ELYDIUM LIMITED

Timetable Management Platform

A cost-effective solution that facilitates the seamless and timely flow of high-quality timetable data, our platform plays three key roles in the data workflow:

- Validation and import (from third-party systems)
- Timetable version control (historic, current and future timetables)
- Consistent data exports (TransXChange, GTFS, Excel, PDF formats)

Features

• Import and export TransXChange using multiple profiles
• Full support for BODS and the TransXChange PTI Profile
• Fully-featured timetable version control
• Create and edit timetables and geographic tracks
• Compare different versions of a timetable
• Rule-based validation engine and import portal
• Full support for export in GTFS format
• Support for printed and online publicity
• Support for editing NaPTAN data

Benefits

• Support for franchising, enhanced partnerships and service tendering
• Ensure compliance of imported data
• Ensure consistency between data exported to downstream systems
• Improve the quality of passenger information
• Fully scalable to support national data sets

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at admin@elydium.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

400036017706642

Contact

Rob West
07932 436657
admin@elydium.co.uk

About the service

• Service categories:
  • Application Development and Deployment
    • Data management
      • Data integration and intelligence
        • Data Ingestion and Transformation Software
        • Data Quality Software
        • Data Access Infrastructure Software
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: None
• System requirements: Browser must support Web Assembly (WASM)

User support

• Email or online ticketing support: Yes
• Support response times: Typical response times are under two hours.
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: No
• Support levels: Support is provided by account managers with technical and transport industry knowledge. There are no additional costs or separate tiers for support; it is provided as standard with all SaaS contracts.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: We provide online training.
• Service documentation: No
• End-of-contract data extraction: All timetable data can be made available in TransXChange or GTFS format. Other data can be made available in CSV or JSON format as appropriate.
• End-of-contract process: A full export of all data stored in the system will be made available at no additional cost.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: We are an API-first company.; ; Our "Online Publicity API" is a priced option, specifically designed for integrating with third-party web and journey planner developers.; ; Secure access to any of the remaining APIs can be provided at additional cost.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: We offer a full range of software development services. Where customisation is required, we will quote based on the standard daily rates included in our pricelist.

Scaling

• Independence of resources: Larger clients typically have their own instances of the solution (accessed through custom URLs). Smaller clients typically share resources. Memory, CPU and disk usage are monitored and we receive notifications when resources for a particular service cross a pre-defined threshold. This allows us to ensure that sufficient resources are provisioned for all users.

Analytics

• Service usage metrics: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Staff screening not performed
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: In-house
• Protecting data at rest: Physical access control, complying with another standard
• Data sanitisation process: No
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Exporting is an integral feature of the service. Small scale ad hoc exports can be performed via the user interface, with the resulting data zipped and downloaded via the user's browser. Large scale exports can be automated and scheduled, with output written to the client's S3 bucket or similar.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • TransXChange
  • GTFS
  • NaPTAN
  • Excel
  • JSON
• Data import formats:
  • CSV
  • Other
• Other data import formats: TransXChange

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: We guarantee a minimum of 99.5% uptime.
• Approach to resilience: Available on request.
• Outage reporting: Outages and other service events are reported to us via our cloud hosting provider's email alerts.; ; We notify our clients by email where the service we provide to them has been affected.

Identity and authentication

• User authentication needed: Yes
• User authentication: Username or password
• Access restrictions in management interfaces and support channels: We are a micro enterprise with a small number of staff. Access is granted/revoked directly by a company director as required.
• Access restriction testing frequency: At least once a year
• Management access authentication: Public key authentication (including by TLS client certificate)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: No
• Security governance certified: No
• Security governance approach: Our approach is built on a foundation of risk management, accountability, and continuous improvement, tailored to the high-availability requirements of a B2B SaaS environment. Governance is enforced through the use of "Infrastructure as Code" and scripted deployments, which ensure that security configurations are applied consistently and are auditable.
• Information security policies and processes: Our core policies include a Data Protection Policy that governs the handling of client data, an Access Control Policy based on the principle of least privilege (utilizing SSH keys and restricted .env configurations), and a Disaster Recovery Policy that mandates daily encrypted backups and scripted infrastructure restoration.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Changes are validated through automated and/or manual testing prior to deployment. As part of this workflow, we assess potential security impact by reviewing changes against common risk areas such as authentication/authorisation behavior, data handling, dependency updates, network exposure (ports, firewalls, etc), and backup/restore implications. Higher-risk changes (e.g., dependency upgrades, security-related configuration changes, or modifications affecting data persistence) receive additional review and are subject to staged rollout. We maintain rollback capability through versioned releases.
• Vulnerability management type: Undisclosed
• Vulnerability management approach: We obtain information on potential threats from multiple sources, including vendor and maintainer security advisories for the operating system and standard Docker images we use (e.g. Microsoft .NET, MySQL, MongoDB) and reputable vulnerability disclosure channels (e.g. CVE, NCSC).; ; We prioritise vulnerabilities based on severity, exploitability, exposure (internet-facing vs internal-only), and potential impact on customer data and service availability.; ; For critical or actively exploited vulnerabilities affecting internet-facing components or data-handling services, we aim to patch on an expedited basis. Non-critical patches are scheduled and released in the next appropriate maintenance window or software release.
• Protective monitoring type: Undisclosed
• Protective monitoring approach: Our hosting partner provides always-on, automatic network-layer DDoS protection, including automated detection and mitigation of volumetric and protocol-layer attacks. We also monitor resource usage (CPU, memory, disk, etc) with notifications automatically triggered when these metrics exceed pre-defined thresholds.; ; Our response is risk-based: suspected active compromise or issues affecting customer data or availability are treated as high priority and escalated immediately, with investigation and containment initiated as quickly as possible, following our Disaster Recovery process.
• Incident management type: Undisclosed
• Post-quantum cryptography secure: No
• Incident management approach: Users can report incidents via our support email channel, which is monitored to ensure timely acknowledgment and triage. ; ; Our response approach is rooted in continuous learning and proactive documentation. We maintain a knowledge base of baseline procedures procedures for common scenarios, allowing us to respond effectively to new incidents.; ; Where an incident is deemed critical, a report is issued to all users.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: We offer time-limited trials of our service at our discretion. Trials are typically fully-featured and run for up to three months.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

  • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
  • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
  • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at admin@elydium.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.