PHONEHUB IO LTD

Phonehub Advanced Contacts Manager

Secure intelligent system to identify, authenticate, and manage prisoner contacts. Designed to reduce resource requirements, improve security and public protection, and improve family contact. Integrates with HMPPS systems.

Features

• Integrated prisoner contacts management system.
• Intelligent risk management.
• Process customisable at establishment or prisoner level.
• Real-time status dashboard.
• Secure two-factor authentication for prison staff.
• Integrates with phone system.
• Maintains full audit trail.
• Automatic telephone number classification.

Benefits

• Significantly improves security and public protection around prisoner contacts.
• Reduces resource requirements.
• Facilitates stronger family ties and reduced stress.
• Increases efficiency of prisoner communications.
• Helps compliance with Strengthening Prisoners’ Family Ties Policy Framework.
• Enables establishments to comply with PSI 04/2016.

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@phonehub.io. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

283876060727497

Contact

Alex Redston
01603340589
info@phonehub.io

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Healthcare
  • Public Order and Safety
  • Other
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: None
• System requirements: Optional intergration with prison systems (NOMIS/PIN system)

User support

• Email or online ticketing support: Yes
• Support response times: During business hours (08:00 - 18:00, Monday - Friday) we aim for a 2-hour response time.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Phone and email support goes directly to both technical and customer service team. All queries responded to rapidly. Technical support available within similar timeframes.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Setup and process documentation is provided for prison staff and management. Video training is provided for relevant staff. On-site training is provided at extra cost.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: After the contract ends, data is retained or deleted in line with contractual and statutory requirements. At the customer’s request, we can provide confirmation of deletion once retention periods have been met. These extraction capabilities are included within the service; optional bespoke exports outside the standard portal tools can be provided at additional cost if required.
• End-of-contract process: We support a managed offboarding process that includes confirming deactivation dates, coordinating with operational contacts and ensuring a smooth transition. All customer data held within the service is handled in line with contractual and statutory requirements. At the customer’s request, data can be exported before contract closure or securely deleted once retention obligations have been met. These activities are included within the contract price. Optional work outside the agreed scope (for example, bespoke data extracts or additional consultancy) can be provided at additional cost if required.
• Documentation accessibility standard: EN 301 549

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Users access the service through a secure web dashboard, available on chromium web browsers. The interface provides role-based access to features such as identify verification, user authentication, and contacts management. All interactions take place over encrypted connections, and access is controlled via authenticated user accounts.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: During development, we test the service with a range of accessibility tools. Testing includes use of screen readers, keyboard-only navigation and browser-based accessibility features. Issues raised from these testings inform improvements to navigation, labelling and focus order.
• API: No
• Customisation available: Yes
• Description of customisation: Buyers can request customisation of the vetting process employed at particular establishments, for particular populations of prisoners.; ; Further details for individual customisatin are available on request.

Scaling

• Independence of resources: We use capacity planning to ensure that there is dedicated and reserved capacity within our cloud services for user demands. This completely eliminates resource contention issues.

Analytics

• Service usage metrics: Yes
• Metrics types: We provide a range of service metrics, including the volume of numbers checked, the number of call diversions identified, the number of contacts added and the response rate of contacts. We also report on contacts per prisoner and other operational activity to help staff monitor usage and assess risk.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Prison staff with the relevant role-based access control can export data directly from the dashboard at any time using built-in export tools. Data can be downloaded in CSV format without needing technical support.
• Data export formats:
  • CSV
  • ODF
  • Other
• Other data export formats: Excel
• Data import formats:
  • CSV
  • ODF
  • Other
• Other data import formats:
  • Excel
  • Manual input

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: We guarantee 99.9% service availability, excluding planned maintenance which is communicated in advance. Availability is monitored continuously, and we notify customers of any incidents that may affect service performance.; ; If vetting activity is attempted during a period of unplanned downtime, it will be processed free of charge. In the unexpected event of failing to meet the guaranteed availability, remedies (including any service credits) will be provided in line with the call-off contract and our terms and conditions.
• Approach to resilience: Available on request.
• Outage reporting: Outages are reported via email alerts and the user dashboard where relevant.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Two-factor authentication required to access management interfaces and support interfaces. Access is restricted using Role Based Access Control to approved user accounts, VLAN on the network and access to the network interface. Routing restrictions are in place with registered MAC addresses on switch ports and access to the admin LAN is restricted to admin's only. VPN's are in place to ensure the data is secure during transit.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We follow security processes as documented in our Information Security Management System (ISMS) Policy Manual, based on ISO27001 standards.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Phonehub IO Ltd has a formal documented Change Management process in place as defined in its ISO27001 management system. The Change Management Board (CMB) meet weekly to approve or reject requests for changes, to ensure the integrity of the process.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: For known product vulnerabilities we regularly apply all operating system and software updates. Daily automated third party vulnerability scanning using tenable.io
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Pervasive security controls with Next Generation Antivirus (NGAV); Endpoint Protection and Response (EDR); and Threat Graph.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Phonehub IO Ltd has a set of defined policies and procedures for incident management in accordance with ISO27001 best practice. The Information Security team will assess the seriousness of any situation and will take necessary action to limit any potential impact. All incidents are logged and reviewed.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Basic tier is free of charge.; Advanced tier has a 60 day free trial including up to 150 contacts.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 3%
• Between £1,000,001 and £2,500,000: 5%
• Between £2,500,001 and £5,000,000: 7%
• Over £5,000,001: 9%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: LRQA
• ISO/IEC 27001 accreditation date: Thursday 28 November 2024
• What the ISO/IEC 27001 doesn’t cover: The scope of our ISO27001 approval does not have any exclusions.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Eff8f530-c361-4261-9610-331aaae65c9d
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 9235c2de-5e8a-4631-a5da-b42c2510f91a
• Other security certifications: Yes
• Any other security certifications: IT Health Check

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
    • Other measures to offer development opportunities for the target cohort(s) in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@phonehub.io. Tell them what format you need. It will help if you say what assistive technology you use.