Valerann UK Ltd

Transportation data analytics

Lanternn by ValerannTM, our remotely deployed SaaS ITS platform, uses a Fusion Engine to aggregate, cleanse, and fuse data inputs from virtually any source on the road. The fusion engine provides predictive insights and prioritises incidents for Operators so that resource can be deployed as necessary.

Features

• Incident detection/location/verification of on-road events for reduced response time
• Monitoring/control of real-time traffic flow and congestion, minimising disruption
• Risk profiling/prevention including through highways maintenance/roadworks
• Weather impact/winter maintenance operations
• Congestion/emissions analysis including alerts on air quality
• Identification of asset maintenance needs, execution and resources
• Connect to patrol vehicles/emergency services/recommended response workflows
• Communicate with drivers and ITS infrastructure, and other agencies
• To analyse/track current and historical performance/KPIs

Benefits

• Operators can reduce OPEX/CAPEX expenditure
• Remote deployment saves time/money over traditional deployments
• AI streamlines processes to free up resource
• Use insights to deploy resource to highest priority incidents
• System has track record of reducing fatal road accidents
• Helps Operators to derive more value from their data
• System scale to as many roads/data sources as desired
• Provides real-time access to road status, facilitating quicker decision making

£50,000 to £200,000 a licence a year

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at john.fagan@valerann.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

424099906196049

Contact

John Fagan
<removed>
john.fagan@valerann.com

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Any operator's IT, ITS, or asset management system
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
• Service constraints: No - Our product is hardware agnostic (we will integrate with any pre-installed or new ITS equipment e.g. any CCTV camera, radar loop or sensor). However, integration/development effort may be required where the equipment is unfamiliar to us.
• System requirements:
  • Product is cloud-based, so requires a modern web browser (Chrome).
  • Appropriate data integration mechanisms required
  • Setup of a secure redundant VPN (if necessary)

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: 9 to 5 (UK time), 7 days a week
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), 7 days a week
• Web chat support: No
• Onsite support: Onsite support
• Support levels: We meet the following SLAs, categorised into four levels of severity, all of which are included in our standard cost. Additional support can be discussed and negotiated to an agreed upon price between the client and Valerann. Our Service Desk is available through our Jira Incident Portal which is reviewed daily. We respond in under 24 hrs to urgent queries and perform regular, proactive check-ins. We can provide monthly incident reports via dashboard, as well as in-depth analytics, trend analysis, and SLA performance forecasting. ; ; SLA: Severity 1 & 2 Incidents (Cat 1 & 2). LbV provides automatic alerts via Grafana, OpsGenie; automatic relay via SMS, Email, Slack, Teams, or Pingdom. Immediate action protocols; 24 hrs resolution for Level 1, 48hrs for level 2; ; SLA: Severity 3 Incidents (Cat 3). LbV provides automatic alerts as above, plus manual review at daily system status update. 3 working days’ resolution target; must be resolved within 5 working days; regular updates provided to client.; ; SLA: Severity 4 Incidents (Cat 4+). LbV provides as above. 2 weeks’ resolution target; must be resolved within 1 month; regular updates provided to client.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: We provide system users and operators with training as LbV is developed and deployed. This training process will include virtual or onsite sessions depending on customer preference. Throughout this process, Valerann will elicit feedback from users to further tune and configure system features to ensure accurate detection and operation, improve the user experience, and meet any additional needs not previously provided. Users will also be provided with a User Manual; however, Valerann’s team can also be contacted about any issues, concerns or needs. We will make ourselves available through project deployment, especially during the initial use stages, to ensure comfortability and access to the system.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Migration plans will be agreed upon between Valerann and the client. All data will be migrated either to the client’s full custody on the existing cloud or transferred to an alternative cloud provider. At all times, the client will retain full governance and ownership of its proprietary data. This data will never be used by Valerann for any purposes other than fulfilment of its contract. The data will be stored in accordance with both organisations’ Data Security policies, precluding access by unapproved agents.
• End-of-contract process: At contract end, Valerann will devise a handover plan and work closely with the customer’s chosen provider to ensure that all documentation, data, and “know how” are carried over. Valerann will project manage handover to ensure a seamless transition for the customer and its users. If Valerann is required to delete or store data, it will carefully comply with the law and customer’s requirements. Valerann will provide “after care”, i.e. making its Customer Success Manager available for 3 months post-contract end to answer any questions and assist the customer and incumbent with getting up and running.

Using the service

• Web browser interface: Yes
• Supported browsers: Chrome
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • MacOS
  • Windows
  • Other
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: We have a mobile version that supports a reduced feature set for patrol vehicle drivers to log incidents they identify directly or to view incidents they have been allocated to in order to respond.
• Service interface: No
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: Through API integration, LbV can serve as the front end for users by ingesting data sources and fusing the data for display and insights through the provided dashboard. It is also possible for LbV to serve as the back end data fusion engine if a separate front end dashboard is preferred. Users are able to access LbV’s data insights through API to integrate with any external systems for further data ingestion or data sharing. Our API includes a detailed SWAGGER interface that provides the application developers an easy and intuitive way to discover the system's capabilities, try them out, and explore the various options to access the data.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
  • PDF
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: Customers can customise the data sources used, the way data is presented on the dashboard, how many users have access, what permissions each user has, types of reporting provided in Grafana, level of automation, use of Machine Vision, level of camera integration, and which of the Lanternn modules to implement (Manage, Monitor, Insights).

Scaling

• Independence of resources: We load test all services for current users, i.e. we simulate and measure peak concurrent usage performance. All clients are segmented off into their own cloud infrastructure.

Analytics

• Service usage metrics: Yes
• Metrics types: User-specific monitoring/reporting; Latency monitoring; Event-specific insights; Event trends; System service metrics (e.g. uptime %); ; We utilise UX monitoring tools, such as Hotjar, to monitor user sessions and interactions. All data captured is anonymised i.e. we cannot link specific sessions to specific users. We maintain an audit trail of key actions carried out within the system (e.g. changing an event status) including the user that carried this out in order to support management reporting.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Staff screening not performed
• Government security clearance: Up to Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: We work with users to configure data export mechanisms. They are able to view data through the dashboard as well as through customised reporting which allows for CSV export of specified data outputs.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)

Availability and resilience

• Guaranteed availability: System availability of the hosting, network infrastructure, communications network and Hosting Centre is designed to be seven days per week and twenty-four hours per day, subject to the prenotification of any scheduled downtime required for system maintenance. Outside of the scheduled downtimes outlined above, the Performance Target is for the system to be available 99.8% of the time measured over a period of one month.
• Approach to resilience: We are hosted by AWS who are certified for resilience and have verified that we have resilient infrastructure. The main plank of our resilience strategy is replicating our databases across three regions using managed services such as Kafka, Postgres, etc.
• Outage reporting: In the event of a service outage, our alert systems immediately notify us. Our team responds as quickly as possible to resolve the issue and avoid disruption. If the outage is extended for any reason, users will be notified as we continue attempts to resolve the issue.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: We utilise a role and permission model, meaning some users have restricted access (read only) or may only be able to carry out certain actions within the system based on their user role.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
• Description of management access authentication: Username + Password, Whitelist IP addresses. Optional: identity federation from known providers (Google, Facebook), Optional: VPN, Optional: 2 factor

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Institute of Quality & Control
• ISO/IEC 27001 accreditation date: 28/12/2022
• What the ISO/IEC 27001 doesn’t cover: Officially known as the ISO/IEC 27001 Information Security Management standard, it details the requirements for businesses to securely manage information assets and data to an internationally recognised standard. It provides a robust approach for managing assets such as customer and employee details, intellectual property, financial information and third-party data. ISO 27001 requires that organisations assess information security risks, put in place robust security controls and processes, and embed information security management across the organisation. The standard is suitable for all organisations that collect and process data – including SME, corporate and non-profit businesses.
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber essentials plus: No
• Other security certifications: Yes
• Any other security certifications: ISO 27017

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: ISO 27017
• Information security policies and processes: Valerann takes the security and privacy of data extremely seriously. We intend to comply with our legal obligations in respect of data privacy and security under the General Data Protection Regulations (GDPR). We follow our Data Management and Information Security Policies. Information Security is overseen by our Chief Information Security Officer, Ran Katzir, with support from our Chief Operational Officer, Danial Yakovich. Every Valerann device has MDM installed to ensure remote security management. Annual training on information security is provided to all staff and enforced via Valerann’s Disciplinary Procedure.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We are using numerous microservices and databases. Every change involves automatic tool scanning for quality and security. Changes are logged and tracked and reported automatically. Every change is peer reviewed and QA tested approved.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Automatic scanning upon every software change using industry recognised tools. Migration and patching as part of the standard on going delivery process (sprints prioritisation and backlog management).
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We identify compromises through investigating of dashboard and logs when an anomalous behaviour / alert is detected.
• Incident management type: Supplier-defined controls
• Incident management approach: Employees report to IT+CTO. All employees are notified immediately on both Slack/Email. Incident / Retro reports are provided internally for major events.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks: Other
• Other public sector networks: Any

Social Value

• Social Value:

  Social Value

  Fighting climate change

  Fighting climate change

  We use a SaaS model so a traditional construction-led physical infrastructure is not required. The carbon footprint for deploying Lanternn is minimal. The platform also helps roads to operate more efficiently, resulting in improved traffic flow which reduces emissions.

Pricing

• Price: £50,000 to £200,000 a licence a year
• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: We offer pilots negotiated and tailored to meet client requirements

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at john.fagan@valerann.com. Tell them what format you need. It will help if you say what assistive technology you use.