Kick ICT

Electronic Invoice Processing – EIP

Electronic Invoicing is a seamless e-invoice solution. Dramatically increasing the percentage of invoices that are processed 'straight through' without the need for human handling because they are received in an electronic format.
The e-Invoicing solution enables companies to have a single access point for all invoices and other creditor documents.

Features

• Receipt of electronic invoices securely from Suppliers
• Business rules to ensure the data is correct
• Coded automatically with the company’s common chart of accounts
• Automatic notifications via email/text messages
• Accounts Payable or a designated contact to receive invoices
• PEPPOL Access Point
• Multi Company & Multi Currency
• Reporting

Benefits

• Simple and intuitive interface means minimum end user training
• E-invoicing enables a company to automate their invoice processing
• Seamless connection to the finance system provide data accuracy
• Cost Savings
• Automated the invoicing process
• Reduced costs to process invoices
• Seamless connection to the finance system provide data accuracy
• Reduced administration cost associated with processing invoices.
• For Suppliers this means faster payments

£200 to £500 a licence a month

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at natalie.davidson@kickict.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

356568942569343

Contact

Natalie Davidson
01698844600
natalie.davidson@kickict.co.uk

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Private cloud
  • Hybrid cloud
• Service constraints: No know constraints
• System requirements: The customer supplied the MS SQL Server database

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Email support request response times are fully detailed in our Service Level Agreement with the customer, and are based on level of support priority . Weekend support is an additional cost.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Kick’s application support model is based around ITIL (IT Infrastructure Library) best practice. ITIL is a best practice framework developed by the Office of Government Commerce and is accepted as a worldwide standard for the delivery of IT support to businesses. Kick’s ITIL based Support methodology is used to ensure that proactive, value added and responsive support service is provided to you. ; ; We adhere carefully to IT industry best practice, and follow the ITIL standards (IT Infrastructure Library). Our support function is provided via our dedicated helpdesk in Strathclyde Business Park, Bellshill from where we provide high quality support to over 500 customers ; ; We use a number of leading edge systems and software applications to help maximize our service to customers, such as: ; ; Cherwell service management call handling software which is ITIL accredited software for handling, monitoring and reporting Castle’s service against agreed SLA’s ; ; Secure remote access software which allows us to take control of any PC or server that can connect to our web site ; ; Customer online Portal - our innovative myCastle self service support portal enables the client to log and monitor call activity and provides access to a knowledge base. ; ; MS Teams with meeting and recording capability.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: A range of On-Boarding services are available including - Project Scoping, planning and deployment. Project Management and on-site training services
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: Data extraction services are part of the solution we offer, ensuring clients can de-couple from the solution and retain all of their data
• End-of-contract process: The contract incorporates the licences to use the EiP solution. Additional/Optional services and costs are The Professional Quality Implementation Services (PQIS) . These include Training consultancy, deployment consultancy, design consultancy, integration consultancy, data migration consultancy and Project Management

Using the service

• Web browser interface: No
• Application to install: Yes
• Compatible operating systems: Windows
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: The API access and configuration is only available as part of chargeable development and integration projects.
• API documentation: No
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: The screen layouts, menus, access to data, workflows and business rules are all customisable. These are customised as part of the project and completed bu the supplier.

Scaling

• Independence of resources: Dedicated application servers can be issued to minimise other user impact on services

Analytics

• Service usage metrics: No

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: DCS

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
• Data sanitisation process: No
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Data can be export direct from the MS SQL server database by the customer
• Data export formats: CSV
• Data import formats:
  • CSV
  • ODF

Data-in-transit protection

• Data protection between buyer and supplier networks: Private network or public sector network
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: User security access

Availability and resilience

• Guaranteed availability: The Service is available 24/7 365 days per year and has an uptime average of 99% over the past 9 years. From time to time planned outages are agreed with customers for the implementation if upgrades etc.. Typically these are once a quarter and are implemented outside office hours
• Approach to resilience: The platform has been implemented with a redundant and fault-tolerant High Availability Architecture (HAA) to ensure that no single point of failure can affect the availability of the overall solution (the concept of duality is applied to all aspects components of the architecture).; ; The Network has been designed to be multi-zone separated by firewalls. Security has been implemented across the applications and uses industry standard authentication.
• Outage reporting: If outages or part outages occur it is Castle's policy to transparently discuss this with our customers. Castle has also implemented the following ways to communicate outages to our customers:-; 1. As soon as an outage occurs Castle will email all relevant customer contacts; 2. Castle will post a status update page that will be updated with any developments and this page is accessible by all customers.; 3. If the problem is ongoing Castle will email all end users directly and send text messages to affected users; 4. When the outage is over Castle will update all users impacted by the outage via email and text message; 5. Castle provides each impacted customer with a detailed outage report that includes a detailed description of the problem that occurred and a plan to ensure that the problem does not occur again.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Username or password
• Access restrictions in management interfaces and support channels: Management Interfaces are restricted based on Group membership. Company Administrator access is limited to views of a company's data and all access if restricted via 2-factor authentication.; System level access is restricted to the Castle help desk operation leaders.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • 2-factor authentication
  • Username or password

Audit information for users

• Access to user activity audit information: You control when users can access audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: You control when users can access audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Assessment Bureau
• ISO/IEC 27001 accreditation date: 1/06/2022
• What the ISO/IEC 27001 doesn’t cover: A.14 System acquisition, development and maintenance.
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Within the company, we have an acceptable usage policy for all IT equipment. This covers, any office technology extensively, in regards to it's security, software on the devices and the usage of the software/hardware. It is designed so that adherence to the DPA is vital and always present.; ; Technologies such as Active Directory Services, and Group Policy are in place to make sure that company wide administration is present and no preventative measures can be made to disable Anti-Virus, firewalls, HIPS, Anti-Phishing, Email-protection etc.

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: All system changes have to be formally documented, fully regression tested to ensure no application conflicts.; ; Changes applied to a test environment first; ; Customer UAT is required before transfer to a live system
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: With both the head office and the private cloud, we deploy a unified threat management system, which helps monitor all information going in and out of each location. The UTMs is equipped with firewall, intrusion prevention, utm management and advanced threat protection technologies.; ; We run regular patching to our platforms through WSUS, and application specific software releases. We usually deploy these in waves, so that if a patch was to break a service it would break a small amount of our private cloud and not the entire cloud. This is to help prevent any outages.
• Protective monitoring type: Undisclosed
• Protective monitoring approach: We regularly carry out tests to ensure that code injections and other similar attacks (OWASP A1,; A2 and A5 classes). In addition we use 3rd parties to test and ensure no access to restricted information using direct object and URL; references (A4 and A8).
• Incident management type: Supplier-defined controls
• Incident management approach: All incidents reported via the Kick ICT ITIL support services desk. Routes to support include Telephone, Email and Web

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Tackling economic inequality

  Kick are proud to be among one of the 3,500 companies across Scotland championing the Living Wage. Since 2020, we've been committed to fair pay, contributing to the collective effort that's delivered a pay rise to over 64,000 workers and put over £485 million into the pockets of low paid workers.

  Equal opportunity

  Kick are fully committed to promoting equality, diversity and inclusion, by which we mean:; Equality: providing equal opportunities and fairness for all employees, workers and job applicants, and eliminating unlawful discrimination;; Diversity: recognising, respecting and valuing the differences in our people’s protected characteristics, backgrounds, skills and experience and encouraging gender diversity, age diversity, ethnic diversity, diverse physical ability and neurodiversity in our workforce;; Inclusion: ensuring a workplace culture that is fair and safe for all staff, that values our differences and enables each person to be themselves, achieve their potential and thrive at work.

  Wellbeing

  Supporting the wellbeing of our employees is a key priority. We offer a comprehensive benefits package that includes private healthcare and a cycle-to-work scheme. We provide training for line managers on mental health issues and have qualified mental health first aiders throughout the company. We actively promote initiatives like Mental Health Week and Stress Awareness Month internally to our staff.

Pricing

• Price: £200 to £500 a licence a month
• Discount for educational organisations: Yes
• Free trial available: No

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at natalie.davidson@kickict.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.