UrbanThings

Smart Mobility Platform and App for Multi-modal Public Transport

UrbanThings is an innovative, UK-based technology company specialising in modular integrated mobility. The company provides a range of smart ticketing, multi-modal travel information & journey planning and MaaS solutions worldwide, with our products powering more than 130 million passenger journeys each year.

Features

• Smart mobile ticketing app and website
• Secure mobile and print-at-home tickets with QR code integration
• Back office reporting for retail management and customer support
• Journey planning and real time passenger information
• Driver app for ticket validation and vehicle tracking
• Revenue protection and ID verification for concessionary travel
• Integration with contactless cEMV
• Tap In Tap Out fare support including CiBo automatic tap-out
• Multi-modal integrations for Mobility as a Service
• Modular technology platform for phased deployments

Benefits

• Reduce costs by moving to digital retail
• Improve passenger satisfaction with reduced boarding times and better journeys
• Provide real time travel information via app and web
• Improve operational efficiencies with live network usage analytics
• Increase ridership with access to new retail channels and demographics
• Future-proof your systems and move to MaaS
• Interoperable across transport modes and operators
• Encourage behavioural change and sustainable travel
• Protect revenue with anti-fraud security
• Fulfil live journeys with demand-responsive transport and ride hailing

£15,000.00 to £250,000.00 an instance a year

• Education pricing available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bids@urbanthings.co. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

226643607033066

Contact

Guy Sutherland
02070431680
bids@urbanthings.co

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: UrbanThings is not aware of any applicable constraints
• System requirements:
  • Web browser: Chrome, Safari, Firefox, Edge or IE11
  • Passenger or Staff app: Android or iOS Smartphone

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: UrbanThings provides a SLA as standard that guarantees timely responses to customer issues raised.; ; Response times to critical issues in Business Hours are within 1 hour, with a resolution plan within 4 hours. 24/7 monitoring and alerting is provided.; ; UrbanThings will provide upon request its full standard support SLAs which can be varied as required by the contracting authority.
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: UrbanThings has a multi-channel support ticketing system in place to log and track customer issues raised. Dedicated technical account managers monitor this system, and tickets can be filed either by email or within a dedicated web portal.; ; Our standard SLA commits us to respond in line with the following levels of service:; ; P1 (critical): first response < 1 hour, resolution plan < 4 hours; P2: first response < 2 hour, resolution plan < 8 hours; P3: first response < 4 hours, resolution plan < 16 hours; P4: first response < 8 hours, resolution plan < 16 hours; P5: first response < 3 days; ; This standard SLA is included at no extra cost with a cap on ticket volume. An enhanced SLA can be agreed if required, with prices ranging from £1,000 to £10,000 per month depending upon requirements such as ticket volume and response times.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: We provide a comprehensive onboarding experience via a dedicated delivery manager. This includes telephone and email support, a project kick-off meeting and help to ensure that transit information is correctly sourced and imported into our platform.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: The ability to export mission critical data is provided throughout the lifetime of the contract, via the online portal.
• End-of-contract process: Na

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Chrome
  • Safari
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Other
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The mobile applications provide passenger functionality such as ticket purchase and travel information. They are distributed via the standard App Stores via Apple and Google.; ; The passenger website is designed for passengers who may not own a smartphone and is designed to provide print-at-home ticketing functionality.; ; The cloud-based back office is a web portal for retail reporting, live passenger analytics and configuration of the passenger app and website.; ; All interfaces are designed for an intuitive, responsive experience on their respective platform.
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: The Cloud-Based back office is a secure web-based portal for retail reporting, customer service, live passenger analytics and configuration of the passenger apps and website. There is a real time fleet map showing vehicle positions and live occupancy, live reporting and passenger analytics, retail / revenue reporting and full data export for visualisation via Business Intelligence suites.
• Accessibility standards: None or don’t know
• Description of accessibility: Attention is paid to the visual presentation of text and images with appropriate levels of contrast. Non-textual content is tagged with names describing purpose or content, and alternate descriptions are used for images in order to provide cues to screen readers where possible. The site hierarchy is tagged with metadata to provide cues to structure. The interface presently has not been tested for WCAG 2.0 compliance but it is our intention to aim to achieve this.
• Accessibility testing: We have not tested our site extensively with users of assisted technology at the present time although intend to do so.
• API: Yes
• What users can and can't do using the API: The UrbanThings mobility API is a REST API that allows access to passenger analytics data summaries and retail reporting in an automated fashion.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Our passenger app can be customised to include the customer's corporate identity, e.g. branding, icons, colours and imagery.; ; The very nature of the product means that customers can enter a wide variety of custom data that is presented to their passengers on an ongoing basis. This includes but is not limited to: product/fare/ticket information, real-time service disruptions information, vehicle positions, vehicle arrival times, occupancy information and custom marketing descriptions, weblinks and other online documents such as timetables or network maps.; ; Customisations are made using the cloud-based operator portal.

Scaling

• Independence of resources: Our service environments are fully isolated from each other running in independent virtual private clouds. Each customer can be configured to have their own full set of system resources, unaffected by the actions or usage of other customers. All resources scale automatically in response to load and to cater for peak demand.

Analytics

• Service usage metrics: Yes
• Metrics types: We provide quarterly reporting on the number of active users of the passenger app, also the number of downloads broken down by the respective mobile platform.
• Reporting types: Regular reports

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: Less than once a year
• Penetration testing approach: In-house
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
• Equipment disposal approach: In-house destruction process

Data importing and exporting

• Data export approach: Full retail reports, revenue reports and passenger event data can all be exported directly from the cloud-based back office by authorised users, for a given date range and/or filtered set of passengers.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Our standard SLA guarantees a minimum of 99.5% uptime, with no critical defects. At the time of writing, our current 365-day uptime exceeds 99.9%. Service credits are awarded in case of a material breach of the SLA. Higher levels of guaranteed uptime are available on request at additional cost.
• Approach to resilience: Our web and API services are hosted on virtual private cloud servers located in multiple availability zones. These are robust and auto-scaling to meet demand in peak times such as rush-hour. Additional information is available on request.
• Outage reporting: We have 24/7 monitoring and alerting of critical systems in place; with outages reported via email alerts. Additional information available on request.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Access is presently restricted to senior support staff, engineers and line managers, with an internal process in place to review and revoke as necessary.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber essentials plus: No
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: GDPR legislation
• Information security policies and processes: UrbanThings is fully GDPR compliant in its record-keeping and internal processes. The company is a registered Data Controller with the ICO and has appointed a Data Protection officer in this regard.; ; A Data Processing Agreement accompanies our standard contract and is used to mandate our compliance with the GDPR and other relevant legislation. Relevant registers and documents are available for inspection.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We define our infrastructure in code and all source code is access controlled via a secure change management system using the Git Flow methodology. We operate using a continuous integration system which includes the automatic testing of new software modules for performance and security.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We uses industry standard tools, including those provided by Amazon AWS, to continuously assess threats to our systems and potential attack vectors to our production and other environments. We use isolated production environments to limit potential attack vectors. Patches are typically deployed within 72 hours, with a target of 24 hours for Common Vulnerabilities and Exposures exceeding a score of five.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We use tools including but limited to those provided globally by Amazon AWS to monitor systems, including network interfaces and API interfaces, for potential compromises. Typical incident detection and response time is less than one hour. Additional information is available on request.
• Incident management type: Supplier-defined controls
• Incident management approach: Incidents are reported via a multi-channel support system which allows tickets to be logged, prioritised and tracked. Processes are in place for common events including partial or full outages and database failures. There is a backup and disaster recovery operation in place, with regular offsite backups taken. Impacted users are typically provided with impact and mitigation reports within 7 days of an event.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Social Value

• Fighting climate change:

  Fighting climate change

  At its core, UrbanHub is built to help authorities, councils and operators achieve behavioural change amongst their passengers, local residents and visitors to encourage the transition to more sustainable and decarbonised travel. The platform reduces friction in using sustainable alternatives to the private car by providing simple and easy to access information about travel options as well as tools for encouraging and rewarding loyalty.
• Covid-19 recovery:

  Covid-19 recovery

  UrbanHub is designed to make travel by public transport and access to information about journey options simple and easy. This will play an important role in encouraging people back to sustainable shared public transport options in the Covid-19 recovery.
• Tackling economic inequality:

  Tackling economic inequality

  The platform provides clear and equitable information to allow passengers to make informed travel choices taking into account factors such as journey cost.
• Equal opportunity:

  Equal opportunity

  UrbanThings is an equal opportunities employer.
• Wellbeing:

  Wellbeing

  Employee wellbeing is a core value at UrbanThings. We implement a number of policies and initiatives to ensure and maintain staff welfare.

Pricing

• Price: £15,000.00 to £250,000.00 an instance a year
• Discount for educational organisations: Yes
• Free trial available: No

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bids@urbanthings.co. Tell them what format you need. It will help if you say what assistive technology you use.