Fivium Limited

eCase - Correspondence, FOI, EIR, SAR and Complaints case management

eCase is the correspondence, FOI, SAR, Disclosures & Complaints case management service that the UK public sector relies on. It is proven to deliver the largest benefits at the lowest risk. It is available in Basic, Plus & Premium models to suit all public bodies' organisational structures, budgets and needs.

Features

• Manage Freedom of Information, SAR, Complaints, Correspondence, PQ, Data Breaches
• Comprehensive reporting with real-time dashboard, auto-generated ICO / OSIC reports
• Collaborate: allocate tasks, requests, information gathering and quality assurance
• Securely send sensitive information: eliminate postal or secure email costs
• AI-powered automation to speed completion of case lifecycle
• Full digital end to end customer experience
• Personalised workbaskets, enabling users to manage their priorities & deadlines
• Comprehensive case search and granular audit trail for every case
• Inbuilt redactor and disclosure log for complete case management
• Government grade security, availability and resilence

Benefits

• Save time and resources through intelligent process automation
• Guaranteed outcomes, industry best practices and best-of-breed technology
• Efficiencies driven by process optimisation and workload balancing
• Proven value through benefit realisation and business case validation reports
• Personalised Customer Success Programme to ensure success at every stage
• Compliance ensured via comprehensive management reporting and granular case visibility
• Confidence in your responses through measurable quality assurance processes
• Easy to use and intuitive via its user-centric design
• Comprehensive models available to suit every organisation's budget & needs
• Assurance through industry leading availability and reliability

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at enquiries@fivium.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

418971107914446

Contact

Robin Coackley
0844 7365211
enquiries@fivium.co.uk

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Other
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: There are no service constraints.
• System requirements: None

User support

• Email or online ticketing support: Yes
• Support response times: Within 1 hour during service hours
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: UK-based service desk providing email and telephone support 08:00 - 18:30. Additional support hours are available on request. We have a managed SLA which we report on monthly.; ; Each customer is assigned both an ITIL service manager and a customer account manager.; ; We encourage a close working relationship with our locally-based support staff. All of our support staff are experienced technicians who have detailed knowledge of eCase and our customers. Our support team is the single point of contact for both software and technical support issues.; ; We’re proud of our record on customer satisfaction and achieved 100% customer satisfaction in our service delivery in a survey undertaken by an external agency that interviewed representatives from all our customers.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: When onboarding eCase there is a well defined process to bring user organisations onboard for each Case Type (e.g. FOI, SAR, Complaint etc). Allowing the suppliers Onboarding team to effectively map to the customer organisation's processes the relevant eCase features. ; ; Full instructor training is available, with options for this to be delivered onsite or online. Additional eLearning modules are includes with the service to help refresh training. User Documentation includes online help and user guides.; ; A train-the-trainer approach is available for organisations that want to take advantage of utilising their own trainers.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Fivium provide a service whereby data can be extracted in a standard (csv or xlxs) format for structured data and a suitably secure "share" for documents attached to cases.
• End-of-contract process: Data extraction in the standard format is included in the contract, any work outside of this (e.g. a specific format requirement) will be subject to additional cost.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: ECase is a responsive web application designed to work across all screen sizes. All functionality is available on the desktop and mobile service and the layout is optimised for both.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: ECase is a browser-based application, which provides users with comprehensive Case Management functionality, including data entry, workflow, reporting, full user management, auditing and access control.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Manual accessibility checking conducted by a team of disabled individuals using a range of adaptive technologies (hardware and software designed to facilitate the use of computers by people with disabilities), this includes:; ; NVDA: screen reader and application used by those who are blind.; ZoomText: a magnification application used by those with low vision.; JAWS: a screen reader used by blind people to access Web pages.; Dragon Naturally Speaking: voice activated software used by those that do not use a conventional input device such as a keyboard or mouse.; Switch Access: used by those with severe mobility impairments to input commands to a computer.; Keyboard Only: some users with mobility impairments have difficulty making precise movements required by pointing devices such as a mouse; therefore a keyboard is used as the exclusive input device.; Readability: Manual checks to assess the suitability of a Web page for those with colour blindness and dyslexia.; Deaf/Hard of hearing: Manual checks to assess the suitability of a web page for those with hearing impairments.; Learning difficulties: Manual checks to assess the suitability of a web page for those with learning difficulties.
• API: Yes
• What users can and can't do using the API: The eCase API provides a mechanism through which programatic actions can be taken to create cases, get values for and change case data fields, access and attach files, and move individual cases through the workflow process.; ; This API facilites integration with customer website or contact form.; API to update case fields.; ; Webhook functionality to notify 3rd party systems of case status.; ; API to download cases from the Houses of Parliament Q&A feed.; ; ADFS (SAML) APIs for single sign-on.; Google Suite integration APIs.; Integration with 3rd third party APIs.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Customisation to fit the processes of the buyer organisation is possible by case type (e.g. FOI), whilst eCase has standard workflows and data models for the supported case types, it is possible to make adjustments to these (within system limitations). ; ; Some customisation can be made through the management interface by privileged users. More complex customisation can be carried out through a service request.; Scaling; ; Customisation is handled by the supplier, initially through contact with the Onboarding team and later through the combination of Customer Sucess and Support services.

Scaling

• Independence of resources: ECase is deployed on a scalable, virtualised infrastructure utilising best of breed application load balancing and proactive monitoring, with horizontal scaling used to cater for dynamic load handling.; ; Database servers are physically separated.

Analytics

• Service usage metrics: Yes
• Metrics types: Service level performance in line with Service Level Agreement including response times, number of tickets and time to resolution.; Storage usage graphs, security metrics such as failed login attempts, virus detection etc.
• Reporting types: Regular reports
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: Physical data protection provided by AWS.; ; Logical data encryption of volumes using AES256, set as default through the use of AWS services.
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Data can be extracted via spreadsheet (.csv, .xlsx).
• Data export formats: CSV
• Data import formats:
  • CSV
  • ODF
  • Other
• Other data import formats:
  • PDF
  • TIF
  • DOC/DOCX
  • XLS/XLXS

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: 99.9% availability 8am to 6.30pm. This is backed by a comprehensive Support Service Level Agreement
• Approach to resilience: ECase is deployed on a fully resilient infrastructure with failover servers at the primary site.; ; A geographically separate datacentre provides disaster recovery capability in case of an outage to the primary site. See the eCase service definition for full information.
• Outage reporting: Public Status Dashboard combined with email alerts and service management updates provided by your dedicated customer service manager.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
• Other user authentication: IP Whitelisting can be used to ensure that eCase users can only access the service from known networks. SAML / EntraID single-sign-on can be utilised as an option, providing seamless secure login with user organisation accounts.
• Access restrictions in management interfaces and support channels: Access to management functions is restricted to user accounts with the relevant privileges as determined by the customer.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
• Description of management access authentication: IP Whitelisting allowing only specific networks to access management functions.

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We maintain a HMG IAS 1&2 compliant RMADS document set and SyOPs which implements the ISO27001 principles. This is independently reviewed by an external CLAS consultancy. An annual IT Health Check is carried out by CHECK registered Pen Test company.; ; Fivium only use UK Government approved datacentres in the UK.; ; Fivium only use UK Government approved datacentres in the UK.; Operational
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Having worked with the UK public sector for over 15 years we have a comprehensive and rigorous approach to configuration and change management based on our solid ISO27001, ISO9001 and ITIL principles. All source code is managed and version controlled and changes are linked to feature requests or service incidents. Significant changes are run through a three-step internal testing and validation process before being released to a customer test environment.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: The eCase environment is proactively enforced with a weekly vulnerability scan which automatically raises any new threats to the security manager.; ; An annual ITHC penetration test is carried out by CHECK approved third-party. Any vulnerabilities Medium or above are fixed as soon as practicable.; ; The environment is patched on a weekly basis and critical patches are released as soon as practicable.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: ECase is monitored through a series of tools and processes aligned in part with recommendations from CESG document GPG13 (Protective Monitoring for HMG ICT Systems) and, in particular, Protective Monitoring Controls (PMC 1-12). This includes checks on time sources, status of backups and others. Alerts raised are sent to our service desk for prompt investigation following our event management procedures.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Incidents can be raised by customers through the service desk via phone or email.; ; Any security incident is logged in our security incident register and raised immediately with the security manager.; A serious incident would also be escalated to a company director.; ; We provide regular updates to the customer regarding any on-going security incidents. Following the incident we provide a detailed report to the affected customers.; ; We have defined processes for common events such as account lock outs.; ; Our security policy and procedures are externally reviewed and approved.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: A free guided walk through of eCase's comprehensive service is available to public services during the Discovery and Qualififcation stage of any engagement
• Link to free trial: https://www.ecase.co.uk/talk-to-us/

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Assessment Bureau
• ISO/IEC 27001 accreditation date: Thursday 25 September 2025
• What the ISO/IEC 27001 doesn’t cover: None
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: British Assessment Bureau
• ISO 9001 accreditation date: Thursday 25 September 2025
• What the ISO 9001 doesn’t cover: None
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 05ff7730-6f88-4488-a932-49facac35470
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: A846db49-c2a9-40a3-8326-03975817ddd5
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Ensuring new workers are informed of their right to join a trade union
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at enquiries@fivium.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.