TSO - The Stationery Office

Mobile App Platform

TSO’s in-house app platform for the fast and cost effective delivery of cross-platform hybrid apps.

Features

• Standard feature set. Pick and choose depending on your needs
• Publications module brings to life book and web-style content
• eLearning module delivers a full learning and test yourself experience
• Designed to be branded to suit your needs.
• Support for content in multiple languages
• Analytics service for tracking usage, progress and other metrics
• Interactive video functionality
• In-app purchases for paywalling areas of content or functionality

Benefits

• Once downloaded, apps work offline when internet is not available.
• Can brand as much or as little as you need
• In-house editorial, account management, marketing, design, and development teams
• We can help to develop, edit and proofread content
• We can create a look and feel for your App
• UK-based team
• Removes the cost and complexity of developing Apps in-house

£9,995 to £99,995 an instance

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tsobidteam@williamslea.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

364625772452458

Contact

Bid Team
07548372034
tsobidteam@williamslea.com

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: We can provide a range of services to suit your needs and budget, some of these services will have constraints such as remote working or working hours, SLAs, etc.
• System requirements:
  • Mobile phone that can download Apps
  • Desktop

User support

• Email or online ticketing support: Yes, at extra cost
• Support response times: To be decided with buyer.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.1 AAA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes, at an extra cost
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.1 AAA
• Web chat accessibility testing: To be decided with buyer.
• Onsite support: No
• Support levels: To be decided with buyer.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Online training can be provided where required to ensure that content editors have full confidence in their understanding of the interface. User documentation will additionally be provided to help
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Data will be provided in one or more of the structured formats within the service either as the standard data formats or any bespoke formats created during the contract.
• End-of-contract process: An exit plan will be included with any contract

Using the service

• Web browser interface: No
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: TSO’s mobile app platform makes it easy to add portable and highly useable apps to your portfolio of information products. Using our app development platform reduces time to market, development and maintenance costs. It is more efficient, resilient and cost-effective than building one-off apps.; ; The platform is a unified environment for developing, deploying and managing mobile applications across multiple operating systems and environments from a single codebase.
• Service interface: No
• User support accessibility: WCAG 2.1 AA or EN 301 549
• API: Yes
• What users can and can't do using the API: Retrieve content in different representations
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: The platform is a unified environment for developing, deploying and managing mobile applications across multiple operating systems and environments from a single codebase.

Scaling

• Independence of resources: TSO’s app platform can handle the growth of user base and data without major infrastructure changes. This is crucial for apps that expect rapid expansion or significant spikes in usage because of events, season etc.

Analytics

• Service usage metrics: Yes
• Metrics types: Download via relevant App platform. Also, built in analytics enable tracking of user behaviour and app performance to inform future developments.
• Reporting types: Regular reports

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Physical access control, complying with another standard
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Data can be made available through APIs to allow for direct access for the users. In addition any non-public data such as reporting can be made available in a variety of formats for the client.
• Data export formats:
  • CSV
  • Other
• Data import formats:
  • CSV
  • Other

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: A standard SLA of 99.98% is offered for the availability of public facing services. Service credits would be given where availability does not meet this standard
• Approach to resilience: Our distributed ‘always available offline’ model means that our products aren’t affected by internet provider or data centre outages and can be used in areas where there’s no connectivity.
• Outage reporting: Email alerts to support and operations teams, with escalation via email to key individuals. API endpoints showing overall service availability

Identity and authentication

• User authentication needed: No
• Access restrictions in management interfaces and support channels: Access to management interfaces is contolled with secure authentication processes including MFA, where possible Single Sign-on is used. Support channels are access through Industry standard secured service management portals.
• Access restriction testing frequency: Less than once a year
• Management access authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
  • Other
• Description of management access authentication: Different elements of the service use specific technologies to restrict the access including all of the above checked options for different elements of the service.

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: You control when users can access audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: UKAS
• ISO/IEC 27001 accreditation date: 02/04/2025
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: Yes
• Any other security certifications: ISO 22301

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: SO/IEC 27001:2013: Information Technology – Security Techniques – Information Security Management Systems. ISO/IEC 27017:2015: Information Technology – Security Techniques – Code of Practice for information security controls based on ISO/IEC 27002 for cloud services. CYBER ESSENTIALS PLUS: Cyber Essentials verified self-assessment with an additional technical audit, an on-site or remote assessment, and internal and external vulnerability scans conducted

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We align to ITIL v3 processes
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We use third party monitoring 24x7 to notify any vulnerabilities we use the provided information to apply patches and updates.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We use third party monitoring 24x7 to notify any vulnerabilities we use the provided information to apply patches and updates.
• Incident management type: Supplier-defined controls
• Incident management approach: Via Jira helpdesks which align to ITIL processes

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  TSO, as part of the Williams Lea Group, has an ESG (Environmental, Social and Governance) programme. The Beyond Business programme ensures ethical and environmental accountability, thoughtful actions in the community and opportunities for development.; Our climate change commitments include:; Developing and establishing sustainable, inclusive and digital practices for the future.; Using cloud hosting solutions for more efficient use of computing resources.; Annual social value reports.; Robust supplier onboarding policies and procedures.; Aligning our ESG strategy to the UN Global Compact Sustainable Development Goals: Good Health and Wellbeing (3); Diversity, Equity and Inclusion (5, 10); Decent Work and Economic Growth (8); Climate Action (13)

  Equal opportunity

  TSO, as part of the Williams Lea Group, has an ESG (Environmental, Social and Governance) programme. The Beyond Business programme ensures ethical and environmental accountability, thoughtful actions in the community and opportunities for development.; Our equal opportunity commitments include:; Employing a User-Centred Design (UCD) approach to service development.; Ensuring accessibility of our products and services.; Robust supplier onboarding policies and procedures.; Policies that explicitly prohibit discrimination and initiatives that encourage diversity. ; Mandatory Diversity, Equity and Inclusion and Anti-harassment and discrimination training; Modern slavery statement and policies. ; Diversity data monitoring.; Disability confident employer. ; An Employee Assistance Programme and Employee Benefits Scheme to provide support for employees.; Flexible working arrangements.; Aligning our ESG strategy to the UN Global Compact Sustainable Development Goals: Good Health and Wellbeing (3); Diversity, Equity and Inclusion (5, 10); Decent Work and Economic Growth (8); Climate Action (13)

  Wellbeing

  TSO, as part of the Williams Lea Group, has an ESG (Environmental, Social and Governance) programme. The Beyond Business programme ensures ethical and environmental accountability, thoughtful actions in the community and opportunities for development.; Our wellbeing commitments include:; An Employee Assistance Programme and Employee Benefits Scheme to provide support for employees.; Flexible working arrangements.; Positive promotion and reward for socially beneficial and responsible behaviour. ; Employing a User-Centred Design (UCD) approach to service development.; Aligning our ESG strategy to the UN Global Compact Sustainable Development Goals: Good Health and Wellbeing (3); Diversity, Equity and Inclusion (5, 10); Decent Work and Economic Growth (8); Climate Action (13)

Pricing

• Price: £9,995 to £99,995 an instance
• Discount for educational organisations: No
• Free trial available: No

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tsobidteam@williamslea.com. Tell them what format you need. It will help if you say what assistive technology you use.