CycleStreets Ltd

CycleStreets: Cycle journey planner and cycle map - white label website

Embedded cycle journey planner and cycle map website, providing a web interface showing optimal bicycle route from A-B, offering a choice of route types (quietest route, fastest route, balanced route; circular leisure route also available).

Features

• Bicycle journey planning (routing) and cycle map website
• Embedded and fully-integrated within your website
• Cycle-friendly routes from A-B
• Different routing types available (quietest, fastest, balanced, leisure)
• Intermediate waypoints (A-B-C...)
• Circular leisure routes also available (at additional cost)
• Elevation-aware routing
• Routing that 'thinks like a cyclist'
• Regularly-updated data
• Takes account of very many street attribute types

Benefits

• Enables people to plan safer cycle routes
• Enables people to plan faster cycle routes
• Encourages active transport
• Assists promotion of healthy cities and healthy transport
• Cycle map designed for people cycling rather than driving
• Provides clear mapping of cycle infrastructure
• Data improvements benefit other apps which citizens already use

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@cyclestreets.net. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

325057145329285

Contact

Mr. M. Lucas-Smith
01223 701901
info@cyclestreets.net

About the service

• Service categories:
  • Applications
    • Content workflow and management
      • Persuasive content management
        • Website Software
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: None.
• System requirements: Deployment via simple HTML embed

User support

• Email or online ticketing support: Yes
• Support response times: Within 48 hours, or sooner.; ; Weekend responses are not guaranteed, but we often work weekends and pick up enquiries.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Support is provided by e-mail during the daytime, with questions answered by direct employees who run the service. We are happy to be called by phone also.; ; Support is provided by the two developers/directors of the company, rather than a separate technical account manager.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Read documentation at:; https://www.cyclestreets.net/help/embedding/; ; Provides a simple webpage where the client decides on the options, and a block of HTML is provided for embedding.; ; The user is required to obtain a license key from:; https://www.cyclestreets.net/api/apply/; ; We are happy to answer queries about the white label service. These are regularly folded into the documentation to provide additional clarity.
• Service documentation: Yes
• Documentation formats: HTML
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: There is no data to extract.
• End-of-contract process: No special activity takes place - the website service will keep running but customers are expected to remove their integration if they do not wish to renew for a further period, and we reserve the right to withdraw service.; ; Customers may renew for a further period if wished.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Layout adaptions and UI optimisations for mobile.
• Service interface: Yes
• Description of service interface: A basic control panel simply giving usage rates is available, but configuration is otherwise not necessary.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: There is full support for keyboard-based navigation. The interface is compatible with speech browsers, e.g. JAWS. The service uses standard HTML5 page generation. Proper semantic structures are used. Aria attributes are present.
• User support accessibility: WCAG 2.2 AA
• API: No
• Customisation available: Yes
• Description of customisation: Clients can specify map starting point, background map style(s), quick links to particular geographical locations, colour scheme and basic UI options, ; ; We are able to undertake consultancy work to add new types of routing beyond the standard types available.

Scaling

• Independence of resources: The underlying API service is spread over multiple hosts. Where usage is non-trivial, customers are put on a specific load-balanced endpoint, isolating them from other customers.

Analytics

• Service usage metrics: Yes
• Metrics types: Number of routes planned, over various time periods. These are accessed as real-time charts via the API key control panel.
• Reporting types: Real-time dashboards
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Staff screening not performed
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: In-house
• Protecting data at rest: Other
• Other data at rest protection approach: There is no personal data processed in relation to the website provision.
• Data sanitisation process: No
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: There is no data to export.
• Data export formats: Other
• Data import formats: Other

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: SSH.

Availability and resilience

• Guaranteed availability: Standard SLA contract has 99.5% uptime.; ; In practice we have consistently achieved above 99.9%.; ; In the event of not meeting the uptime requirement, customers have the option to be refunded for time lost, at a twice pro-rata rate.
• Approach to resilience: Users sign up to an SLA which ensures we are contractually obliged to meet service standards.; ; Redundancy is present, so in the event of a serious outage, we are able to switch to another endpoint in a different data centre.; ; Multiple data centres are used geographically.; ; Uptime monitoring by an external service, and internal API format monitoring, are both in place.
• Outage reporting: There is no public dashboard.; ; Internal SMS alerting is in place.

Identity and authentication

• User authentication needed: No
• Access restrictions in management interfaces and support channels: Username and password.
• Access restriction testing frequency: At least every 6 months
• Management access authentication: Username or password

Audit information for users

• Access to user activity audit information: No audit information available
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: No
• Security governance approach: Security is run by a Director (a direct employee) who is also an engineer involved in running the service. No aspect of security governance is outsourced, except for hosting provider patching where we procure this additional service.
• Information security policies and processes: Machines are patched regularly by the hosting provider.; ; Those involved in installation and deployment of services are in-house staff and are trained in security patching and resilient coding practices.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Both code and configuration are each (separately) committed to Git repositories.; ; Deployment is done on a continual rather than big-bang basis.; ; Branch-based development is used.; ; Code is reviewed regularly by other employees.; ; Code uses libraries developed over many years which have withstood the test of time.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Patch availability for machine-level software is notified regularly by the hosting company. Patches of a high urgency nature are usually applied by the host very shortly after, although this sometimes expedited by our in-house employees.; ; Software-level bill of materials monitoring is in use by the version control hosting provider.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Application-level error logging is enabled.; ; Server performance logging for multiple attributes is checked regularly.; ; SMS alerting is set to detect slow responses, which tend to be an indication of potential problems.; ; Systems-wide charting is in use.; ; Potential compromises are assessed for severity. In the case of the underlying routing API, the threat potential is low as no personal data is involved.; ; Incidents are dealt with as top priority, displacing other work.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: Users can report incidents via e-mail or our feedback system.; ; In the event of a significant downtime incident, the initial response is to reconfigure the endpoints to avoid loss of service. Users would be notified by e-mail beyond this.; ; No personal data is being processed by the underlying API from which the site retrieves routing results. The site itself has no user login or database storage.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: You do not have a current and valid Cyber Essentials certificate, or will not have in place within 12 months of the date of award but have an IASME certified equivalent.
• Cyber essentials plus: No
• Cyber Essentials Alternative: You do not have a current and valid Cyber Essentials Plus certificate, or will not have in place within 12 months of the date of award but have an IASME certified equivalent.
• Other security certifications: No

Social value

• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
  • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@cyclestreets.net. Tell them what format you need. It will help if you say what assistive technology you use.