Skip to main content

Help us improve the Digital Marketplace - send your feedback

XCD HR LIMITED

XCD HR and Payroll Solution

XCD is a full suite of cloud HCM solutions, delivered as a single-solution from one database to provide full employee relationship management. Functionality includes Gross & Net (UK) Payroll, Time Management, Expenses/Compensation/Reward, Learning/Performance/Appraisals, Recruitment, and associated functions (Workflow, Reporting, BI, Automation, Document management, mobile) for HR Professionals, Managers and Employees.

Features

  • Single-solution HR and Payroll suite delivering complete Employee Relationship Management
  • Built on world-class Salesforce Lightning platform
  • Full UK net payroll for public sector and mid enterprise
  • Full support for single sign on (SSO)
  • Accessible through desktop browser or mobile
  • ATS integration through sister product and leading ATS, Hireserve
  • ERP integration for Finance, PSA, time clocking, biometrics and more
  • Full suite covering full employee lifecycle (recruit to retire)
  • Role based access for all employees
  • Rapid onboarding and implementation (90% faster than some competitor platforms)

Benefits

  • Single solution provides seamless collaboration across all functions
  • Data automation has saved customers 1000’s of hours per year
  • Global analytics dashboards allow HR function to provide strategic support
  • Powerful reporting using standard Salesforce technology
  • No re-keying of data required between HR and Payroll
  • Update personal data anywhere, any time using the mobile app
  • Modules configurable to meet organisational requirements and enable process automation
  • Manage complex and different contract terms and working hours
  • Continual service improvement underpinned by Salesforce development and innovation roadmap
  • Native Salesforce cloud app allowing anytime, anywhere access

Pricing

  • Education pricing available
  • Free trial available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at andy.bray@peoplexcd.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

4 4 8 7 4 4 9 3 2 8 4 0 8 9 2

Contact

XCD HR LIMITED Andrew Bray
Telephone: 07503 629249
Email: andy.bray@peoplexcd.com

About your service

Service categories

Applications

Enterprise resource management

  • Payroll management

Human capital management

  • Core Human Resources Applications
  • Talent Management Applications
Multi cloud support
No

Service scope

Software add-on or extension
Yes, but can also be used as a standalone service
What software services is the service an extension to
XCD Employee Relationship Management (ERM) Suite is built on the Salesforce platform. It can be run a standalone solution leveraging the Salesforce Lightning platform. As a further benefit for organisations running Salesforce.com, XCD is also compatible with existing Salesforce Customer Relationship Management, Professional Services Automation and associated applications.
Cloud deployment model
Public cloud
Service constraints
Planned maintenance will be undertaken in line with the Salesforce maintenance schedule and policy but with negligible impact to system availability or SLA performance. This includes major releases, patch releases, and daily releases.

To provide prior notice and details of any maintenance, Salesforce provides a published site maintenance calendar supplemented with email notifications and in-app notifications. Further details can be provided on request.
System requirements
  • Browser compatibility (Google Chrome or Microsoft Edge reccomended)
  • An Octane score of 20,000 (30,000 recommended)
  • Network latency of 200 ms or lower (150 ms recommended)
  • Download speed of 1 Mbps (3mps recommended)
  • At least 5GB RAM, 2GB available for browser tabs
  • 8GB Ram, 3GB available for browser tabs recommended

User support

Email or online ticketing support
Yes
Support response times
Support hours are UK Monday to Friday 09:00 to 17:30
Excludes Public Holidays.

Resolution times as follows:

Emergency: 24 Hours
Critical: 48 Hours
Normal: 5 Business days - Workaround (if available) or considered for future release.

Evidencing the quality of our support, our "fix at first touch" rate is 54%, where we have provided an immediate resolution to any query.
User can manage status and priority of support tickets
Yes
Online ticketing support accessibility
EN 301 549
Phone support
Yes
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
No
Onsite support
Yes, at extra cost
Support levels
All customers receive access to our Support Team for software issues and queries as well as a Customer Portal and case management. XCD provide the following levels of support:

Standard Support (included in software fee).

Premium Support - As per standard but with enhanced access to CSM, additional support through additional training, 3rd line support access, health checks and quarterly support review sessions (additional cost per annum - dependent on employee numbers and payrolls).

Platinum Support - As per premium but with further features including additional access to CSM, training, access to all LMS modules and monthly support review sessions (additional cost per annum - dependent on employee numbers and payrolls).
Support available to third parties
Yes

Onboarding and offboarding

Getting started
Throughout the sales cycle, we will allocate you a dedicated Business Development Manager who will get to know your teams, your processes and your strategies. They will work with the professional services team to scope the project requirements. Upon commencement of the project, our Sales and Professional Services teams will arrange a formal kick off meeting with you to ensure continuity as we move into the implementation phase.

We will walk through the outline project plan, methodology, RACI, governance and communication and outline the steps for the implementation which follow our methodology of:

1) Design
2) Configure
3) Quality Assure
4) Data Migration
5) Systems Handover and training
6) User Acceptance Testing
7) Go-live Readiness
8) Go-live Support and Handover
Service documentation
Yes
Documentation formats
  • HTML
  • ODF
  • PDF
End-of-contract data extraction
When a contract comes to an end, we will work with customers to assist them extracting any or all of their data from the XCD system in a quick, seamless and secure manner.

This will take the form of consultancy to advise customers in what tools are available to export data OR to actually extract the data on behalf of the customer. Customers will have the ability to export their data directly without support or advice using the standard Salesforce tools.

In line with the rates indicated in our pricing document, this is a chargeable consulting activity which would be scoped and estimated on an individual customer basis. This cost is not included in the ongoing cost of the contract with XCD.
End-of-contract process
If a customer issues XCD with notice that they wish to terminate the contract, we will arrange for a conference call with the customer and appoint a dedicated XCD Project Manager to work with the customers Project Manager to facilitate a smooth off-boarding process.

The Project Managers will discuss timelines for items such as "Last Transaction Date" and "Data Export Options". We will then create a Project Plan or set of agreed activities and assign resources to carry out the activities from both XCD and the customer's perspective.

Following contract termination data is retained for 30 days then permanently deleted from the platform.
Documentation accessibility standard
EN 301 549

Using the service

Web browser interface
Yes
Supported browsers
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
Application to install
Yes
Compatible operating systems
  • Android
  • IOS
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
XCD's mobile app is tailored specifically for mobile phones, and allows users to easily manage tasks including expenses, leave, authorisations and approvals, and view payslips.

In addition to this, the entire XCD application can be accessed via a tablet through the browser interface.
Service interface
Yes
User support accessibility
EN 301 549
Description of service interface
XCD has multiple methods for integrating to and from the application:

1) CSV/Flat Files - Predominantly used for data import or integrating external systems where real time interfaces are not required.
2) Reporting Outputs - Typically used where users wish to inspect the data prior to import to another system, for example General Ledger (GL) reporting to Finance.
3) Pseudo Real Time Rest API - Used for integration where Employee, Work Patterns, Leave and associated holiday data is required.
Accessibility standards
None or don’t know
Description of accessibility
Access through either:

Native files (for example CSV)
As a report output
Rest API with JSON through a third party integration tool such as Mulesoft
Accessibility testing
Accessibility testing
XCD's service interface is data only and used for integration into applications. Therefore we have not tested with assistive technology.
API
Yes
What users can and can't do using the API
The API is delivered as an extension package associated with the XCD core package.

The API is REST utilising JSON to deliver its payload.

The API covers standard functions in the XCD application relating to:
- Leave
- Payroll
- Overtime payments
- Expenses
- Timesheets
- Performance management

Users can call the API to request any information from the XCD application, or insert data into the XCD application.
API documentation
Yes
API documentation formats
PDF
API sandbox or test environment
Yes
Customisation available
Yes
Description of customisation
The XCD suite of solutions is highly customisable as it is built on the Salesforce Lightning platform.

System Administrators can customise the solution in the following ways:

-Objects and Fields
-New Screens (modify existing or build new)
-Workflows and Processes Reports
-Analytics and BI Process Builders Users
-Roles and Access.

Much of this customisation can be done by users through simple drag and drop functionality to create lightning components which help to automate HR processes.

Scaling

Independence of resources
Scalability is ensured through use of Salesforce infrastructure which handles a daily average of 6 billion transactions. Despite this, the Salesforce environment consistently maintains sub-250ms response time.

Within each logical system, we use load balancers to distribute demand among multiple web and application servers for additional scalability and redundancy. The multi-tenant application design, combined with the fastest servers and high-performance networking infrastructure available, guarantees capacity.

In addition to scaling for growth, Salesforce continually strives to improve the response time for our services. To reinforce our claims, transaction volumes and response times are reported in real-time via Salesforce's Trust Status portal.

Analytics

Service usage metrics
Yes
Metrics types
He service includes various metrics to monitor usage and adoption of the service. For example, to identify user behaviour, this includes last login and login duration.

Provides performance and availability information for the entire service, the infrastructure detail metrics are available on the Salesforce Trust platform.

For specific metric monitoring and further detail, customers can extend capability through the use of Event Monitoring. For example: Which applications are being used, by who, how they are being used, when, where from and whether there are performance issues. This data can be used to improve adoption, security and performance of the application.
Reporting types
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
Resource tagging
Yes
FOCUS resource tagging
No

Resellers

Supplier type
Not a reseller

Staff security

Staff security clearance
Other security clearance
Government security clearance
Baseline Personnel Security Standard (BPSS)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
User control over data storage and processing locations
Yes
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 4.0)
Penetration testing frequency
At least every 6 months
Penetration testing approach
‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest
  • Physical access control, complying with CSA CCM v4.0
  • Scale, obfuscating techniques, or data storage sharding
  • Other
Other data at rest protection approach
Classic Encryption: We supply the native Salesforce application feature which can be used to encrypt specific custom fields with 128-bit master keys and using the Advanced Encryption Standard algorithm. This has no additional cost but does impact some application functionality.

Platform Encryption: Platform Encryption allows customers to encrypt data stored through Salesforce such as files and attachments, certain standard and custom fields, and use an advanced key management system. It uses native strong, standards-based encryption. Controls help to protect data, including the use of derived data encryption keys and customer-controlled key rotation, generation, and destruction process. Available at additional cost.
Data sanitisation process
Yes
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
Data sanitisation type
Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

Data export approach
Users can export their data using the standard Salesforce tools or can request that XCD extract the data on their behalf.
Data export formats
CSV
Data import formats
CSV

Data-in-transit protection

Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • Other
Other protection between networks
By default, customers connect to the service over the public internet with all transmissions between the user and the Salesforce Services secured using TLS 1.2 or higher and encrypted using 256 or 128-bit encryption.

The services use International/Global Step Up SSL certificates with 2048-bit Public Keys. Web Service callouts can be secured using TLS, as well as with 2-way TLS.

In addition, customers can partner with a selection of supported ISPs for a more direct connection to the Salesforce service. In the UK, BT are one such ISP. This service is known as Salesforce Express Connect.
Data protection within supplier network
  • IPsec or TLS VPN gateway
  • Other
Other protection within supplier network
Customer data is protected within the Salesforce service through a mature, standards-based defence in-depth security architecture.

Logical and physical access is strictly controlled and monitored. The controls used are in-scope for our various security certifications (and those commonly required by our clients) and audited regularly by third parties.

Controls such as firewalls, intrusion detection, anti-malware, file integrity monitoring are augmented with extensive monitoring to provide robust prevention, detection and response. The service is subject to internal, external and third-party vulnerability scanning and application penetration testing.

Availability and resilience

Guaranteed availability
Being based on Salesforce Services, our platform is inherently designed with the concept of continuous improvement and Trust (such as Availability, Performance and Security) in the infrastructure. Our use of Salesforce ensures we benefit from their investments to make on-demand services available to its customers 24/7, except for (minimal) planned downtime, for which Salesforce gives customers prior notice, and force majeure events.

Excellent availability statistics (historically 99.9%) are critical to Salesforce's customers’ success and to the performance of Salesforce as a leading global cloud-based software provider. Live and historical statistics on Salesforce system performance are publicly shared on the Trust and further detail can be shared upon request and signature of an NDA.
Approach to resilience
To maximise availability, the service is delivered using a world-class data centre infrastructure consisting of a primary production data centre, a full capacity secondary data centre for hosting the service provided to customers.

The infrastructure utilises carrier-class components designed to support millions of users. Extensive use of high availability servers and network technologies, and a carrier-neutral network strategy, help to minimise the risk of single points of failure. This also provides a highly resilient environment with maximum uptime and performance.

Further details available on request.
Outage reporting
Our service provides access to live and real-time outages information via public portal and via email alerts, using Salesforce's Trust Status site.

With the goal of rapidly restoring services during any outages, we utilise Salesforce's Escalation policies which are established and maintained. In the event of an extended outage, periodic updates are provided in near real-time to customers via the Trust dashboard site. In addition, service notifications are provided to nominated contacts via various channels such as email.

Update frequency for notifications is dependent on the customer support service plan selected by our customer (as detailed in our pricing).

Identity and authentication

User authentication needed
Yes
User authentication
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
Other user authentication
Using the base application of Salesforce, we can offer a comprehensive range of authentication mechanisms that customers can choose from. These include:

-The inherent username and password option
-Single Sign-On (SSO)
-Social Sign-On through another application, such as google
-Integration with a customer's existing identity management systems
-2-Factor Authentication

The application can also act as a Service Provider or Identity Provider for SSO integration using Security Assertion Markup Language (SAML).
Access restrictions in management interfaces and support channels
Management access for service support and delivery is offered through multiple layers of controls including, but not limited to:

-Multiple 2 factor authentication
-Bastion host and proxy control
-Segregation of duties

These controls are in scope for SSAE-18 auditing and evidences through the SOC 2/ISAE3402 report.

Access to the management interface for the customer to configure their salesforce environment is configured by the customer themselves. The options are outlined in the above response. Robust application design and testing ensures that users without administrative access rights cannot access more sensitive areas of the application.
Access restriction testing frequency
At least every 6 months
Management access authentication
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
  • Other
Description of management access authentication
We can offer customers a comprehensive set of authentication mechanisms.

These include:
-The inherent username and password option
-Single Sign-On (SSO)
-Social Sign-On through another application, such as google
-Integration with a customer's existing identity management systems
-2 Factor Authentication

The application can also act as a Service Provider or Identity Provider for SSO integration using Security Assertion Markup Language (SAML).

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
User-defined
Access to supplier activity audit information
Users have access to real-time audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
At least 12 months

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
ISO/IEC 27001
Information security policies and processes
We have a robust information security policy and set of defined processes which are externally audited.

These include:
-All locations protected against cyber attack through physical and internet access controls.
-Secure by design hardware and infrastructure with up to date patching policies.
-Defined policies for the storage and retention of sensitive and PII data Incident and breach management process.
-Training and Awareness for all staff and customers.

Evidencing the robustness of our policies which are externally audited, we annually maintain our Cyber Essentials and ISO27001 certifications.
Software Security Code of Practice
Yes

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Nfrastructure and Policy change management is undertaken by our Executive Team. Development change management is covered in our Software Development Lifecycle and enacted through specification, tooling and release management processes.

The client environment uses a change management object where changes to the organisation are recorded and agreed with the client. To assess security impacts, we have tooling to audit changes to the environment on request or prior to release.

For client issues and requests, we use Case Management where each request is stored, communicated and documented. Our Project Manager will oversee Change Management implementation by maintaining a project log.
Vulnerability management type
Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
Vulnerability management approach
Through Salesforce, our service deploys various vulnerability management and threat detection processes including internal scanning, external scanning and vendor patch release management.

Technical operations and security personnel monitor vulnerability alerts and patch release notifications from vendors and other sources. There are associated evaluation and deployment processes in place. Salesforce also regularly performs self-vulnerability assessments using various tools and techniques, such as Qualys.

In addition, Salesforce uses external service providers to perform an application vulnerability assessment after each major release (3 times annually) and network vulnerability assessments quarterly. There is also an on-going external application scanning service used.
Protective monitoring type
Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
Protective monitoring approach
Our service benefits from Salesforce's Computer Security Incident Response Team (CSIRT)'s security event logging and management system to manage the alerts and logs generated by devices on our network and provide protective monitoring. The system consists of a central database, management server and distributed agents.

The distributed agents receive events from network devices and systems (firewalls, IDS, routers, switches, hosts, file integrity, and database monitoring) on the network, then compress, encrypt, and transmit the data to the management server and database for processing. Correlated events are configured to generate alerts and logs which are monitored on a 24/7 basis.
Incident management type
Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
Incident management approach
We utilise Salesforce's formal Incident Management Process which guides the Salesforce Computer Security Incident Response Team in investigation, management, communication, and resolution activities.

Salesforce will promptly notify the customer in the event of any security breach of the Service resulting in an actual or reasonably suspected unauthorised disclosure of Customer Data. Notification may include phone contact by Salesforce support, email to customer's administrator and Security Contact and public posting on the Trust portal.

Salesforce.com is a member of the prestigious Forum of Incident Response and Security Teams (FIRST) and complies with the FIRST framework and best practices for incident response.
Post-quantum cryptography secure
Yes

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks
No

Pricing

Discount for educational organisations
Yes
Free trial available
Yes
Description of free trial
On request, we offer a free 30-day access to a demo environment.

Discount percentage by annual call-off contract value (excluding VAT)

Less than £250,000
0%
Between £250,000 and £500,000
0%
Between £500,001 and £1,000,000
0%
Between £1,000,001 and £2,500,000
0%
Between £2,500,001 and £5,000,000
0%
Over £5,000,001
0%

Non-mandatory Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
Alcumus ISOQAR
ISO/IEC 27001 accreditation date
Thursday 1 May 2025
What the ISO/IEC 27001 doesn’t cover
Nothing not covered by certification.
ISO 28000:2022 certification
No
ISO 9001 certification
No
Quality management systems (QMS)
Yes
CSA STAR certification
No
PCI certification
No
Cyber essentials
Yes
Please provide your Cyber Essentials Certificate Number
B974819e-187e-4c4a-ab11-b7ab40505052
Cyber essentials plus
No
Cyber Essentials Alternative
None of the criteria
Other security certifications
No

Social value

Section B - Commitment for Future: Delivery
  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain
  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Introducing transparency to pay and reward processes
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition
  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at andy.bray@peoplexcd.com. Tell them what format you need. It will help if you say what assistive technology you use.