SYMOLOGY LIMITED

Symology for Bridges/Structures (Cloud Edition)

This solution provides a spatially enabled system for the management of Bridges and Structures assets.

Features

• Sophisticated user-definable Asset Management/Valuation/Lifecycle facilities
• Embedded GIS/Mapping (ESRI), includes WFS integration and OpenData Layers
• Mobile Working capability with real-time communications and offline capability
• Inspections/Condition Surveys (General/Principal/Special) scheduling/recording and CS450 calculation
• Defect Recording and Works Ordering, Workbank and Budget Monitoring capabilities
• BCI/SCI Calculation facilities in accordance with SAVI Toolkit (Atkins spreadsheet)
• Ability to store files (photographs) with Assets, Defects and Inspections
• Pre-built Asset definitions in accordance with Well Managed Highways CoP
• Ability to store BCI results year-on-year to provide historical analysis
• Comprehensive reporting facilities, including national reports, dashboards and exporting

Benefits

• Integrated solution removes need & cost for numerous separate systems
• Provides accurate, timely, reliable, valid, complete and secure data
• Streamlines end-to-end workflow providing lean, efficient business processes
• Supports and informs management and engineering decisions
• Increases efficiency through mobile working, aiding Net Zero/carbon neutral effort
• Potential to allow channel shift efficiency savings to be realised
• Data can be extract and analysed without technical assistance
• Interacts with corporate systems and external customer facing access channels
• Intuitive user interface with common look and feel minimises training

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@symology.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

364322789743539

Contact

Stuart Marshall
0808 196 8693
sales@symology.co.uk

About your service

• Service categories:

  Applications

  Enterprise resource management

  • Asset life-cycle management
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: A fortnightly planned maintenance window of four hours scheduled every other Thursday after 18:00.
• System requirements: Mobile App runs on Android or iOS mobile/tablet devices

User support

• Email or online ticketing support: Yes
• Support response times: Response times are based on the helpdesk hours and are dependant on priority. ; Priority 1 -> 1 hour ; Priority 2 -> 1 hour ; Priority 3 -> 24 hours ; Priority 4 -> 24 hours
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Symology offer a single level of high quality support to all our customers which has resulted in us retaining our extensive customer base for many years. Symology’s helpdesk is able to offer both technical and functional support during standard office hours Monday to Friday. Manned support outside of the standard support time can be made available at an additional charge as required. Symology also provide a designated Account Manager who is a product consultant and is available during office hours for escalation of issues. Symology also include a Customer Service Portal (Fault Management System) which provides a web interface that allows customers to create or review support cases at any time. It also allows customers to; • Search and browse the product knowledgebase. • Log new support cases, specifying a priority. • Check on the status of existing cases (including those opened by phone or email). • Add comments and attachments to existing cases. • A detailed Customer Service Portal User Guide is available to users on logging in to the portal.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Symology provides a comprehensive onboarding process to help users start using the service. This includes training videos available via the Aurora Academy website, which can be accessed at any time. User documentation can be provided following training, and these handouts can form part of the training sessions and be used for future reference as a reminder by training delegates. Additionally, Symology offers training sessions, which can be delivered on-site or remotely, depending on the customer's preference. The training is designed to be interactive and engaging, ensuring that users are equipped with the knowledge and skills required to effectively utilise the software service. The training is led by experienced trainers who have a deep understanding of the software and its applications. This comprehensive onboarding process ensures that users are up and running quickly and efficiently, minimising the time spent on learning and maximising the benefits of the software service.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: All customer data remains the customer's property at all times. Symology will extract and provide the data in CSV format for input into any new system, using our own schema. Alternatively, a documented specification defining the format provision can be provided during decommissioning. Object files and attachments will be provided in the file structure in which they are stored, available via SFTP for three months from the termination/expiry of the contract. After this period, all data and copies/backups will be removed from all media/stores, and a certificate of destruction will be provided. Data Metric reports will also be provided as part of the decommissioning process.
• End-of-contract process: At the end of the contract, Symology will facilitate a smooth transition process to ensure a seamless handover of data and services. An Exit Manager will be allocated to create a detailed exit management plan, outlining the customer's requirements for data extraction, the exit timeline, and the termination of service. The plan will include the date and time for the termination of service, the final date for system decommissioning, and data destruction.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: We are committed to meeting our customers’ accessibility requirements for onboarding and offboarding documentation. To achieve this, we will apply best practices such as using built-in heading styles instead of simple formatting, adding descriptive alt text for all images and diagrams, and ensuring table headers are correctly marked for clarity. We will also check colour contrast and avoid relying on colour alone to convey meaning. Finally, before publishing, we will run Microsoft Word’s Accessibility Checker to confirm compliance and deliver documentation that supports inclusive access for all users.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The Mobile solution is designed for multi-disciplined inspectors. The solution offers inspectors the functionality to complete and prompt inspections/condition surveys, record defects, collect/record asset information, record status updates, attach photographs, send Street Works start/stop notices and record works details(completed/labour/plant/materials). It is designed to work without the requirement for an 'always-on' connection. Mobile mapping facilities allow users to select/update records as well as plot points/lines/polygons. GPS tracking facilities include the ability to trace the routes that inspectors have been taking. A planned route facility allows the inspector/gang to optimise the route and coordinate different activities to ensure maximum efficiency when on-site.
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: Symology offers a range of Web Services (XML/REST) Interfaces to interface with corporate systems. Symology's Web Portal solutions, including Report It, Apply For It and View It, also utilise direct interfaces. These Interface solutions are designed to allow other applications to interface directly with the various solution areas. The aim of the Direct Interface is to receive data from "trusted sources" which can be recorded directly into the database, without any form of review by a user. Typically Direct Interfaces are used to call the solution which operates as a specialist back-office product. They can be plugged in to from a corporate product, or used as an alternative to the main user interface, for performing the actions available to the interface. The Direct Interfaces operate by providing a component interface to the relevant solution area, whereby elements of the application logic can be called by external applications. Direct Interfaces are currently available for Customer Service, Asset Register, Licences, Street Works and Street Gazetteer.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: The solution offers users considerable customisation. The web portal will be customised in line with the customer's branding as standard. All screens can be controlled (no access, read-only access, update access) by permissions. Facilities are also provided on a user-by-user basis to change the font/screen sizes used throughout the system. Update/Enquiry dashboard grids can be customised considerably including what data is displayed. Highlighting options also allow business rules to be created to change the visualisation of the data. The solution has an Additional Fields facility allowing users to create fields within each module to store data that may not be catered for elsewhere. These fields can be many formats and can be grouped as required. They can also be passed to the Mobile and made read-only if required. The solution has extensive and customisable workflow capabilities. This is aimed at marrying a customer's business processes with the solution to ensure the maximum benefits are returned.

Scaling

• Independence of resources: We guarantee resource independence by provisioning each customer with a dedicated database instance, ensuring strict data and workload isolation. This architecture prevents cross‑tenant interference, so one customer’s demand cannot degrade another’s performance/availability. Application components are orchestrated through Kubernetes, enabling continuous monitoring of usage, latency, and resource consumption across infrastructure layers. Kubernetes’ autoscaling mechanisms dynamically allocate resources in response to demand fluctuations, while capacity is deliberately over‑provisioned based on historical and forecasted patterns. Our operations team proactively monitors system health and performance metrics, addressing emerging bottlenecks before they impact users. This integrated approach ensures consistent service quality for all customers.

Analytics

• Service usage metrics: Yes
• Metrics types: User Activity Metrics:- Number of active users per month, Login statistics (daily/weekly/monthly) including session duration. API and Transaction Metrics:- Volume of API calls and transactions over defined time periods. Storage Usage Metrics:- Object storage consumption (GB/TB), Database storage usage. Service Performance Metrics: - Uptime/availability statistics aligned with SLA commitments. Compliance/Audit Metrics:- Comprehensive audit logs detailing user actions and system events for compliance monitoring. Support/Training Metrics:- Number of support calls raised and resolved, Training engagement and completion statistics. Public Web Portal Usage:- Usage analytics for public-facing web portals provided as part of the solution, including interaction volumes and engagement trends.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Degaussing
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: Users can export data in CSV, Shapefile or XML format very quickly and easily from within the solution. Users select the data required to export by means of the vast array of definable enquiry data grids and then simply export to file. This file would automatically be made available to downloaded. Complete data sets will be provided to a customer, in our own schema format, on contract end/termination.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • Other
• Other protection between networks: Often the level of protection is dictated by the authority customer however we always recommend customers use encrypted traffic. Symology do not support SSL 1, 2 or 3. Secure FTP traffic is permitted although support for weak algorithms has been removed.
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: SFTP

Availability and resilience

• Guaranteed availability: Symology's Managed Service has been in operation since 2006. The standard availability target is 99%, enhanced availability target is 99.9%, and both are measured between the hours of 08:00 and 18:00. The Service period is 3 months. In the unlikely event that the availability falls below the target service level in any service period, the customer shall be granted a service credit against the fees for that service period. 98% -> 5%, 97% -> 10%, 96% -> 15%, 95% and below -> 20%.
• Approach to resilience: Symology operate a dual hosting model offering an active/passive approach resulting in an extremely high level of resilience when it comes to business continuity and disaster recovery. Symology utilise two independent data centres within different locations across the UK. Each customer's solution is regularly mirrored to the passive data centre. Further information is available on request.
• Outage reporting: Service outages and availability are reported by means of a public Service Status website providing a transparent view of the availability of the Symology Hosted Services. In addition, availability is continually monitored and customer Account Managers are informed of any outages, be it planned or otherwise, that need communicating with affected customers.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is tightly controlled through secure authentication and authorisation. All management users authenticate via SSO or, where unavailable, MFA using an authenticator app; Symology staff use SSO with MFA on approved corporate devices and UK‑only IP ranges. Administrative access follows a granular RBAC model, supported by segregation of duties, logged privilege elevation, and periodic access reviews. Outside standard hours, customers use the Customer Service Portal, accessed only through unique, non‑shared credentials (verified company email and password). The portal enables case creation, updates, and knowledgebase access while ensuring each user’s identity is strictly validated.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: In addition to ISO27001 and Cyber Essentials Plus accreditations, Symology adhere to our own internal Information Security Management System. All of the components of this ISMS are periodically and systematically reviewed by both internal and external audit procedures. A nominated member of staff has been appointed by Symology’s Managing Director to be responsible for the control of all matters relating to the implementation, control and continuing audit of these procedures which are adopted and practised by all Symology employees. Symology has adopted the process approach for developing, implementing and improving the effectiveness of its ISMS by committing to understanding business information security requirements and the need to establish policy and objectives for information security, implementing and operating controls in the context of managing the overall business risk, monitoring and reviewing the performance and effectiveness of the ISMS, continual improvement based on objective measures, communicating throughout Symology the importance of meeting all relevant statutory and regulatory requirements specifically related to its business activities and ensuring that adequate resources are determined and provided to monitor and maintain the ISMS. Due to its secure nature, access to Symology's ISMS policy will only be made available to customers visiting our head office.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: All changes pass through a centralised, controlled approvals process which is audited. Records are retained indefinitely. Software changes pass through a PQT/QA process which also includes security testing. External-facing software is tested by two separate third parties.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Potential threats are assessed by a combination of security device monitoring and regular log reviews. Following our Cyber Essentials Plus certification requirements, our patches are rolled out within 14 days of release. We are subscribed to a number of security information services whose role it is to inform us of emerging threats. Once informed the relevance of the threat is assessed and if relevant the scope of the threat is assessed and then the mitigation is planned and documented to help monitor the progress of mitigation. The potential impact is assessed to help prioritise the mitigation effort.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Potential compromises tend to be identified by alerts generated by hardware and software security devices including but not limited to our firewalls and intrusion detection/protection devices once they have assessed the issue as warranting investigation. Logs are also monitored by a third party log monitoring tool. Once alerted, a priority service case is raised to track investigation of the issue. If there is a concern about security or the monitoring, it will be tracked back to its source and any necessary remediation of software, services or procedure will be investigated.
• Incident management type: Supplier-defined controls
• Incident management approach: Incident notifications come from system monitors, log monitoring or report from an individual. A priority service case is raised and stakeholders are automatically alerted. An investigation will be immediately launched to assess the source, scope and severity of the incident. Once the immediate threat has been resolved, work will be undertaken to assess the extent of the incident, trace the source and identify necessary steps to eliminate any residual effects. The response will be examined to highlight if anything could have been done differently to detect the incident sooner, reduce its impact or improve communications to the relevant parties.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: It should be noted that free trial has been selected to facilitate access to a technical connection test rig rather than enabling functional system use.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: NQA
• ISO/IEC 27001 accreditation date: Tuesday 20 May 2025
• What the ISO/IEC 27001 doesn’t cover: All protection of information of highway asset management software and related services in accordance with the latest Statement of Applicability version 2.3, is covered.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: SAQ-D Compliance reviewed quarterly by Sectigo Limited
• PCI DSS accreditation date: Saturday 8 November 2025
• What the PCI DSS doesn’t cover: PCI DSS security controls, including network security, encryption, and access management, and ensures alignment with industry best practices for protecting cardholder data are only relevant for the ApplyForIt Portal.
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 85b643e9-040a-40d5-9472-81736e1b7f62
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: D824fd87-c6c2-4fb4-82be-1ba4e5ad60e4
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@symology.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.