EXCELPOINT LIMITED

Excelpoint ERP

Excelpoint’s no-code Enterprise Application software configures scalable solutions which automate business processes, eliminating paper and spreadsheets, and integrating legacy systems. Access via web-browser on desktop, tablet, or smartphone, and through apps for Android Mobile. Automatically generate emails, texts, cross-database updates, output documents, and trigger digital business activities.

Features

• Flexible and scalable AI ready enterprise applications
• Access securely from desktop, laptop, tablet and mobile
• Digitalise processes end-to-end to deliver enhanced customer experience
• Easy integration with legacy systems exploiting existing investments
• Interconnect SMS, email, push, mapping, barcode, signature, photograph, visualisation, automatically
• Leverage preconfigured CRM, ERP, GRC and many other solutions
• Extensive logic driven user defined survey and analysis capabilities
• Configure and tailor business applications entirely in-house
• Comprehensive support for, business logic, application configuration, and operations
• Plug-in integration with platforms including: Companies House, Gazetteers, News Feeds

Benefits

• Move application development to business not technical specialists
• Increase agility of business to adapt to external pressures
• Significantly increasing the pace at which business applications evolve
• Future proof applications against emerging technology waves
• Reduce the cost of customisation, aligning application to business process
• Reduce the risk of functional and technical underdelivery
• Leverage legacy systems and information in integrated and automated processes
• Replace paper and spreadsheets with secure digital solutions
• Enable secure office, home and field-based working regardless of device
• Re-align, re-purpose and extend to deliver multi-purpose solutions

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@excelpoint.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

308154669293230

Contact

Parry Jenkins
+44 (0) 7973 426252
sales@excelpoint.co.uk

About your service

• Service categories:

  Applications

  Enterprise resource management

  • Project and portfolio management
  • Asset life-cycle management

  Human capital management

  • Talent Management Applications
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: Excelpoint is entirely browser based and works on all current browsers, and hence can be accessed via your existing infrastructure and network topography. It supports Windows, macOS and Linux Workstations but also iOS, Windows Mobile and Android Smartphones and tablets due to the cross-browser support and fully responsive design. The solution is available 24/7, except for agreed timeouts for planned maintenance. This can be scheduled out of normal office hours to suit you, unless in response to critical (or above) incidents, though again the remediation would be scheduled in agreement with you.
• System requirements:
  • Works with Windows, MacOS, Linux via browser
  • Works with Microsoft Edge Firefox Chrome Safari Opera
  • Mobile access via iOS, Windows Mobile and Android Devices
  • Standalone App available for Android Devices

User support

• Email or online ticketing support: Yes
• Support response times: We aim to respond within one hour between the hours of 08:00 and 18:00 Monday to Friday. Outside standard hours we can work to contract and service level specific arrangements to suit the customer, on an on-call basis.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Our standard service support SLA's are summarised below which are factored into our licence fee. We categorise 5 levels of incidents based upon severity of impact, and respond accordingly, all during normal business hours: Showstopper: Acknowledge in 1 hour, workaround in 4 working hours, resolution in 20 working hours. Critical: Acknowledge in 1 hour, workaround in 7 working hours, resolution in 33 working hours. High: Acknowledge in 1 hour, workaround in 15 working hours, resolution in 41 working hours. Medium: Acknowledge in 2 hour, workaround in 82 working hours, resolution in 148 working hours. Low: Acknowledge in 3 hour, workaround in 115 working hours, resolution in 195 working hours. We would provide a technical account manager available during normal business hours. We would also be happy to discuss revised SLA's should the above not meet your requirements, and to provide quotes for bespoke terms
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: To help with start up we offer two free days on site consulting support. This ensures you have access to all necessary documentation including our concise users guide, and comprehensive administrators manual, plus access to quick start application hubs and clear lines of communication to further support if needed. We can also help you plan your next steps, based upon the complexity and nature of what you wish automate with Excelpoint. You will need to decide do you wish to assemble and configure the solution in-house, or would you like some extra support from us. If in-house then we have comprehensive training for those who will complete the work. If you wish us to complete the work then we can provide a clear estimate of the effort required, and what we would need from you. You will be surprised how quickly it can be done. Finally, we can advise on data conversion, and how best to get your new solution fully up and running.
• Service documentation: Yes
• Documentation formats:
  • ODF
  • PDF
• End-of-contract data extraction: Data extraction is very simple and very flexible. Our solution is driven entirely based on information type, and with just a few simple clicks each information type (or group of information types) can be extracted and loaded to any of the following - a text file, tab limited, Excel format, we can also support direct access SQL to any information type. Typically, the most time consuming aspect of the data extract is likely to be discussing target formatting.
• End-of-contract process: We include two days free consulting support at the end of the contract to advise on the most efficient data extract processing. This allows you to complete a full data extract. We also confirm and guarantee full erasure of data. This is achieved via processing within the MS Azure Cloud and completed my the MS Azure Team. With Azure SQL Database, deleted data is marked for deletion. If an entire database is deleted, it is the equivalent of deleting the database’s entire contents. The SQL Database implementation is designed to ensure user data is never leaked by disallowing all access to the underlying storage except via the SQL Database API. That API allows users to read, write, and delete data, but does not have a way to express the reading of data that the user has not previously written
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: We have two documents both available in PDF and Word Format. A basic end user guide which covers the basic operation of the solution - how to log on/off, what the various icons mean, basic data entry, search, reporting. Plus a comprehensive full feature guide for users, administrators and "in-house" developers, which covers all operations of the system, and how to assemble, configure, amend and maintain all configurable features off the solution.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Functionality is identical, and screen layout is fully responsive with the layout optimised automatically to suit each environment. There a 5 responsive screen sizes: Smart Phone We Browser Layout Tablet Portrait Layout Tablet Landscape Layout Medium Laptop Layout Large Desk Top Layout. Offline mobile access is also configurable via a standard mobile App downloaded and installed from the appropriate App Store for Android, and functionality can be optimised to work both in real time online, and in intermittently through the App.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: The service interface is accessed via web browser and user input can be configured using any combination of simple text boxes, date pickers, check boxes, radio buttons, selection from simple and searchable lists. The page is accessible via screen reader and voice to text applications. We can support screen description and data capture in a number of foreign languages storing both verbatim foreign response and Google translated data. Field tips are configurable to guide user input.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: A large public sector customer has assessed our system interface and based upon their report we implemented the necessary measures to achieve the WCAG 2.1 AA rating. They then repeated the tests and confirmed the changes had been implemented and the standard had been achieved.
• API: Yes
• What users can and can't do using the API: Via the Excelpoint REST API users can retrieve, add and update individual records, upload attachments to records, trigger workflows and processes, and perform searches to retrieve multiple records.
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Excelpoint is “Information Driven” and the definition of an Information Type or “Template” drives all other functionality of the system without further intervention. As a direct result anything and everything can be customised - what information is captured, the layout of the data capture screens, the validation applied, the processing logic deployed, the format of any and all outputs. It is also possible to customise "field tips" which guide data entry. Customisation is achieved with no bespoke coding using the highly flexible, configurable, and easy to use no-code platform features. This can be done by anyone with suitable access and permissions, and a clear understanding of the business requirement, business process and the information that drives the business. No technical knowledge is required. User definitions include Super User, Administrator, and Standard User, and for Standard Users the access permissions can be set to further limit the user capabilities. These access permissions include the Groups of information they have access to and whether they have Search, View, Edit, Add, Generate or Delete rights. In addition, we can provide both training to in-house administrators, and direct support to help expedite any customisation required

Scaling

• Independence of resources: The MS Azure Cloud has capacity. We select the correct virtual machine capacity for each individual contract sized appropriately. Unless otherwise agreed we select dedicated servers. We can if requested look at shared server solutions - for non mission critical applications - which would drive down the hosting costs. In this instance the systems themselves would be securely siloed with zero overlap, but sharing server capacity

Analytics

• Service usage metrics: Yes
• Metrics types: Available to report on are: Logon/Logoff events including date time and userid Item counts per information type Full audit trail of system events - data viewed, added, amended, deleted for any information type - this can be set at installation level and configured through a matrix of options Also available are hours of usage - in total, per user, by role.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: The system is high configurable and data can be exported in almost any format required. Any information type (or groups thereof) can be output in any of the following formats: simple text file; highly complex excel files linked to external dashboards, charts and reports; mail merged to word documents; outputs via interface to external reporting tools such as power BI; reminder emails or SMS from tabulated information
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • Tab delimited ASCII data
  • Excel spreadsheet templates
  • Via SQL views of information types
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • Direct from Excel Files
  • Tab delimited ASCII data
  • Direct from any information repository meeting open system connectivity standards
  • Direct from any SQL compliant database
  • Direct from any MSAccess database
  • From an external 3rd party API
  • From a JSON document

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Our G-Cloud Solution is hosted in the MS Azure Cloud, which typically quotes uptime statistics for almost all aspects of the Azure eco-system at a guaranteed level of more than 99.9%. Downtime is usually caused by the infrastructure rather than the application platform or specific applications delivered. In almost twenty years, we have not suffered any significant downtime caused by our platform or systems delivered within it. As with any development platform, it is, of course, possible to create a system that could cause significant server load and poor performance or crashes, but this is more an issue of testing, change management, and release strategy. Backups are taken Daily. All backups, are stored within the server environment but not on the same server as the main system and are automatically removed according to the above timetable. Where appropriate, the Azure platform can be configured to automatically replicate one virtual server to another to provide an almost instantaneous failsafe in case of a complete system failure. Service credits can be agreed on a per call off contract basis.
• Approach to resilience: Our selection of the Microsoft Azure platform for hosting means that physical data is stored in UK datacentres, and the failsafe failover server would be in another UK datacentre, both locations covered by all current Data Protection legislation including GDPR.. • There will no physical access to the Datacentre for both Excelpoint and DCC staff, however, Excelpoint can grant nominated DCC staff with server level access. • All Microsoft Data Centre’s maintain state-of-the art physical security, including 24x7x365 surveillance, environmental protections and extensive secure access policies, not detailed here for security reasons. • Excelpoint roles that will have technical access to DCC data will include: o Systems Architects; o Business Consultants; o Support technicians; although only Systems Architects will have server and database level access to the data • Robust recruitment procedures and references assure Excelpoint of staff quality coupled with company policies and technology enablers ensuring access to systems can be granted and removed as needed and approved. • Excelpoint use a Password Vault to allow only approved access to information or infrastructure for any member of our team in a controlled and monitored manner. This access can be removed effectively for people leaving or changing roles.
• Outage reporting: Excelpoint is hosted on the G Cloud Approved Microsoft Azure Cloud Platform and as such provides real-time outage reporting through the Azure Monitor service. All Virtual Machines are monitored for performance and uptime along with the Excelpoint applications running within. In the event that issues are detected email, SMS and voice alerts can be triggered to the Excelpoint support team who in turn pro-actively engage with customers on potential downtime.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to any customer system details is role based and the details are stored within a centralised password vault. Only those requiring access are granted access. The vault that stores all customer credentials is only accessible by those with appropriate permissions. Remote server access is protected under firewall and only accessible from a specific IP address.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: In line with our ISO27001/ISO9001, Cyber Essentials and IASME accreditations we maintain comprehensive Information Security Policies and Processes, identified in our Company Handbook, sign-posted to new joiners during induction, backed by disciplinary processes and procedures, and monitored. The policies cover: Regulations for use of company facilities; Bring Your Own Device; Password rules and management; Email, Internet and Social Media policy; Monitoring. The Company hold employees personally liable for loss or reputational damage resulting from breach of policy, and breach of policies may result in disciplinary action including dismissal for Gross Misconduct. In addition we also have specific Data Protection Policies, which confirm adherence to six ‘Data Protection Principles’ ensuring data must: be processed fairly, lawfully and transparently; be collected and processed only for specified, explicit and legitimate purposes; be adequate, relevant and limited to what is necessary for the purposes for which it is processed; be accurate and kept up to date. Any inaccurate data must be deleted or rectified without delay; not be kept for longer than is necessary for the purposes for which it is processed; and, be processed securely. The Data Protection Policy also covers action in the event of a Data Breach, or Subject Access Request.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Excelpoint is accredited with ISO 27001 and ISO 9001 and as such has management systems in place to direct the process by which configuration changes are planned, implemented, tested and rolled out. Changes made to system configuration are tracked through Excelpoints internal change management system which, in conjunction with the internal support system provides a traceable record of changes requested, implemented, tested and rolled out. Changes are always reviewed by a product specialist to ensure that the suggested change does not present security issues in the context of the customer's business requirement.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Changes made to the platform itself are tracked through code version control and tested with both automated testing and functional testing allowing for a review of potential security holes. The platform is vulnerability tested annually, or after any major work undertaken on security-critical areas of the product, and any highlighted vulnerabilities are triaged and addressed within defined timeframes where critical security flaws are addressed immediately and low risk changes are incorporated in the next software release cycle.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Monitoring is primarily done directly by Azure Monitor. It delivers a comprehensive solution for collecting, analyzing, and acting on telemetry from your cloud environments. In addition this allows us to interactively analyze monitoring data and proactively respond to critical conditions identified in the data that it collects. This includes sending a text or mail to an administrator responsible for investigating an issue, or launch of an automated process that attempts to correct an error condition. Speed of response aligns with our standard response SLA's for which the top speed is response within 1 hour, fix within 24.
• Incident management type: Supplier-defined controls
• Incident management approach: Incidents are raised through either our manned telephone support line ( 09:00 – 17:30) or via email to our support desk. In either case, a Support ticket is raised, and a unique reference is assigned. The incident will be triaged appropriately and issued to a suitable member of the technical consultancy team. Progress and resolutions are then updated and tracked against the logged ticket in line with our SLA provided as a download on this portal. Customers are kept up to date with progress and resolutions until satisfied and then the incident is closed.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Excelpoint provides solutions configured in our no-code platform, and hence there is no fully functioning solution to “trial”. That said, we typically construct a skeleton demo tailored to customer requirements which we can offer for “free trial” for four weeks. Customers can also “try configuring their own” for four weeks.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 5%
• Between £250,000 and £500,000: 7.5%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 12.5%
• Between £2,500,001 and £5,000,000: 15%
• Over £5,000,001: 20.0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Atlas Certification Limited
• ISO/IEC 27001 accreditation date: Monday 30 June 2025
• What the ISO/IEC 27001 doesn’t cover: Tbc
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Atlas Certification Limited
• ISO 9001 accreditation date: Monday 30 June 2025
• What the ISO 9001 doesn’t cover: Tbc
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: C53f02c1-51c2-453a-a2c8-407b1a9589ed
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Ensuring new workers are informed of their right to join a trade union
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering
    • Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
    • Methods for engaging with different parts of the community (including the education system and charities representing the community) and how communities come together to inform decisions, strategy and projects to leave a positive legacy for future generations

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@excelpoint.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.