HFX LIMITED

Imperago Flexitime

Imperago Flexitime can help you to meet staff expectations to work more flexibly and increase staff productivity and engagement. Imperago Flexitime solution handles clocking in and out information from a wide range of sources. Staff can clock in from contactless and temperature sensing terminals to ensure compliance following Covid 19.

Features

• Real time flexitime recording.
• Time and attendance recording.
• Complex workforce management
• HR & Payroll interface.
• Multiple posts recording.
• Sickness management.
• Real time reporting and management statistics.
• Mobile and remote access.
• Employee self service
• Contactless & temperature sensing terminals

Benefits

• Accurate recording of employee time
• Visibility on staff availability.
• Reduce turnover and staff absenteeism.
• Motivate staff and increase job satisfaction.
• Reduce staff costs and overheads.
• Real time management reporting.
• Provide workforce flexibility.
• Improve management of part time staff.
• Interfacing with other business systems.
• Address concerns around disease transmission.

Service documents

• Pricing document

  ODT

• Service definition document

  ODT

• Terms and conditions

  ODT

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at alexander.boa@advt-group.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

284534131803506

Contact

Alex Boa
03333 44 7872
alexander.boa@advt-group.com

About your service

• Service categories:

  Applications

  Enterprise resource management

  Human capital management

  • Core Human Resources Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Imperago Flexitime can integrate with most HR and Payroll solutions for a seamless end to end process
• Cloud deployment model: Public cloud
• Service constraints: N/A
• System requirements: N/A

User support

• Email or online ticketing support: Yes
• Support response times: 1 hour
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: None
• Onsite support: Yes, at extra cost
• Support levels: All customers receive the same level of Software support. Hardware can either be onsite or Return to Base. We have 1st and 2nd Line support, then 3rd line support is with consultants, developers and Cloud management. All customers have a dedicated account manager.
• Support available to third parties: No
• AI chatbot: No

Onboarding and offboarding

• Getting started: Hfx has developed a standardised approach to configure the solution to support our customers. The approach is both collaborative and iterative, designed to build relationships between hfx and the customer to ensure that the configured solution delivered meets the customer’s needs. hfx will also assist and support its customers in aligning/realigning their business processes to enable them to maximise the benefits of the solution. ; ; The solution also requires system users’ role-based access (RBAC) rights to be set up, either individually or in groups, to ensure that individuals’ permissions are applicable to their roles within the organisation, and that sensitive personal/clinical information is only accessible to those that need to see it.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: At the end of the contract term, hfx will work with the customer to agree an exit plan, including the migration of data from the system and the decommissioning of any locally sited hardware provided under the contract. The customer can usually extract its own data from the system for migrating into the new/replacement system using the tools provided. Additional consulting and support services can be provided at additional cost if these are required.
• End-of-contract process: The customer can usually extract its own data from the system for migrating into the new/replacement system using the tools provided. Additional consulting and support services can be provided at additional cost if these are required.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Via a dedicated project manager

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: There are no differences for Employee self service
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: Users can interact with the service through a secure RESTful API that provides access to core data elements including Users, Assignments (Jobs), Absences, Clockings (named Bookings in the API documentation), Rosters, and Balances.; ; Service setup is achieved by issuing an API key, which enables authenticated access to approved endpoints. During onboarding, users specify which data elements and endpoints they require, allowing permissions to be configured appropriately before access is granted. The API key does not expire, ensuring uninterrupted integration.; ; The API supports standard operations across supported data elements. Users can retrieve data using GET requests, with responses filtered based on supplied parameters. Existing records can be modified using UPDATE requests, which require a valid record identifier. New records can be created using PUT requests, and records can be removed using DELETE requests, again requiring the relevant identifier. All available endpoints and request requirements are fully documented within the API documentation.; ; Limitations are managed through permission-based access control. Users can only access the endpoints explicitly enabled for their API key, preventing unauthorised data access or modification. This ensures users can only set up or make changes to data that align with their approved use case.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Users can customise the homepage to reflect the company branding/ images and logos. All dashboards, reports, hierarchies, permissions and balances are customisable to reflect the exact requirements of the company

Scaling

• Independence of resources: HFX own the private cloud Imperago runs on and therefore is dedicated to this one function. Internal monitoring records performance so HFX can predict future requirements. Web security and load balancing servers ensure daily peaks are averaged over multiple hosts. There is always spare capacity available for seasonal peaks.

Analytics

• Service usage metrics: Yes
• Metrics types: Imperago provides real time statistics for all employee's and their status
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: Both the data centre provider and HFX have ISO/IEC 27001 accreditation. The data centre provider also has ISO 9001, ISO 22301, ISO 45001, PCI DSS, ISAE 3402 Type 2 Report and ISAE 3000 Type 2 Report. All data at rest and transit is encrypted by at least AES256 symmetric encryption standard, Backup data is effectively encrypted three times in the external immutable store in London.
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Data Erasure
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: Reports can be exported into CVS/ Excel and pdf. Web API's can also be used
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • PDF
  • Web API
  • Excel
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • Web API
  • Excel

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: HFX guarantees 99.9% availability but availability is usually in the region of 99.98% or better. This is achieved by significant investment in resilient hardware and load balancing software from Cisco and others. There are no single points of failure. Internal load balancing automatically removes from service any failed or inconsistent device or service so HFX maintain high availability. HFX have a 247 internal cloud support team to manage the infrastructure and key software components.
• Approach to resilience: There is no single point of failure for hardware, from the national grid feeds through to multiple internet connections, to firewalls, switches, server hosts and various software components. A data centre data sheet is available on request which lists the various controls, standards and resources which are in place.
• Outage reporting: HFX use a publicly available portal provided by a third party so not subject to internal issues, and e-mail alerts.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: HFX have a secure VPN which operates on a different physical connection into the data centre for management and support and each support user has a unique user ID and is allocated privileges on the 'lease privelege' principle, so each user only has what the absolutely require. High level admin users have multiple accounts so they only use the higher level access user IDs for specific tasks.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
• Information security policies and processes: HFX Is ISO27001 certified and holds regular internal audits as required by the standard to ensure security has the highest priority at all times and is actively implemented in every area of the business. HFX has an external ISO audit every year where the key processes are verified and evidence of compliance has to be provided.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: All assets are tracked from purchase to disposal, their configurations are recoded and there is a change control procedure in place for all cloud configuration services, from firewalls through to Imperago software. Every change will be signed off by the asset owner or manager or the customer. QA and test systems will verify all changes before they are committed to production.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: HFX receives e-mail alerts from manufacturers and also subscribes to receive OpenCVE reports which relate to hardware or software services used to deliver Imperago. Regular patches are applied on a weekly basic whilst high and critical patches or mitigations are applied as soon as is possible. The attack surface of all devices is reduced to the minimum necessary to minimise the risk of revealing a route for attack which can be exploited.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: HFX use a layered approach to defensive security to protect against compromise. Cloudflare is used to proxy and filter all traffic before it enters the data centre. HFX also utilise country blocking and various page rules to protect access. Edge and internal firewalls also have services to block traffic based on a ruleset, and the internal networks are segregated by access and risk. HFX uses a SIEM to collate, report and log traffic from all sources, which can identify attacks in progress. Potential compromise incidents have the highest priority and receive 24 hr attention as pr the incident response process.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: HFX has predefined processes for several categories of incident which are audited and form part of the ISO27001 management system. A user can report an incident to HFX directly via the support team where it will be escalated within HFX based on the severity and the defined process. Incident reports are created by the Customer Services Director, who owns the incident process. Reports are provided to registered customer contacts in pdf format via e-mail.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 5%
• Between £250,000 and £500,000: 6%
• Between £500,001 and £1,000,000: 7%
• Between £1,000,001 and £2,500,000: 8%
• Between £2,500,001 and £5,000,000: 9%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Alcumus ISOQAR
• ISO/IEC 27001 accreditation date: Friday 4 July 2025
• What the ISO/IEC 27001 doesn’t cover: This covers all areas of our business.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: E18abd98-3947-49b1-a56e-2d942b374a94
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Volunteering opportunities for staff
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

Service documents

• Pricing document

  ODT

• Service definition document

  ODT

• Terms and conditions

  ODT

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at alexander.boa@advt-group.com. Tell them what format you need. It will help if you say what assistive technology you use.