CareLineLive eBrokerage

Service scope

Software add-on or extension: No
Cloud deployment model: Public cloud
Service constraints: CareLineLive eBrokerage Cloud software is web-based, so it can be accessed from any suitable browser enabled device, Chrome preferred, with an internet connection.
System requirements: Access via secure internet browser login, Google Chrome preferred.

We support Google Chrome, Microsoft Edge and Safari.

Desktop/laptops required for UI access to CareLineLive eBrokerage Cloud software.

User support

Email or online ticketing support: Email or online ticketing
Support response times: Issues raised by email: CareLineLive use best endeavours to determine (during Working Hours, i.e. Mon-Fri 9am - 5:00pm excluding public holidays in England, unless stated otherwise below) whether an issue affects protected functionality and into which priority category an issue raised falls. Priority categories:
Critical (reported 24 x 7)
High
Medium/Normal
Low
Target acknowledgement (email): 30 minutes.
Issue target response and fix times:
Critical: 2 hours response, 4 hours fix (24 x 7 x 365 clock)
High: 4 hours response, 2 working days fix
Normal: 8 hours response, 7 working days fix
Low: 3 working days response, future release fix
User can manage status and priority of support tickets: No
Phone support: Yes
Phone support availability: 9 to 5 (UK time), Monday to Friday
Web chat support: No
Onsite support: Yes, at extra cost
Support levels: The Support Service is the first point of contact for all Customer enquiries and service-related issues, receives support requests via email to our support portal 24 x 7 x 365, or by phone during office hours. Support calls/emails/messages are logged, processed and followed up by our Support Service Staff for the prices quoted.

CareLineLive Support Service also provides general advice and guidance on Service use, incident knowledge, workarounds and next release information.

Client management:

During implementation, CareLineLive’s Project Manager is responsible with escalation to the designated CareLineLive Account Manager for the customer, and then CareLineLive's Operations Director or Managing Director if/when applicable.

Post implementation, CareLineLive's designated Account Manager and Contract Manager for the customer are responsible for BAU liaison and Contract and Performance reviews respectively, with escalation to CareLineLive's Operations Director or Managing Director if/when applicable.
Support available to third parties: Yes

Onboarding and offboarding

Getting started: We provide business process consultancy to aid customers define the most appropriate changes to their business process to obtain maximum benefit from our Cloud Software. Upon implementation CareLineLive eBrokerage Cloud software will then reflect their new business process requirements and workflow. We then provide contextual online training, and user documentation, plus support via a designated project management, and Support Service.
Service documentation: Yes
Documentation formats: PDF
End-of-contract data extraction: CareLineLive will assist with the migration of data at the end of the contract, in a .SQL backup file format for CareLineLive eBrokerage, with the following quite straightforward process which is our standard approach in this regard:

1. The customer provides written contract termination notice to: accounts@mas-group.co.uk
2. The customer will receive a written notification reply letting you know we have received the request. Our reply will include the end date.
3. The customer will be provided instruction on how to receive your data. The data comes in the form of a .SQL database backup file.
4. The customer provides an SFTP site and once in place we would send the backup file to that.
5. We delete the customer data in our hosting after the customer has confirmed satisfactory receipt, onboarding to the new system and sufficient UAT.

We typically include an allowance for Project Management and Technical Services in our pricing response to oversee the exit process at the end of the contract.
End-of-contract process: We normally include sufficient chargeable time in each contract for our designated project manager (exit) to prepare and agree the exit plan with the customer, then manage the exit (supplier side) and for our technical services team to offboard the customer's data, preparing the .SQL backup file, prior to deleting the customer's data in accordance with the following quite straightforward process which is our standard approach in this regard:

1. The customer provides written contract termination notice to: accounts@mas-group.co.uk
2. The customer will receive a written notification reply letting you know we have received the request. Our reply will include the end date.
3. The customer will be provided instruction on how to receive your data. The data comes in the form of a .SQL database backup file.
4. The customer provides an SFTP site and once in place we would send the backup file to that.
5. We delete the customer data in our hosting after the customer has confirmed satisfactory receipt, onboarding to the new system and sufficient UAT.

Using the service

Web browser interface: Yes
Supported browsers: Microsoft Edge

Chrome

Safari
Application to install: No
Designed for use on mobile devices: No
Service interface: Yes
User support accessibility: None or don’t know
Description of service interface: CareLineLive eBrokerage:
The service interface is browser based, giving instant access to the main functional areas of the CareLineLive eBrokerage Cloud software service via a vertical tool bar, multiple browser tabs can be kept open so areas once opened remain accessible via the browser window. Data entry and review is via fields that can be configured for data type, and will auto verify that the data is consistent at the point of saving if not before. Extensive use is made of colours, graphic charts and fly by / hover over tips.
Accessibility standards: None or don’t know
Description of accessibility: The CareLineLive eBrokerage system is cloud based, accessed via Safari and standard Chromium-based browsers, Chrome preferred, and is designed to support standard browser-compatible accessibility tools.
Accessibility testing: We have not, as yet, done any assistive technology testing with CareLineLive eBrokerage Cloud software.

If the Customer has specific accessibility requirements we would be pleased to review and advise on the support status. Bespoke accessibility requirements would need to be specified and done under a change request, which may be chargeable.
API: Yes
What users can and can't do using the API: Data from call monitoring systems can be interfaced to CareLineLive eBrokerage Cloud Software. Data transfers must use either our documented open API or the manual upload tools within CareLineLive eBrokerage. Once call monitoring data is interfaced in this way it can be used to provide management reports such as evidence of service delivery. Reports are discussed in more details below.
API documentation: Yes
API documentation formats: PDF

Other
API sandbox or test environment: Yes
Customisation available: Yes
Description of customisation: Multiple elements of the CareLineLive eBrokerage platform are configurable, including the following:
• Framework provider tier lists are configurable, providing a priority-based package distribution.
• Tier timing is configurable as well as pauses between tiers if applicable.
• Zone/region management allowing packages to be broadcast to only users configured for the zone/region.
• Working hours are configurable so that the tiered timing only runs during the working hours specified.
• Access matrix so user privileges can be adapted as required.
• Email notifications can be configured.
• Care Options such as Domiciliary, Supported Living and Care Home can be adapted with subcategories by the support team.
• SysAdmin can configure broker access level and zone administration

Scaling

Independence of resources: Our CareLineLive eBrokerage Cloud Software solution is based on a SQL database architecture and fully scalable e.g. so that there are no issues as the customer/or customers add new users. In addition for major customers we deploy dedicated virtual server and database resource.

Analytics

Service usage metrics: Yes
Metrics types: Generally we would include the provision of the following service metrics and a review online with the customer on a quarterly basis:
1. Service availability levels.
2. Number of Customer-reported incidents at each priority level and fix times.
3. Number of supplier self-notified incidents at each priority level and fix times.
4. Any issues/support/breaches of the SLA.
5. Downtime periods.
6. Service availability figures and other relevant information to be provided to the Customer 5 days in advance of each meeting.
Reporting types: Real-time dashboards

Regular reports

Reports on request

Resellers

Supplier type: Not a reseller

Staff security

Staff security clearance: Other security clearance
Government security clearance: None

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom
User control over data storage and processing locations: No
Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency: Less than once a year
Penetration testing approach: ‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
Protecting data at rest: Physical access control, complying with SSAE-16 / ISAE 3402

Physical access control, complying with another standard

Encryption of all physical media

Other
Other data at rest protection approach: CareLineLive utilise the cloud hosting services of Rackspace Ltd to host our CareLineLive eBrokerage Cloud Software system at their London 3 data centre. Rackspace hosting datacentre is located at:

RACKSPACE LIMITED
Unit 5 8 Millington Road, Hyde Park Hayes, Hayes, Middlesex, UB3 4AZ

Rackspace maintains the following certifications for our hosted infrastructure. Rackspace have been assessed and hold validation for the following compliance frameworks:
• ISO 27001
• SSAE 16 and ISAE 3402 (Previously SAS 70 Type II)
• PCI DSS
• Safe Harbor (export.gov)
• Cyber Essentials Plus
Data sanitisation process: Yes
Data sanitisation type: Explicit overwriting of storage before reallocation

Deleted data can’t be directly accessed
Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach: CareLineLive eBrokerage Cloud software includes the provision of 5 standard reports.

Plus the cost options of:
MyDBR licence (any of the data held in CareFor could be reported upon and/or extracted by the customer)
Custom reports
Data export formats: CSV

Other
Other data export formats: Excel

PDF
Data import formats: CSV

Data-in-transit protection

Data protection between buyer and supplier networks: Private network or public sector network

TLS (version 1.2 or above)

Other
Other protection between networks: Web services will conform to local authority encryption standards and use API keys where appropriate. We also utilise CSV file exchange where appropriate and secure file transfer.

We utilise federated authentication, MFA, Server certificates, Service accounts with complex 32 character passwords, 256-bit or higher encryption at rest within the service.
Data protection within supplier network: TLS (version 1.2 or above)

Other
Other protection within supplier network: We utilise federated authentication, MFA, Server certificates, Service accounts with complex 32 character passwords, 256-bit or higher encryption at rest within the service. In addition, CareLineLive utilise the cloud hosting services of Rackspace Ltd to host our CareLineLive eBrokerage Cloud Software system at their London 3 data centre.

Rackspace maintains the following certifications for our hosted infrastructure. Rackspace have been assessed and hold validation for the following compliance frameworks:
• ISO 27001
• SSAE 16 and ISAE 3402 (Previously SAS 70 Type II)
• PCI DSS
• Safe Harbor (export.gov)
• Cyber Essentials Plus

Availability and resilience

Guaranteed availability: We propose a Service Level Agreement, which includes the Target Service Availability of 99.85% for our hosted services in any given 12-calendar month period, 24 hours per day, 7 days a week, 365 days per annum, planned maintenance periods excepted.
Approach to resilience: CareLineLive eBrokerage Cloud software is hosted in resilient infrastructure with no single point of failure, so recovery from a localised system or hardware failure would typically take minutes/seconds as a result of the auto-failover architecture that is in place.

The CareLineLive Cloud software solution is a fully resilient hosted solution, with offline capable mobile apps that retain and cache rota and visit data even while offline.

Technical infrastructure and viability: CareLineLive utilise the cloud hosting services of Rackspace Ltd to host our CareLineLive eBrokerage Cloud Software system at their London 3 data centre. Rackspace perform full backups once per day and incremental backups hourly. Backups are held on resilient infrastructure at Rackspace, RACKSPACE LIMITED Unit 5 8 Millington Road, Hyde Park Hayes, Hayes, Middlesex, UB3 4AZ

In addition, as a professional datacentre hosted services supplier Rackspace employ the following environmental controls:
Dual power paths into facilities
Uninterruptable Power Supplies (minimum N+1)
Diesel Generators (minimum N+1)
Service agreements with fuel suppliers in place
HVAC (minimum N+1)
VESDA / Fire Suppression
Flood detection
Continuous facility monitoring

CareLineLive Group also operate our own Business Continuity Plan, to maintain support to customers in the event of a threat to normal operations.
Outage reporting: Via the CareFor Uptime robot (https://status.care-for-it.com/).

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Identity federation with existing provider (for example Google Apps)

Username or password

Other
Other user authentication: All user access is secure via username and password. Our standard password rules are that each password must have a minimum of 8 characters, 1 lower case, 1 capital letter, and 1 number. We have provided single sign-on via SAML integration with our identity service (the method by which we control all usernames/password), and we have implemented Azure AD (now Microsoft Entra ID) integration with a local authority, and this, or integration via Google, could be in scope. We also offer the ability for full 2FA whereby a 1-time code is emailed to the user when doing a password reset.
Access restrictions in management interfaces and support channels: Access to accounting and operations software is controlled by means of logins and passwords. These are given only to users who need to work with the respective packages, and their level of access is controlled by permissions allocated to the various login identities. Access to network objects is limited by individual logins that are authorised on the basis of operational requirements. User access rights are decided and/or approved by the Managing Director. Application user rights are decided by the Managing Director.
Department heads have the authentication controls to administer access to systems they are responsible for.
Access restriction testing frequency: At least once a year
Management access authentication: Username or password

Other
Description of management access authentication: Department heads have the authentication controls to administer access to systems they are responsible for. Also equipment is whitelisted on the company network.

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: At least 12 months
Access to supplier activity audit information: Users have access to real-time audit information
How long supplier audit data is stored for: At least 12 months
How long system logs are stored for: At least 12 months

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: QMS International
ISO/IEC 27001 accreditation date: 3rd January 2024 (C4 Ulysses Ltd was incorporated into MAS Group ISO 27001 & 9001 certifications).
What the ISO/IEC 27001 doesn’t cover: All recommendations identified during our most recent ISO 27001 2013 audit have been implemented. We also perform quality monitoring via our ISO 9001 certification.
ISO 28000:2007 certification: No
CSA STAR certification: No
PCI certification: No
Cyber essentials: Yes
Cyber essentials plus: Yes
Other security certifications: Yes
Any other security certifications: SSAE 16 and ISAE 3402 (Previously SAS 70 Type II)

Safe Harbor (export.gov)

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001

Other
Other security governance standards: CareLineLive utilise the cloud hosting services of Rackspace Ltd to host our CareLineLive eBrokerage Cloud Software system at their London 3 data centre. Rackspace have been assessed and hold validation for the following compliance frameworks:
ISO 27001
SSAE 16 and ISAE 3402
PCI DSS
Safe Harbor (export.gov)
Cyber Essentials Plus
Information security policies and processes: CareLineLive Group (/MAS Technicae Group (International) Ltd ) operates an IMS that has gained ISO 9001:2015 and ISO 27001:2013 certifications, including aspects specific to its Scope of Certification. CareLineLive Group aims to provide defect-free products and services to its customers on time and within budget, and is committed to operating its business responsibly in fulfilment of its compliance obligations. It is the Organisation’s declared policy to operate with and to maintain good relations with relevant regulatory bodies. CareLineLive Group has prepared and published an Information Security Policy and a suite of information security aspect-specific IS policies, held as part of the IMS, that should be used in conjunction with this overall IMS Policy. Top management is committed to:
• Develop and improve the IMS
• Continually improve the effectiveness and performance of the Integrated Management System
• The enhancement of customer satisfaction.
All personnel understand the requirements of this IMS Policy and comply with the contents of the IMS. The Organisation constantly monitors its performance and implements improvements when appropriate.
The CareLineLive Group follow, maintain and uphold ISO 27001, and ISO 9001 information security policies and processes and are registered with the UK ICO.

Operational security

Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach: Managing changes covers requirement gathering, specification, coding, testing and release management with respect to the live CareLineLive environment.
We adhere to a strict change control process, documented in the CareLineLive Group ISO Secure Systems & Development Aspects Policy. Any change requests will be carefully considered, documented in a requirements specification documentation that has to be agreed and signed off by all stakeholders prior to resources being assigned.
Major changes: applied during planned maintenance window in consultation and with agreement of the customer typically during low traffic periods. Minor changes: applied during normal hours of business at CareLineLive discretion.
Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach: Appropriate patching controls ensure technical vulnerabilities are managed effectively: adherence to the Malware and Vulnerability Aspects Policy and Directive.
Controls (Anti-Virus software, hardware/software firewalls, Internet web traffic): scanned for malware, potential phishing threats are used to detect threats. Threats risk assessed, appropriate action determined by the ISMS committee, recorded in the risk register, risks mitigated depending on severity/impact.
Issues deemed critical: target resolution within two business days or as soon as possible.
Anti-Virus software, hardware/software firewalls, Internet web traffic scanned for malware, and potential phishing threats: Logs are checked regularly, any significant reports escalated to the ISMS Committee and investigated.
Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach: CareLineLive Group perform protective monitoring in accordance with our ISO policies and procedures, (clause A.12.4 refers) overview:
A12.4.1 Event logging: Event logs that record user activities, exceptions and information security events to be generated and retained for an agreed period to assist in monitoring access control and as evidence in potential information security investigations.
A.12.4.2 Protection of log information: Event logs and the systems and services used to generate them to be protected against unauthorised access or modification.
A.12.4.3 Administrator and operator logs: System administrator and operator activities to be recorded, with the logs protected and subject to review.
Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach: Incident reporting uses our ISO9001 logging process which identifies the problem, possible source, etc. A threat assessment is done to determine what impact is likely and then escalated as required. All incidents are then reported on the ISO27001 logs which will be shared with the Customer. We report routinely once a month but if there is a serious incident such as a GDPR breach then this is reported and acted upon without delay in order to minimise or mitigate any damage. Where needed we will also report to the ICO and other bodies as required.

Secure development

Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks: No

Social Value

Tackling economic inequality
Equal opportunity
Wellbeing

Tackling economic inequality

CareLineLive Group Social Value Policy:

At CareLineLive Group we create infrastructure, support local communities and enable growth to deliver community benefits and additional social value. We assist our customers to maximise social, economic and environmental wellbeing of local communities in accordance with The Public Services (Social Value) Act 2021, The Procurement Reform (Scotland) Act 2014 and the Wellbeing of Future Generations (Wales) Act 2015.

This policy is supported by our sustainability strategy, 'Our Sustainability Policy', and delivered through our community investment targets on an annual basis.

Through collaboration with our customers and suppliers we are committed to:

Employment & Skills
Enabling local people to obtain skills needed to access employment – working with local technical colleges to offer apprenticeship.
Providing our employees with new skills for the future, access to ongoing training
Creating employment opportunities within the community
Removing barriers to employment within the IT industry
Offering employment to those who have served in the armed forces
Local Business & Economy
Procuring goods and services locally wherever possible
Supporting small and micro businesses, social enterprises and minority owned businesses to improve capability and grow sustainably

Community Engagement
Carrying out activities that deliver benefits to local communities
Supporting local community-based charities that support employment opportunities and environmental regeneration to meet local needs.
Working with education and training providers to offer educational support and work experience opportunities
Supporting our team to live healthier lives
Environment:
Using resources efficiently to reduce waste and maximise value – wherever possible being a paperless company
Reducing our impact on the environment but recycling and being mindful of resources used within our work environment
Promoting sustainable and ethical procurement

Governance, Measurement & Reporting
We maintain clear records on how we deliver this policy

We communicate this policy to all our employees, supply chain and review it annually.

Equal opportunity

CareLineLive Group Social Value Policy:

At CareLineLive Group we create infrastructure, support local communities and enable growth to deliver community benefits and additional social value. We assist our customers to maximise social, economic and environmental wellbeing of local communities in accordance with The Public Services (Social Value) Act 2021, The Procurement Reform (Scotland) Act 2014 and the Wellbeing of Future Generations (Wales) Act 2015.

This policy is supported by our sustainability strategy, 'Our Sustainability Policy', and delivered through our community investment targets on an annual basis.

Through collaboration with our customers and suppliers we are committed to:

Employment & Skills
Enabling local people to obtain skills needed to access employment – working with local technical colleges to offer apprenticeship.
Providing our employees with new skills for the future, access to ongoing training
Creating employment opportunities within the community
Removing barriers to employment within the IT industry
Offering employment to those who have served in the armed forces
Local Business & Economy
Procuring goods and services locally wherever possible
Supporting small and micro businesses, social enterprises and minority owned businesses to improve capability and grow sustainably

Community Engagement
Carrying out activities that deliver benefits to local communities
Supporting local community-based charities that support employment opportunities and environmental regeneration to meet local needs.
Working with education and training providers to offer educational support and work experience opportunities
Supporting our team to live healthier lives
Environment:
Using resources efficiently to reduce waste and maximise value – wherever possible being a paperless company
Reducing our impact on the environment but recycling and being mindful of resources used within our work environment
Promoting sustainable and ethical procurement

Governance, Measurement & Reporting
We maintain clear records on how we deliver this policy

We communicate this policy to all our employees, supply chain and review it annually.

Wellbeing

CareLineLive Group Social Value Policy:

At CareLineLive Group we create infrastructure, support local communities and enable growth to deliver community benefits and additional social value. We assist our customers to maximise social, economic and environmental wellbeing of local communities in accordance with The Public Services (Social Value) Act 2021, The Procurement Reform (Scotland) Act 2014 and the Wellbeing of Future Generations (Wales) Act 2015.

This policy is supported by our sustainability strategy, 'Our Sustainability Policy', and delivered through our community investment targets on an annual basis.

Through collaboration with our customers and suppliers we are committed to:

Employment & Skills
Enabling local people to obtain skills needed to access employment – working with local technical colleges to offer apprenticeship.
Providing our employees with new skills for the future, access to ongoing training
Creating employment opportunities within the community
Removing barriers to employment within the IT industry
Offering employment to those who have served in the armed forces
Local Business & Economy
Procuring goods and services locally wherever possible
Supporting small and micro businesses, social enterprises and minority owned businesses to improve capability and grow sustainably

Community Engagement
Carrying out activities that deliver benefits to local communities
Supporting local community-based charities that support employment opportunities and environmental regeneration to meet local needs.
Working with education and training providers to offer educational support and work experience opportunities
Supporting our team to live healthier lives
Environment:
Using resources efficiently to reduce waste and maximise value – wherever possible being a paperless company
Reducing our impact on the environment but recycling and being mindful of resources used within our work environment
Promoting sustainable and ethical procurement

Governance, Measurement & Reporting
We maintain clear records on how we deliver this policy

We communicate this policy to all our employees, supply chain and review it annually.

Pricing

Price: £9,100 a licence a year
Discount for educational organisations: No
Free trial available: Yes
Description of free trial: Free trials are available, including access to a full version of CareLineLive eBrokerage Cloud software. Not included: professional services, customisations, integrations with third party systems, and bespoke development. Time limited: by prior agreement. Part chargeable pilot schemes also available (automatically ongoing if proven).
Link to free trial: On request

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

CareLineLive eBrokerage

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents