly sourced and imported into our platform.
Service documentation
Documentation formats
End-of-contract data extraction
The ability to export mission critical data is provided throughout the lifetime of the contract, via the online portal.
End-of-contract process

Using the service

Web browser interface
Supported browsers
  • Internet Explorer 11
  • Chrome
  • Safari
Application to install
Compatible operating systems
  • Android
  • IOS
  • Other
Designed for use on mobile devices
Differences between the mobile and desktop service
The mobile applications provide passenger functionality such as ticket purchase and travel information. They are distributed via the standard App Stores via Apple and Google.

The passenger website is designed for passengers who may not own a smartphone and is designed to provide print-at-home ticketing functionality.

The cloud-based back office is a web portal for retail reporting, live passenger analytics and configuration of the passenger app and website.

All interfaces are designed for an intuitive, responsive experience on their respective platform.
Service interface
User support accessibility
None or don’t know
Description of service interface
The Cloud-Based back office is a secure web-based portal for retail reporting, customer service, live passenger analytics and configuration of the passenger apps and website. There is a real time fleet map showing vehicle positions and live occupancy, live reporting and passenger analytics, retail / revenue reporting and full data export for visualisation via Business Intelligence suites.
Accessibility standards
None or don’t know
Description of accessibility
Attention is paid to the visual presentation of text and images with appropriate levels of contrast. Non-textual content is tagged with names describing purpose or content, and alternate descriptions are used for images in order to provide cues to screen readers where possible. The site hierarchy is tagged with metadata to provide cues to structure. The interface presently has not been tested for WCAG 2.0 compliance but it is our intention to aim to achieve this.
Accessibility testing
We have not tested our site extensively with users of assisted technology at the present time although intend to do so.
What users can and can't do using the API
The UrbanThings mobility API is a REST API that allows access to passenger analytics data summaries and retail reporting in an automated fashion.
API documentation
API documentation formats
Open API (also known as Swagger)
API sandbox or test environment
Customisation available
Description of customisation
Our passenger app can be customised to include the customer's corporate identity, e.g. branding, icons, colours and imagery.

The very nature of the product means that customers can enter a wide variety of custom data that is presented to their passengers on an ongoing basis. This includes but is not limited to: product/fare/ticket information, real-time service disruptions information, vehicle positions, vehicle arrival times, occupancy information and custom marketing descriptions, weblinks and other online documents such as timetables or network maps.

Customisations are made using the cloud-based operator portal.


Independence of resources
Our service environments are fully isolated from each other running in independent virtual private clouds. Each customer can be configured to have their own full set of system resources, unaffected by the actions or usage of other customers. All resources scale automatically in response to load and to cater for peak demand.


Service usage metrics
Metrics types
We provide quarterly reporting on the number of active users of the passenger app, also the number of downloads broken down by the respective mobile platform.
Reporting types
Regular reports


Supplier type
Not a reseller

Staff security

Staff security clearance
Other security clearance
Government security clearance

Asset protection

Knowledge of data storage and processing locations
Data storage and processing locations
European Economic Area (EEA)
User control over data storage and processing locations
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
Less than once a year
Penetration testing approach
Protecting data at rest
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
Data sanitisation process
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
Equipment disposal approach
In-house destruction process

Data importing and exporting

Data export approach
Full retail reports, revenue reports and passenger event data can all be exported directly from the cloud-based back office by authorised users, for a given date range and/or filtered set of passengers.
Data export formats
Data import formats

Data-in-transit protection

Data protection between buyer and supplier networks
TLS (version 1.2 or above)
Data protection within supplier network
TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability
Our standard SLA guarantees a minimum of 99.5% uptime, with no critical defects. At the time of writing, our current 365-day uptime exceeds 99.9%. Service credits are awarded in case of a material breach of the SLA. Higher levels of guaranteed uptime are available on request at additional cost.
Approach to resilience
Our web and API services are hosted on virtual private cloud servers located in multiple availability zones. These are robust and auto-scaling to meet demand in peak times such as rush-hour. Additional information is available on request.
Outage reporting
We have 24/7 monitoring and alerting of critical systems in place; with outages reported via email alerts. Additional information available on request.

Identity and authentication

User authentication needed
User authentication
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
Access restrictions in management interfaces and support channels
Access is presently restricted to senior support staff, engineers and line managers, with an internal process in place to review and revoke as necessary.
Access restriction testing frequency
At least every 6 months
Management access authentication
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users contact the support team to get audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
At least 12 months

Standards and certifications

ISO/IEC 27001 certification
ISO 28000:2007 certification
CSA STAR certification
PCI certification
Cyber essentials
Cyber essentials plus
Other security certifications

Security governance

Named board-level person responsible for service security
Security governance certified
Security governance standards
Other security governance standards
GDPR legislation
Information security policies and processes
UrbanThings is fully GDPR compliant in its record-keeping and internal processes. The company is a registered Data Controller with the ICO and has appointed a Data Protection officer in this regard.

A Data Processing Agreement accompanies our standard contract and is used to mandate our compliance with the GDPR and other relevant legislation. Relevant registers and documents are available for inspection.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
We define our infrastructure in code and all source code is access controlled via a secure change management system using the Git Flow methodology. We operate using a continuous integration system which includes the automatic testing of new software modules for performance and security.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
We uses industry standard tools, including those provided by Amazon AWS, to continuously assess threats to our systems and potential attack vectors to our production and other environments. We use isolated production environments to limit potential attack vectors. Patches are typically deployed within 72 hours, with a target of 24 hours for Common Vulnerabilities and Exposures exceeding a score of five.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
We use tools including but limited to those provided globally by Amazon AWS to monitor systems, including network interfaces and API interfaces, for potential compromises. Typical incident detection and response time is less than one hour. Additional information is available on request.
Incident management type
Supplier-defined controls
Incident management approach
Incidents are reported via a multi-channel support system which allows tickets to be logged, prioritised and tracked. Processes are in place for common events including partial or full outages and database failures. There is a backup and disaster recovery operation in place, with regular offsite backups taken. Impacted users are typically provided with impact and mitigation reports within 7 days of an event.

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks

Social Value

Fighting climate change

Fighting climate change

At its core, UrbanHub is built to help authorities, councils and operators achieve behavioural change amongst their passengers, local residents and visitors to encourage the transition to more sustainable and decarbonised travel. The platform reduces friction in using sustainable alternatives to the private car by providing simple and easy to access information about travel options as well as tools for encouraging and rewarding loyalty.
Covid-19 recovery

Covid-19 recovery

UrbanHub is designed to make travel by public transport and access to information about journey options simple and easy. This will play an important role in encouraging people back to sustainable shared public transport options in the Covid-19 recovery.
Tackling economic inequality

Tackling economic inequality

The platform provides clear and equitable information to allow passengers to make informed travel choices taking into account factors such as journey cost.
Equal opportunity

Equal opportunity

UrbanThings is an equal opportunities employer.


Employee wellbeing is a core value at UrbanThings. We implement a number of policies and initiatives to ensure and maintain staff welfare.


£15,000.00 to £250,000.00 an instance a year
Discount for educational organisations
Free trial available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bids@urbanthings.co. Tell them what format you need. It will help if you say what assistive technology you use.