Hanlon Software Solutions

Hanlon Employability CRM and Portal

Modular CRM to track client interventions addressing barriers to progression and helping jobseekers into employment, education and training. Employer engagement and vacancy management; Management of business support, grants and loans. Community benefit, social value and Section106 monitoring; Manage student work experience programmes; Programme funding management; Programme performance reporting and analysis.

Features

• Web enabled, multi-provider employability tracking system
• Customer registration and e-signature. GDPR compliant
• Customer assessment, profiling and progression analysis
• Customer referral, intervention tracking and outcomes analysis
• Virtual labour market. Employer engagement, vacancy management and skills matching
• Business enquiries tracking and impact analysis
• Real-time, flexible reporting using embedded pivot grids. Statutory reporting
• Public facing web portal, Employability and business development content management
• Community benefit and Section 106 tracking and reporting
• On-line student work experience management

Benefits

• Connects customers, businesses, service providers to everyone's mutual benefit
• Co-ordinate customer services across multiple providers saving time and money
• Single customer registration reduces frustration and potential errors
• Holistic customer record enables providers to work more collaboratively
• Achieves positive customer outcomes more quickly through safe data sharing
• Bulk email, messaging, mail-merge and SMS for easy contact management
• Single, shared business record reduces un-necessary repeated contact
• Centralised, real-time reporting. Quick, easy and comprehensive
• Flexible, simple reporting meets statutory requirements saving time and effort
• Highly configurable data framework fits any programme, value for money

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at kevin.hanlon@hanlons.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

334163414395417

Contact

Kevin Hanlon
0115 9590077
kevin.hanlon@hanlons.co.uk

About the service

• Service categories:
  • Applications
    • Customer relationship management
      • Customer service
        • Customer service
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: No
• System requirements:
  • Broadband, 5G or 4G connectivity
  • System administrators require Remote Desktop Connection

User support

• Email or online ticketing support: Yes, at extra cost
• Support response times: Response within 1 hour during office hours. Response at weekends is next working day unless special arrangements are agreed.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes
• Support levels: All customers can access the following support functions:; ; activation of user licences;; access to a helpdesk via email and phone for advice and problem resolution;; remote, on-line support and user training;; help with data management, including bulk data updates and development of ad-hoc reports as and when required;; regular site visits to check on system usage, share best practice, discuss issues and deliver refresher training if necessary;; development and release of new software builds containing bug fixes, enhancements and modifications to meet the requirements of new and existing programmes.; ; We aim to release at least four new software builds per year. Interim builds may also be released as and when required.; ; We do not set a limit on the number of helpdesk calls or emails per customer.; ; All of the above is included in the annual hosting, support and maintenance charge which is based on 17.5% of the system and software module charges or £2,750, whichever is the lower.; ; Service Level Agreements are available covering our response framework and fault resolution.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We provide any or all of the following, depending on which are most appropriate to meet the requirements of the customer:; ; online, context sensitive help on the web forms within the application;; digital user manuals, including a quick guide;; onsite train the trainer;; onsite user training based on user roles - there is a training session for each module in the application - each session lasts a maximum of 4 hours and users can select, or be advised, which sessions are most appropriate for them based on their user role;; remote, online training.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: At the outset we agree an exit plan with our customers that includes options for data extraction. These include:; ; supply of a copy of all data in csv format. The data is structured with master records, for instance client core data, with separate spreadsheets for sub records such as activities and outcomes, linked on the unique master ID, such as Client ID;; ; continuation of storage of the database on our servers for analysis and reporting purposes only, subject to compliance with GDPR.; ; Users can select whichever option suits their purposes best. Their decision is generally based upon the length of time beyond the contract end date that they have to report to funders. For many programmes, this could be up to 7 years. We have incorporated data redaction facilities in to the application to enable extended reporting periods in order to remain compliant with GDPR.
• End-of-contract process: Customers generally purchase the Hanlon service to meet the requirements of a specific funded programme that has an end date. The end date of the contract for the Hanlon service is generally set to coincide with the end date of the programme. At this point the customer may decide that they have no further need of the service and request their data to be returned. When data is returned to the customer, Hanlon will provide a destruction certificate as proof of deletion of the customer's data from our servers. This occurs once the customer confirms they have received all of the their data. However, many customers decide that the service meets the requirements of other programmes that they are running and therefore seek a contract extension with Hanlon so that they can continue to use the service. Many organisations have used the Hanlon service for over 15 years which has proved to be very cost effective for them.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Features and functions available on the mobile service are the same as those on the desktop. Web pages within the Hanlon application are developed using Bootstrap 5 and are designed to be responsive. The layout of each page adjusts to fit the size of the user's screen, so the same page renders correctly on both PC / laptop monitors and mobile devices, such as tablets and mobile phones.
• Service interface: Yes
• Description of service interface: The service interface is configurable depending on the user's role. Users access various elements of the solution via a side panel, menus and breadcrumb navigation control. Useful tools are permanently available on a ribbon at the top of each web page. Tabs are used to navigate to sub elements within each page.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: We use Powermapper, SiteImprove and NVDA to test our web pages against level AA of the WCAG 2.2 accessibility standard.
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: Users can read data from the system (API v1). Users have read access only and cannot make any changes via the API. However, we offer the creation of a custom API for each client with custom endpoints. These endpoints can be used to read, update and insert data. Authentication is handled by Hanlon's using generated tokens which can be redacted as required.; ; The API can be used to export client, enterprise and vacancy data to external systems. In development is a facility to manage the importation of data from external systems.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Customisation of the application is achieved by configuring settings and content within the system. Options include:; ; amend the data framework to capture the data users require on activities, interventions, outcomes, demographics, barriers to progression, support needs, aspirations and skills - to name just a few;; ; design the content and layout of client registration forms and assessments;; ; design employer and opportunity registration forms;; ; customise business profile options such as sector, size, accreditations and locations;; ; create personalised user dashboards;; ; design the content and layout of user reports.; ; Administrative tools are available within the web and windows sections of the application. The tools enable users to customise the application as described above.; ; Users are assigned to system roles. Roles can be created with prescribed functionality. System administration is one of the elements of functionality that can be assigned to specified users.

Scaling

• Independence of resources: We have built redundancy into our network to ensure applications are not adversely affected by high usage.; Network monitoring software alerts our support team to high CPU / memory usage.; Also, processor intensive functionality, such as real-time embedded pivot grid reports, are firstly queued and then allocated a maximum percentage of server memory rather than being allowed to overload the server.; Long running operations, such as GDPR redactions/deletions are handled by web services.; We closely monitor memory and disc usage and our network can be easily expanded if required.

Analytics

• Service usage metrics: Yes
• Metrics types: History of user log ins.; Date and user who created records in the database.; Email send logs.; Document send logs.; Record search and loading times.; Report and query processing times.; Page access logs for client records.; Record deletion logs.
• Reporting types:
  • Real-time dashboards
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest: Physical access control, complying with another standard
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Two methods to export data:; 1. All data is reportable and all reports are exportable. Criteria can be applied for reporting purposes so only the data users wish to see comes back. They can also create their own report layouts. Each report is exportable in a number of formats, for instance .PDF, .DOCX and .XLSX.; 2. At no additional cost our support team will create ad hoc data extracts to users' specifications. This option is included in our support service.
• Data export formats:
  • CSV
  • ODF
  • Other
• Other data export formats:
  • PDF
  • DOCX
  • XLSX
  • HTML
• Data import formats:
  • CSV
  • Other
• Other data import formats: SQL

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: We aim to provide 99.95% service availability. The only exception is planned maintenance scheduled in advance and usually conducted out of normal working hours.; ; In the unlikely event of us failing to meet the above SLA (in any one month rolling period) the customer will be eligible for a credit. We'll refund 1 day's service fee for every hour that connectivity has been unavailable over the specified SLA, up to a maximum value of one month’s service.
• Approach to resilience: Our data-centre has 1Gbps primary circuit. A 1Gbps automatic failover secondary circuit is due to be supplied by GTT.; ; The data-centre consists of multiple web servers and SQL servers. Client systems can be relocated at a moments notice.; ; We operate a three-tiered approach to backing up client data for high resilience against all possible disaster scenarios.; ; Our primary backup system stores data on local disks connected to our backup server, managed by Microsoft Data Protection Manager 2019, providing data restoration within an hour.; ; Backup tier 2 builds upon the first tier by producing copies of backups onto our offsite cloud. The data is encrypted using industry standard encryption. This tier provides a data retention period of 28 days with daily recovery points.; ; Backup tier 3 is designed for disaster recovery where the other tiers are not available. Data is backed up to MSAzure, using Zone Replicated Storage (ZRS). Data never leaves the UK.; ; This tier provides a data retention period of 7 days with daily recovery points.
• Outage reporting: Service outages are reported by email and a message/notification is also displayed on the web site.; ; We are in the process of making an outage dashboard available externally.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
  • Other
• Other user authentication: SSO
• Access restrictions in management interfaces and support channels: MS Asp.Net Identity authentication framework is used to manage access to the web application. Active Directory is used for the Windows (RDP) application.; Two factor authentication is available on request.; Password changes require an access code sent directly from the system via email.; User based privileges manage user access to certain parts of the application based upon the user role.; Security settings are used to manage access to:; specific cohorts of clients, enterprises and vacancies;; specific information on client profiles, interventions and action plans;; documents and document types
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
  • Other
• Description of management access authentication: SSO

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Our information security policies are detailed in our ISMS (Information Security Management System) and constitute the main element of our ISO27001 certification, first achieved in 2011 and most recently re-assessed in August 2025.; ; Policies cover all elements of information security, including: risk framework, all aspects of assets, patch control, usage policies, staff (recruitment, induction, on-going training and leavers), data handling, documents, physical security, business continuity / disaster recovery.; ; Our system administrator creates a schedule of security compliance checks at the start of each year and produces a report for the operations director each month.; ; Our information security policies are reviewed each quarter and updated as necessary.; ; Staff are trained on their information security responsibilities as part of their induction and undergo refresher training regularly thereafter.; ; Posters are displayed throughout the offices reminding staff of their responsibilities.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Firstly, Azure DevOps is used to manage the cycle of build development, testing and roll out. Azure DevOps allows us to assess and document data security risks associated with each new build.; ; Both new software developments and infrastructure enhancements are subject to risk analysis prior to implementation. The three elements of; Confidentiality, Integrity and Availability are assessed. The risk plan assesses likelihood and potential impact for each scenario with options for mitigation, before arriving at a decision on whether to proceed.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Firstly, within our BCM we maintain a risk register with impact assessments.; ; The application is hosted on secure servers behind a Sophos XG 125W firewall.; ; Atera RMM network monitoring software is deployed on our servers. This reports any issues to our system administrator.; ; Virus protection on all servers and devices is managed by ESET PROTECT Enterprise (EPEN-N2-D).; ; Application and network penetration testing is carried out regularly by our own team and once per year by an external, fully accredited company.; ; Security patches are deployed as soon as they are available, or at least once per week.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Monitoring software is deployed on servers and stand-alone machines. An email is automatically sent to the system administrator if potential compromises are identified.; ; We also perform our own internal tests on a monthly basis. Application testing leading up to the release of a new software build is far more intensive.; ; External penetration testing is also used to identify potential compromises.; ; The response to an incident is dependent on its nature, but all would be treated as a priority.; ; We have a documented Business Continuity Plan available to staff, that provides guidance on how to deal with incidents.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: Some incidents are emailed directly by the application to a Helpdesk folder. Users can also report incidents to our Support folder.; ; Each incident is logged on our ISMS and assigned a status, priority and a support team member.; ; Users are notified that the incident has been logged and provided with a resolution date/time.; ; The operations director checks the incident log continuously and ensures deadlines are being met. One of the business KPIs is the response time for incident resolution.; ; Incident reports are provided on request. We are developing a feature on our web site to allow users to download reports.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Users can experience the current system build containing demonstration data for up to four users and for up to four weeks. They have unlimited access to the support / helpdesk during this time.
• Link to free trial: https://hanlondemo.hanlonsonline.co.uk

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: BSI
• ISO/IEC 27001 accreditation date: Friday 14 January 2011
• What the ISO/IEC 27001 doesn’t cover: None. All of the service is covered by our ISO/IEC 27001 certification
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• ISO 9001 certification accredited by: BSI
• ISO 9001 accreditation date: Tuesday 31 July 2012
• What the ISO 9001 doesn’t cover: None. All of the service is covered by our ISO 9001 certification
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 7119fa75-78e6-45d6-9a85-41572879ea09
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
  • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors
  • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
  • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

  • Understanding of the issues affecting the development of new skills by target cohort
  • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
  • Other measures to offer development opportunities for the target cohort(s) in the contract workforce
  • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
  • Understanding of issues relating to entering the contract workforce
  • Creation of outreach activities to create a pipeline of employees for the future contract delivery
  • Content of the outreach activity is designed to suit the target cohort
  • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at kevin.hanlon@hanlons.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.