IDOX SOFTWARE LTD

Directory Connect

Directory Connect is a customisable directory and website platform that helps residents and professionals find local services, support and information. It can be a single directory (e.g. Family Information Service, SEND Local Offer, Public Health, Adult Social Care, Social Prescribing etc) or can bring together multiple directories into one place.

Features

• Directory of services: User-friendly hub for accessing support and information
• Powerful search: Customisable algorithm and filters for better results
• Admin area: Easy for partner organisations to maintain service data
• Flexible permissions: Control content with approval steps and access levels
• Traffic light notifications: Easily track data freshness with clear indicators
• Open API: Interoperability with third-party platforms and data feeds
• Light touch referrals: Frictionless in-platform or external service referrals
• Landing pages: create theme or directorate-specific areas of the platform
• Accessibility: WCAG2.2 compliant, localised design and mobile device responsive
• Host multiple directories in one place

Benefits

• Consolidate data: single source of truth for service, support, I&G
• Quality service data: Up-to-date, quality approved information for residents
• Fulfilling obligations: Host statutory guidance including FIS and SEND
• Devolved responsibility: co-design and collaborative platform
• Reduce number of websites: Host multiple directories on one platform
• Collaborative community: Exchange ideas and update within our community
• Stakeholder engagement: Community input and collaboration for better service
• Accessibility: WCAG 2.1 compliant for high accessibility
• Interoperable data: for sharing with other platforms and neighbouring authorities

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@idoxgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

429578778739026

Contact

Jen.roberts@idoxgroup.com
0333 011 1200
bidteam@idoxgroup.com

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Healthcare
  • Education
  • Adult Social Care
  • Children's Social Care
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Idox Open Objects Datastore Platform
• Cloud deployment model: Private cloud
• Service constraints: No
• System requirements:
  • A modern web browser
  • An internet connected device

User support

• Email or online ticketing support: Yes
• Support response times: According to our SLA for support which is available on request/during the G-Cloud clarifications stage.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 A
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.2 A
• Web chat accessibility testing: None to date.
• Onsite support: Yes, at extra cost
• Support levels: According to our SLA for support which is available on request/during the G-Cloud clarifications stage.
• Support available to third parties: Yes
• AI chatbot: No

Onboarding and offboarding

• Getting started: Our deployment service delivers a localised instance of the Directory Connect platform within a locality. We work closely with our clients to co-design a version of the platform that stands the best chances of local adoption from stakeholders and residents. Our recommended deployment process goes through six main stages:; ; 1. PMO; 2. Discovery & co-design; 3. Localisation of platform; 4. Technical configuration, deployment and data migration; 5. Training; 6. Support and maintenance; ; Our delivery team will work closely with you to define a project plan that will support the process.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: Direct API connection,CSV export or encrypted MySQL data dump.
• End-of-contract process: * Date for termination is agreed; * A full encrypted data backup is taken; * Infrastructure is decommissioned; * Any third-party services are decommissioned / cancelled; * Any remaining elements or accounts, such as domain names are transferred to the client
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: N/A

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: None
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: The interface is accessed via a web browser
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Third party testing, customer testing, internal testing
• API: Yes
• What users can and can't do using the API: Our Open API allows any authenticated user to Create, Read, Update or Delete (CRUD) any entity to which they have access to. This includes but is not limited to updating service listing, making referrals and performing searches.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Each deployment can have their own "look and feel" design and include custom branding, name and logo. Our platform is built with design tokens can we can tweak colours, typography, spacing, illustration and more per locality.; ; Configuration options on the backend to allow for custom categories, taxonomies, filtering and full control over user accounts and all content within the platform - including organisations, services, locations, events and information pages.

Scaling

• Independence of resources: Managed instances are hosted within AWS and make use of auto-scaling technology. We have proactive monitoring on infrastructure to identify demand.

Analytics

• Service usage metrics: Yes
• Metrics types: * All activity is audit logged and searchable; * Built in reporting for basic; * More advanced reporting available via our Directory Insight product (inc search data, unmet need, greater data quality reporting, etc); * Stale data management; * Referral metrics; * Integration with web analytic providers such as Google Analytics; ; Any specific reporting requirements can be discussed and catered for.
• Reporting types: Real-time dashboards
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: API Connection, CSV export or via our Directory Insight dashboard
• Data export formats:
  • CSV
  • Other
• Other data export formats: JSON
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: All platform data is stored within the UK under an ISO 27001:2022 certified cloud supplier (AWS). We use encryption, network security and user access controls to protect data. ; ; Access to any data via the Admin area is protected through granular role-based access control, enforced 2FA and detailed audit logs on all actions taken by users on all data entities stored within the platform.; ; Data is encrypted at various levels - at rest within our database, in transit when being sent to and from our servers, and at field level (for referrals) with real-time decryption only upon authorised access.

Availability and resilience

• Guaranteed availability: We offer a base uptime guarantee of 99.5% measured by industry standard monitoring systems.
• Approach to resilience: Cloud hosted in AWS. Redundancy across application tiers and our application is spread across multiple regions.
• Outage reporting: Outage is reported via emails direct to relevant team members. We also maintain a public status dashboard and uptime monitoring system.

Identity and authentication

• User authentication needed: No
• Access restrictions in management interfaces and support channels: Management access to the platform is restricted and authenticated via username, password and 2FA. Role based permissions are used and all actions are audit logged.
• Access restriction testing frequency: At least once a year
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: ISO27001 accredited Information Security Management System of Idox Software Ltd. ; This ISMS covers all business functions including but not limited to, information systems, networks, physical environment, incident/threat management, project & contract management and personnel management. Information security awareness training is conducted to ensure policies are communicated and ongoing annual internal reviews and auditing is conducted to ensure processes are followed. The system and controls are also externally verified and certified annually as part of the ISO 27001 certification process. Risks raised through internal and external audits are reviewed at management meetings by the information security manager, the appropriate head of business and a board representative.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: We employ a change management process, ensuring planned changes are implemented with the minimum of risk and disruption. We work with clients who have internal change control processes and can follow any specific workflows.; ; Development work on the product is version controlled using Git, peer reviewed and subject to automated and manual QA process.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: We monitor OWASP and various vendor alert sources for emerging vulnerability intelligence and patching data. A combination of web application scanning, host vulnerability scanning, and external perimeter proactively identifies any design, configuration, or patching weaknesses. When identified, any threats are assessed in context and where warranted, mitigations are implemented in accordance with their severity. These controls and processes are monitored as part of our ongoing ISMS/ISO27001 auditing programme.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Monitoring tools are used to measure server performance metrics as well as storage and network/bandwidth utilisation and unusual server/network/perimeter activity. The alerts from these systems are actively monitored and reviewed and any potential intrusion attempt is raised in line with our security incident reporting procedure for further investigation.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Managed through our support desk, via email or phone. We log, managed and review all issues to inform and improve our procedures and product. Post mortems are carried out where necessary and reports communicated to clients.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Citation ISO Certification Limited
• ISO/IEC 27001 accreditation date: Monday 27 May 2024
• What the ISO/IEC 27001 doesn’t cover: Our ISMS is certified and tested to ISO27001 standards annually and covers our entire organisation.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Citation ISO Certification Limited
• ISO 9001 accreditation date: Thursday 11 April 2024
• What the ISO 9001 doesn’t cover: Our ISMS is certified and tested to ISO9001standards annually and covers our entire organisation.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 5c6de739-c45d-4eee-916a-013a0c2ce8f7
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 26018f8f-da19-4856-8fd2-b719e0c21047
• Other security certifications: Yes
• Any other security certifications: ISO 22301

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@idoxgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.