TRUSTLY UK LIMITED

Open Banking Payments and Data Services

Trustly UK (and its subsidiary, Ecospend Technologies), caters to diverse industries, sectors and prestigious brands. Trustly provides standardised and customisable Payment Initiation Services (PIS) and Account Information Services (AIS) including value-add data services boasting unparalleled expertise, especially in delivering tailored open banking solutions for the Public Sector.

Features

• Account to Account payments
• Real time bank account authenticity assessment
• Open Banking powered identity insights
• Financial transaction analysis and categorisation
• Fraud prevention solutions
• Reporting and dashboard
• White label and pure-API solutions
• Available via multiple channels for end user benefit

Benefits

• Reduced operational costs
• Enhanced user experience, enabled by automated population of data
• Reduced overheads due to automated and accurate reconciliation
• Informed decisioning enabled by automated and tamper-proof financial data
• Fraud mitigation
• Coverage of personal, business and corporate bank accounts
• Immediate settlement for payments
• Improved accuracy and mitigation of human error

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at publicsector@trustly.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

238376354794702

Contact

Greta Akintoye
+447586681287
publicsector@trustly.com

About the service

• Service categories:
  • Applications
    • Enterprise resource management
      • Financial
        • Financial and Accounting Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Our payments service can be integrated into your existing e-commerce journey, telephone payments, chatbot, physical correspondence etc.; ; Our data services can be integrated into your existing processes and/or systems for eligibility, affordability and fraud prevention/mitigation etc.
• Cloud deployment model: Public cloud
• Service constraints: Our 24/7/365 service is stable, reliable and scalable operation for our clients. Regular scheduled maintenance ensures stability, continuous improvement, and innovation in line with evolving open banking standards. Our clients receive prior notification of any planned downtimes, strategically scheduled for minimal disruption wherever possible. While some issues in the open banking ecosystem are beyond our control (e.g. bank API failures), proactive end-to-end monitoring and swift intervention ensures that any negative impacts on user and merchant experience are mitigated as much as possible.
• System requirements: N/A

User support

• Email or online ticketing support: Yes
• Support response times: Our SLAs are designed to prioritise proactive issue resolution and prompt client communication. We endeavour to tackle issues proactively and promptly notify clients upon their identification. Our SLAs can be customised to align with individual requirements of each client. We recognise that different issues may have varying levels of priority and impact, and therefore, our SLAs incorporate different response times to ensure efficient resolution based on the severity of the issue.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: No
• Support levels: Trustly has developed a varied and experienced team since its launch in 2017, drawing on multi-disciplinary executives spanning technology support, technology development, account management from the Financial Services and Payments Industries. We are dedicated to fostering successful partnerships by providing dedicated account management resources who are supported by our in-house technical teams. Our commitment to excellence extends beyond the initial engagement, as we believe in nurturing relationships for long-term success. Through our dedicated account management team, we offer personalised support and guidance tailored to the unique needs of each partnership. This ensures that our clients receive the attention and assistance necessary to achieve their objectives and maximise the value of our collaboration.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We believe in facilitating a seamless transition for clients as they start using our service. Our approach is hands-on and supportive, ensuring that every step of the onboarding process is smooth and efficient. Our dedicated technical team is readily available to provide guidance and assistance, whether it's resolving technical queries or offering strategic advice. Clients have access to our team throughout the onboarding journey, allowing for real-time support and troubleshooting as needed.; ; In addition to our hands-on support, we provide comprehensive guidance documents that are publicly available. These documents serve as valuable resources for users, offering detailed instructions, best practices, and troubleshooting tips. You can access our onboarding guide https://docs.ecospend.com/new/guides.html#merchantOnboardingIntro. They empower clients to explore our service at their own pace and address any questions or challenges they may encounter.; ; Whether it's through direct interaction with our technical team or through self-service resources, our goal is to ensure that users feel supported and confident as they begin using our service. We are committed to providing the necessary tools and assistance to help users unlock the full potential of our platform.
• Service documentation: Yes
• Documentation formats: HTML
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: The migration and timing for switching off the service will be agreed with the client in order to ensure no disruption. There will also be a clear transfer/demobilisation plan in place with the client.; ; All data stored by us as part of the services, from management data to transaction data, will be deleted or transferred to the new supplier in line with the timeframes and requirements agreed with the client as part of the exit management plan.; ; Any physical copies of data, management reports, etc will be returned to the buyer or destroyed. Only data required to be kept by us as part of any legal, financial or regulatory requirements will be kept by the Supplier as part of those obligations.
• End-of-contract process: Trustly will agree a comprehensive exit management plan with the client, prioritising uninterrupted operations and compliance with individual requirements of the client.; ; Our plan will outline a collaborative approach, emphasising joint working groups with key stakeholders from both Trustly and the client, ensuring alignment and efficiency throughout the exit process.; ; Critical steps include assessing ongoing work progress, documenting records, finalising financial matters, and maintaining regular communication through business-as-usual and exit plan meetings.; ; Trusly will commit to providing uninterrupted services until the agreed-upon end date, adhering to all Key Performance Indicators (KPIs) and Service Level Agreements (SLAs), and supporting a seamless transition to any new supplier (if appropriate).; ; Our will feature plan features structured schedules for meetings, demobilisation timelines, risk management, action logging, and asset tracking to ensure systematic proceedings.; ; Additionally, as part of annual review meetings with the client's joint working group we will evaluate the plan's effectiveness and make necessary updates collaboratively.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The consumers are able to initiate a payment and/or complete their consent journey in a number of ways depending on their preference:; - by using their mobile phone (mobile journey via their mobile banking app, authentication using biometrics); or; - online (Web journey) which will require the consumers to log in to their online banking using their online banking credentials; or; - start the journey on the Web, go through the payment initiation / consent journey using their mobile and go back to the client's Web page to complete the engagement (de-coupled journey).
• Service interface: Yes
• Description of service interface: Our Management Console serves as a value-adding tool for our clients, offering a range of functionalities including reporting, configurations, user management, and dashboard access. Designed with clarity and efficiency in mind, it provides a clear breakdown of transactions and other key metrics, empowering our clients with actionable insights to make informed decisions. Whether it's tracking performance, managing users, or configuring settings, our Management Console delivers a seamless experience tailored to meet the diverse needs of our clients.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: We have tested our service with the following assistive technology:; ● JAWS; ● NVDA; ● VoiceOver (MacOS and iOS); ● ZoomText and Fusion; ● Native magnifier; ● Voice Control for Mac or iOS; ● Native OS features (high contrast mode)
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: We provide our Open Banking services via RESTful APIs in line with open banking standards. A merchant first authenticates to our API services using a client_id and client_secret. They then receive an access_token to be used for the subsequent services. A detailed flow of the process is provided at: https://docs.ecospend.com/new/guides.html#pisInstantPayment; ; Our APIs are implemented in accordance with OAS 3.0.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Our white label products offer customisation options to align with the merchant's branding. Clients can tailor the bank list and send payment/data links via SMS and/or email. Additionally, we provide a pure API option, granting clients full control over the look and feel of the solution, ensuring complete alignment with their brand identity and user experience preferences.

Scaling

• Independence of resources: Our system is engineered for autonomous scalability and adept management of fluctuating volumes. Key components of this design include:; ; - Leveraging the substantial transaction volumes processed daily to establish a robust data feedback loop. This enables continuous performance optimisation and proactive issue identification.; ; - Employing an automatic scale-up and scale-down architecture for maximum efficiency.; ; - Regular assessment of clients' evolving requirements, facilitating system configurations tailored to enhance performance and resource utilisation.; ; - Implementation of a comprehensive monitoring system with alert mechanisms. This proactive approach allows for early issue detection and timely intervention to prevent escalation.

Analytics

• Service usage metrics: Yes
• Metrics types: Comprehensive reporting is available via our Management Console. This includes, but is not limited to:; - Service availability; - API connection status; - API call volumes / values (where appropriate); - System monitoring, such as latency; - Error rates; ; We can customise reporting suite based on individual requirements.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: We make use of application level data encryption where PII data is encrypted in memory before being written on the database.
• Data sanitisation process: Yes
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: The users can export the data in different file formats (CSV, Excel, JSON).
• Data export formats:
  • CSV
  • Other
• Other data export formats: JSON
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: Mutual TLS

Availability and resilience

• Guaranteed availability: Our service aims to ensure 24/7/365(366) availability with an uptime of 99.9%, while SLAs can be tailored to meet the specific requirements of our customers.
• Approach to resilience: This is available on request.
• Outage reporting: Whilst we have not experienced any significant outages of our system since inception, we have deployed a multi-faceted approach to report outages promptly. Our service offers several channels for outage notifications, including API endpoints for automated monitoring, email alerts sent directly to relevant stakeholders, announcements via our platform, and visibility through our management console dashboard. This comprehensive system ensures that our clients are promptly informed of any disruptions, enabling swift response and resolution.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
• Other user authentication: End customers authenticate themselves using Strong Customer Authentication in line with industry standard; ; Merchants use unique client credentials to access our environment, e.g. management console.
• Access restrictions in management interfaces and support channels: We enforce access restrictions in our management interfaces and support channels through measures such as IP address restrictions and the implementation of 2-factor authentication for accessing the management console.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Cyber Essentials Plus
• Information security policies and processes: Our commitment to data protection extends beyond implementation to ongoing evaluation and improvement of our technical measures:; ; - Annual Evaluation of Data Protection Impact Assessments (DPIAs): Our dedication to maintaining the highest standards of data protection is demonstrated through the annual evaluation of Data Protection Impact Assessments (DPIAs). This systematic review ensures that our data processing activities are continually assessed for compliance, effectiveness, and alignment with evolving regulatory standards. By conducting these evaluations on a regular basis, we demonstrate a proactive commitment to identifying and mitigating potential risks associated with our projects.; - Regular Testing of Technical Measures: Ewe prioritise the reliability and effectiveness of our technical measures by subjecting them to regular testing. Our Quality Assurance (QA) team conducts thorough assessments whenever changes are made to the system. This rigorous testing process ensures that any updates or modifications to our systems do not compromise the integrity, confidentiality, or availability of personal data. It serves as a proactive measure to identify and rectify any potential vulnerabilities or issues, contributing to a robust and secure data processing environment.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Change requests are logged on the project board for assessment. The security, performance, and usability impact of changes are evaluated at various stages of the Software Development Lifecycle (SDLC) by designated teams:; ; Security and Architecture: Pre-design and design phases.; Product Management: Requirement and production phases.; Software Development: Design and development phases.; Quality Assurance Team: Testing phase.; ; Each team documents their evaluation and approves their respective stage. Our SDLC allows tracking of changes through 'Work Items' managed by these teams. Additionally, the delivery of changes to product environments is traced via recorded CI/CD steps linked to these 'work items'.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We are ISO 27001 certified and therefore, our vulnerability management process is aligned with those requirements.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We are ISO 27001 certified and therefore, our protective monitoring processes are aligned with those requirements.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: Yes
• Incident management approach: We are ISO 27001 and Cyber Essentials Plus certified and therefore, our incident management process is aligned with those requirements.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Trials, pilots, and proof of concepts are evaluated on a case-by-case basis. Nevertheless, we offer complimentary access to our Sandbox environment.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 15%
• Between £2,500,001 and £5,000,000: 20%
• Over £5,000,001: 25%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: FINAS (the Finnish Accreditation Service)
• ISO/IEC 27001 accreditation date: Thursday 14 December 2023
• What the ISO/IEC 27001 doesn’t cover: Trustly UK Limited (TUKL) is the contracting entity for this framework; however, the Open Banking platform is provided via our subsidiary, Ecospend Technologies Limited.; ; The Ecospend technology platform is fully covered under its ISO 27001 certification. ; ; Accreditation Body: UKAS; ; Last Audit/Issue Date: 28/10/2024
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: Ee0743ac-c128-472b-82b8-26423d54d34d
• Cyber essentials plus: Yes
• Cyber Essentials Plus Certificate Number: 3859c960-0bf3-4f10-aa28-48ead3544f2b
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Plans to engage the contract workforce in deciding the most important workplace issues to address
  • Ensuring new workers are informed of their right to join a trade union
  • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
  • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Volunteering opportunities for staff
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
  • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
  • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors
  • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)
  • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
  • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

  • Understanding of the issues affecting the development of new skills by target cohort
  • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
  • Other measures to offer development opportunities for the target cohort(s) in the contract workforce
  • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at publicsector@trustly.com. Tell them what format you need. It will help if you say what assistive technology you use.