GOCARDLESS LTD

GoCardless Payments

Over 100,000 organisations use GoCardless to automate collecting money via Open Banking (PIS) and Bacs (Direct Debit), send money to customers and residents, and bank account data services (AIS).

In government, our clients include the DVLA, the Cabinet Office and local Councils.

Other customers include Plum, Comic Relief, and Octopus.

Features

• Flexible payments; collect and send money as needed.
• Take subscription payments, variable invoices or one off payments.
• Collect instant payments via open banking.
• Pre-built integrations via partners for simple implementation and operation.
• ISO27001, ISO22301, CyberEssentials certified, FCA regulated.
• Industry leading API, including webhooks and client libraries.
• Real-time notification of failed or cancelled payments.
• Automatically and intelligently retry failed payments, and combat fraud.
• Go-live in as little as two days, with SUN provided.
• Deploy the product to meet your unique use case(s).

Benefits

• Automate payment collection, reducing manual administrative tasks.
• Streamline subscriptions with automatic renewals and management.
• Improve cash flow with increased speed and lower payment failures.
• Lower processing fees than cards.
• Access real-time payment insights for smarter decision making.
• Enhance customer experience with instant notifications, custom branding, simple interfaces.
• Reduce fraud with advanced anti-fraud solutions.
• Securely verify customer bank data for risk reduction.
• Integrate and adopt rapidly, with support and strategic guidance.
• Highly secure and resilient, whilst complying with all financial requirements.

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at cchambers@gocardless.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

240350258254744

Contact

Public Sector team
020 8338 9537
cchambers@gocardless.com

About the service

• Service categories:
  • Applications
    • Enterprise resource management
      • Financial
        • Financial and Accounting Applications
        • Accounts Payable Applications
        • Accounts Receivable Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: GoCardless has over 350 integrations with Accounting, Billing and CRM systems, such as Sage, Xero, Salesforce, Chargebee, and Zuora.; ; You can search our partners here: https://gocardless.com/partners
• Cloud deployment model: Public cloud
• Service constraints: Very occasionally we have planned downtime for important database maintenance. Customers are notified via email well in advance of this. You can also view the status of GoCardless here: https://www.gocardless-status.com/. Uptime for the last 5 years at the time of writing is >99.99% (December 29th 2020- December 29th 2025).
• System requirements: Access to the internet via modern web browser

User support

• Email or online ticketing support: Yes, at extra cost
• Support response times: Our Customer Support team has set SLAs for response times, depending on the customer success package chosen. You can find an overview here https://gocardless.com/solutions/customer-first-support-and-services/ and in our service definition document.; ; We offer support by phone and email; customers on our Premium package have access to priority phone lines and 24/7 support.; ; GoCardless also offers an award-winning online support centre, which can be accessed below:; https://support.gocardless.com/hc/en-gb.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), 7 days a week
• Web chat support: No
• Onsite support: No
• Support levels: Our Support Team is based in London and provides phone and email support. Standard support is provided from Monday to Friday 9 am to 6 pm. You can find an overview here https://gocardless.com/solutions/customer-first-support-and-services/ and in our service definition document. Customers on our Premium package have access to priority phone lines and 24/7 support.; ; GoCardless also offers an award-winning online support centre, which can be accessed below: https://support.gocardless.com/hc/en-gb; ; GoCardless has won Customer Support awards for its online support services. **“Most Effective Self–Service Initiative” at European Contact Centre & Customer Service Awards * *
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: GoCardless offers the following help to government services get started collected payments:; - Implementation assistance from our team of Implementation Managers; - Onboarding training following a train-the-trainer model; - Getting started section including tutorials and videos by topic in the GoCardless Support Centre and Knowledge Hub: https://support.gocardless.com and https://hub.gocardless.com/; - Guide to getting started with building an API integration: https://developer.gocardless.com/getting-started
• Service documentation: Yes
• Documentation formats: HTML
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: - Extract customer/mandate data via the 'bulk change' process of migrating your customers' mandates from GoCardless to another Direct Debit provider (free of charge).; ; - Run and export payment and mandate reports (including dates, amounts and other historic information regarding payments taken, payments attempted, mandates setup and any additional customer information, such as unique reference numbers) in .csv format.
• End-of-contract process: We offer rolling and fixed-term contracts.; ; To cancel the contract, simply email your Account Manager, or our Support Team on help@gocardless.com, requesting for your account to be terminated.; ; The contract will then be cancelled in accordance with its terms, and fees will discontinued as appropriate.; ; There are no cancellation fees, and no other associated fees with cancelling the service.; ; We will 'bulk change' / migrate your customers from GoCardless to another Direct Debit provider at the point of service termination for free, if required.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: GoCardless is built to be agnostic to the device used by your payers. Our payment flows are responsive and work on all devices.
• Service interface: Yes
• Description of service interface: GoCardless is configured and controlled through a web browser dashboard. Larger customers, including most of our government customers, use the dashboard for initial configuration and account administration only, and then integrate thier CRM/ERP solution with our API to send and receive data from GoCardless. This allows your staff to operate solely in existing and familiar interfaces.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Our WCAG 2.2 AA testing includes testing with JAWS, NVDA and VoiceOver.
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: The GoCardless API allows you to create a custom integration connected to your existing software, in a way that best meets your unique needs.; To use our API, customers sign up for a GoCardless account and create an access token which provides access to our API.; Requests can then be submitted to our API by providing this access token when sending an HTTP request.; GoCardless provides clear API documentation, pre-built code samples for popular programming languages and a free sandbox testing environment. We also provide onboarding and solutions engineering expertise, as well as free technical support for any questions.
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: GoCardless allows you to create a fully customised payment solution. Our modern API enables your developers to build a custom integration into your existing business systems. This customised solution includes:; ; 1. Customised payment pages; 2. Customised notification emails for citizens.; 3. Your service or entity name on the end customer's bank statement.; ; If your needs are for something simpler to operate or faster to deploy, you can instead use the GoCardless hosted payments pages and our notification emails.

Scaling

• Independence of resources: We apply a rate limit to all API requests, to prevent excessive numbers of simultaneous requests from an individual integrator degrading the API experience for others. Currently, this limit stands at 1000 requests per minute, per merchant. If you are making requests from a partner integration (on behalf of a merchant), the rate limit is 1000 requests per minute per merchant. See rate limiting https://developer.gocardless.com/api-reference/#making-requests-rate-limiting; ; We deploy a highly resilient and scalable service, and can add in resources on demand. System performance is monitored 24/7 with automated alerting across the service, including for capacity.

Analytics

• Service usage metrics: Yes
• Metrics types: The GoCardless dashboard provides metrics per https://support.gocardless.com/hc/en-gb/articles/17144255148572-Dashboard-reporting, with reports on eg. 'Collected payments' and 'Active customers'. ; ; If you have built an API integration, all data from your GoCardless account can be pushed in real time to your connected CRM/ERP systems, to power reporting there.
• Reporting types:
  • API access
  • Real-time dashboards
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Physical Destruction / Hardware containing data is completely destroyed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Businesses using GoCardless can export their payment and mandate creation reports to an Excel file.; ; If using an API integration, your systems will be kept up to date in real-time, meaning you already have all data at contract end. A copy can still be created for eg. validation or backup purposes.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: We have an SLA for platform availability, with the top level of availability being 99.9%. We provide provide service credits in the result of it not being met, on a sliding scale.; ; Uptime for the last 5 years at the time of writing is >99.99% (December 29th 2020- December 29th 2025).
• Approach to resilience: Available on request. We are ISO 23301 certified, and annually audited to maintain the certification.
• Outage reporting: Updates in live time are available at:; https://www.gocardless-status.com/; ; Merchants are notified via email in advance for scheduled outages.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: We have implemented Role-Based Access Control (RBAC) within GoCardless, which is managed as part of on- and off-boarding of employees. GoCardless users are granted access only to assets they need to perform their job duties in accordance with approved business purposes. Access to critical assets must be explicitly requested and approved by the asset owners. ; ; Access reviews for critical systems are performed monthly, and quarterly reviews of privileged access are performed for high-impact systems or are reviewed within 3 days of sessions.; ; Access rights are automatically revoked at 5pm on the employee's last day as part of our offboarding process.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Security work is coordinated by a designated group of managers and specialists which meets quarterly to assess the effectiveness of ongoing internal audits and security risk management. It is formed of individuals from different business functions, the majority being engineering staff. Progress is periodically reported to the Chief Product, Risk, and Technology Officers. A security performance report is submitted annually to the CEO and the senior management team for review.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Technical changes and their impact on security are evaluated as part of the project scoping and delivery workflow. Mandatory peer reviews of code and technical stability is evaluated through unit and integration testing.; Code and configuration files are managed using Github for version control, shared ownership and code review.; Software changes are integrated continuously including automated evaluation of code quality and running of unit and integration tests.; All urgent security patches are applied immediately and other updates as soon as reasonably practical.; Business and compliance changes are evaluated as part of routine weekly senior management meetings and quarterly Board meetings.
• Vulnerability management type: Undisclosed
• Vulnerability management approach: We monitor our systems constantly, with alerting built in wherever possible. We work with special interest groups and operate a bug bounty programme. ; ; GoCardless applies all urgent security patches immediately and applies other updates as soon as reasonably practical, in line with CVSS scoring.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: In the event of a serious incident, GoCardless will inform affected merchants and partners without undue delay, providing a summary of the extent, expected impact and status of the incident. Details for contacting GoCardless about that incident will be communicated with that information. Status updates will follow at regular, frequent intervals that will be determined during triage of the incident.; ; We respond to incidents in line with internal SLAs.
• Incident management type: Undisclosed
• Post-quantum cryptography secure: No
• Incident management approach: A team of experienced site reliability engineers is responsible for responding to technical and security incidents, and they follow a pre-defined process. The duty engineer role rotates weekly and the designated engineer is available to respond 24/7. Additional members of the team, including engineering managers can be contacted in the event of a particularly complex incident. Users can report issues via our normal support channels.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Businesses can sign up to GoCardless and create a sandbox to trial the solution and features, for free. This does not include live payment processing, and is not time limited.
• Link to free trial: https://manage-sandbox.gocardless.com/

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: British Assessment Bureau
• ISO/IEC 27001 accreditation date: Friday 23 September 2016
• What the ISO/IEC 27001 doesn’t cover: Per the Statement of Applicability: A.8.3.3 Physical media transfer (Media containing information shall be protected against unauthorized access, misuse or corruption during transportation); ; Reason not covered: We do not use any media for transferring data with clients. Risk related to this control is avoided.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 41c5abda-f337-454d-bddb-9aa0449039c0
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: Yes
• Any other security certifications: ISO 22301

Social value

• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
  • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at cchambers@gocardless.com. Tell them what format you need. It will help if you say what assistive technology you use.