BASWARE HOLDINGS LIMITED

Basware Procurement

Basware Procurement cuts spending costs by capturing requisitions/purchase orders for goods. It consists of the following services:
Marketplace - for shopping goods and services and managing catalogue content, Purchase - for cost approval and purchase order management and e-Orders for Buyers - for purchase order sending and supplier collaboration.

Features

• Amazon-like shopping experience for ordering goods and services
• Ability to raise PO's using PO/invoice approval on mobile devices
• Straight through processing of invoices where PO has been raised
• Comprehensive audit reports for full P2P process
• Processing non-PO invoices, such as utilities and unsupported POs
• Hosted and punch out catalogues, and free text NCRs
• Simple receipting and available on mobile device

Benefits

• Capture all purchase transactions through Amazon like user experience
• Free up AP/finance staff through touchless processing of invoices
• Approval of unsupported invoices and invoicing where no PO required
• Improved cash-flow for buyers and suppliers
• Approval of PO's or invoices on mobile devices
• Complete visibility of requisitions, PO's, receipts and invoices
• Contract compliance using hosted or punch out catalogues

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at paul.newman@basware.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

454044914140617

Contact

Paul Newman
0845 603 2885
paul.newman@basware.com

About your service

• Service categories:

  Applications

  Enterprise resource management

  • Procurement
  • Order management and orchestration

  Financial

  • Financial and Accounting Applications
  • Accounts Payable Applications
  • Accounts Receivable Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes
• What software services is the service an extension to: Basware Procurement is an Add on service to Basware AP automation.
• Cloud deployment model: Public cloud
• Service constraints: Basware uses a continuous development methodology, with an automated delivery pipeline, to continuously release small updates with low associated risk. There are two different update types: monthly updates and maintenance updates. The monthly update is used to deliver the vast majority of new features, enhancements, and bug fixes and are typically applied in maintenance periods, maintenance updates are applied on a on demand basis and users are normally unaware that an update has is being applied. Typically more than two-thirds of updates are carried out without service downtime.
• System requirements:
  • User access via a supported browser (TLS 1.2 or higher)
  • Accessed via internet or a direct point to point connection

User support

• Email or online ticketing support: Yes
• Support response times: Basware maintains internal Service Level Objectives (SLOs) to help measure the performance of our Customer Support response and resolution time. These objectives are reviewed regularly and available upon request. Basware has a target response time of 1 hour for all case priorities. Case Response Times are measured and monitored using Basware's Customer Support Portal.; Critical Respond 1 h Resolve 10 h; High Respond 1 h Resolve 20 h; Medium Respond 1 h Resolve 100 h; Low Respond 1 h Resolve 200 h
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: ServiceNow test the accessibility of their products using the assistive technologies JAWS, NVDA, and VoiceOver.
• Onsite support: Yes, at extra cost
• Support levels: Basware Global Support model is aligned with ITIL (IT Infrastructure Library). Support is available during local business hours.24/7 support can be provided as an option. The Service Desk provides advice and assistance about: • Operational use and service requests related to the software or service • Suspected incidents and problems. This is underpinned by Service Level agreements. There are 3 levels of support designed for different types of organisation, with SaaS 2 offered as the service level for G-Cloud customers. Key elements of the service such as service updates, data security, Single Sign On, Maintenance, Business Continuity and Disaster Recovery are commonly covered.
• Support available to third parties: Yes
• AI chatbot: No

Onboarding and offboarding

• Getting started: Rapid delivery of value for our customers is a key element of the Basware offering and the on-boarding of both users and suppliers will be key. The implementation of the Basware solution will identify what are the key deliverables for the organisation and then focus the implementation on achieving these aims. Rapid design and build of the solution will then lead on to ensuring users both finance/AP and operational can be onboarded as effortlessly and quickly as possible. Training approaches will be dependent on the needs of each customer, but train the trainer and training documentation are always utilised during the implementation. Supplier on-boarding should not be ignored and the Basware invoice processing solution, when used with Basware eInvoice will allow suppliers many options for submitting invoices to our customers, thus ensuring that suppliers are onboarded quickly and with minimal resources.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: As it is an entirely managed service it is simply a matter of ceasing access to the service and ensuring that all client owned information is returned to them. This is part of the service provided. If the service is terminated then all business documents and associated metadata held within the Customer's systems can be exported using the application's export functionality by the Customer. Metadata will be in human readable format.
• End-of-contract process: On completion of the call off, we can simply cease the services and the processes for doing so are clearly articulated within the arrangement. As it is an entirely managed service it is simply a matter of ceasing access to the service and ensuring that all client owned information is returned to them. All confidentialities relating to the services are maintained indefinitely as part of the arrangement.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Application optimised to work with mobile devices using HMTL5. Only for AP Clerks and Buyers a larger screen would be required.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: The service interface is accessible either via direct login. The service interface provides access to both the procurement and system administration tools. The system functionality available to each user is determined by their role. The role for each user is determined by the system administrators.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Internal testing using tools to verify the level of compliance with WCAG standards.
• API: Yes
• What users can and can't do using the API: There are two principle APIs for the service:; 1) Punch-out API. This is an API that enables customers to access the system from their own ERP/P2P system. It supports industry standard punch-out mechanisms including cXML, Oracle OAG XML and OCI. Once they have accessed the system, the users are able to undertake various activities on the platform based upon their user role.; 2) Transaction Engine API. The transaction engine is a sophisticated and proven middleware platform that enables integration between customer and supplier systems for the transmission and receipt of transaction documents such as purchase orders and invoices. The transaction engine supports a wide variety of options and can be configured to interface with virtually any end system using various API types.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: The hosted service works in such a way that it has no capacity issues in respect of the content and transactions managed within the service. The hosted network is running at approximately 20% capacity at peak times, accommodating even the largest spikes in traffic. As network utilisation reaches 30% more network capacity will be added to ensure that customers never experience network degradation, even if one of the providers has an outage. Current bandwidth capacity is 6.3 Gbps. The environment is proactively supported by a 24/7/365 dedicated support team ensuring it is not affected by the demands of other customers.

Analytics

• Service usage metrics: Yes
• Metrics types: Operational Metrics - AP KPI – Overview dashboard provides information on 4 strategic key performance indicators (KPI):; - E-invoice Rate – indicates the % of all invoices which are electronic; - Spend under control – invoices based on PO or payment plan (Contract) Automatically matched; - Paid on time – % of invoices which are paid on or before the designated due date; - Performance trend - The dashboard also has the trend of each specific strategic KPI as well as the breakdown of each strategic KPI in bar charts
• Reporting types:
  • Real-time dashboards
  • Regular reports
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: The service can be scheduled to export data and image files on a regular basis. Documents can be bulk uploaded in XLS, XML and CSV formats. Basware can support virtually any structured data format.The service will export individual transactions either grouped into a batch or as separate invoice sets (content, image & attachments). The latter is the more common method of transfer. These can be Zipped and signed as required.
• Data export formats:
  • CSV
  • Other
• Other data export formats: XML
• Data import formats:
  • CSV
  • Other
• Other data import formats: XML

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Basware consistently operates the Basware service to meet a target level of 99.9% of time during a combination of core and non-core hours (97.5% during the first month of service or following a major release). Further information included in Service Definition document. This is underpinned by our Service Level Agreements which provide for Uptime performance of 99%/99.5%.
• Approach to resilience: Available on request
• Outage reporting: Outages would be reported via email alerts. Scheduled Maintenance Windows Scheduled maintenance windows are required to allow for security updates, application upgrades and patching, addition of new hardware, etc. Basware reserves the right to specify the times of scheduled maintenance windows which will be targeted to be outside the hosting location's typical business working hours in order to keep the service interruption time for endusers close to zero. The scheduled maintenance windows may take place with 5 days notice. A maximum of two maintenance windows will be used in any month. During the maintenance window users will be informed of the unavailability of the service. For SaaS Three Customers only the notice period is extended to 10 days. Basware Analytics maintenance may take place with 5 days notice. A maximum of two maintenance windows will be used in any month. During the maintenance window users will be informed of the unavailability of the service. Unscheduled Maintenance Windows: If unscheduled maintenance windows are required then 48 hours notice will be provided. If emergency repairs or updates are required, for example to apply security patches, then if the urgency is low enough 24 hours notice will be provided.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Public key authentication (including by TLS client certificate)
  • Username or password
• Access restrictions in management interfaces and support channels: Basware has documented logical access controls, for requesting and granting access rights to production systems and applications. Access is on a role-based model, approved by management. Access rights are removed from operating systems and applications immediately after termination/transfer of employment and specific notification from HR or supervisors. Access profiles defining roles based on user job functions are documented and used to restrict access. These follow the principle of least privilege. Root, Administrator and other privileged operating system level access to production system is restricted to authorised individuals. Operating system and applications are configured to enforce minimum requirements for password quality/expiration.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Public key authentication (including by TLS client certificate)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: ISAE 3402
• Information security policies and processes: Basware Information Security Policy describes the practices through which Basware assures its existing and future customers, partners and employees that their information is securely handled, stored and processed. The Information Security Policy target is to comply with the ISO 27001 standards. The minimum target is to comply at all times with the local legal requirements. Within the organisation, the Chief Financial Officer is responsible for the main policies concerning security, for its strategic steering and monitoring, and for the allocation of sufficient resources. In addition, Security Steering Group coordinates the overall security. Security Steering Group is chaired by the CFO.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: The Basware solution has been built to be managed by our customers and configuration changes would typically be carried out by the customer organisation. Basware's software as a service offering does not work on the approach that our customers are buying services from us for configuration changes. If Basware is required to make changes then a formal and documented change management process must be followed. Configuration changes are documented as change request tickets.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Systems are scanned for vulnerabilities at regular intervals. Customer production systems are scanned weekly. Customer and internal IT production systems are scanned internally with privileged system credentials for: hard-to-find vulnerabilities and configuration errors, installed software patches, and system configuration compliance against applicable benchmark standards. Risks are recorded in a risk register. The risk assessment includes business impact assessment, threat assessment, and vulnerability assessment. Risk management includes risk mitigation actions, risk avoidance, risk transfer, and risk acceptance in full or in part. Risk mitigation may include preventive, reactive, and corrective actions. Reactive and corrective actions are triggered by risk realisation.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: If production systems and business applications generate security events, for example both successful and failed instances of user logon and logoff, changes in privileges, such as user and access management, software changes and removal, system and application configuration changes, and significant system events. Create, read, update, and delete access on customer data is monitored. Exceptional access (outside of standard data flow) generates security events. Security events are transferred to a secure monitoring system as soon as events are generated and buffered locally to prevent event loss in case of break in communications with the secure monitoring system.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Production environments are monitored for incidents and failures and incident tickets are opened for anomalies. Monitoring includes internal and external performance. Production environment activity is monitored by reviewing most common system and application log events in weekly meetings. Event logs are collected and stored. A service level agreement (SLA) for service availability and performance is in place. Performance against the SLA is monitored, measured and reported to customers on a monthly basis including statistics on incident management.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: A806870b-ae18-413f-a6e9-4899090dd958
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: Bdfe7d2a-1287-4a83-9890-1c4cf6250aff
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Collection of the views and expertise of disabled people and their representative organisations on successfully supporting disabled employees or applicants
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Offering a range of quality opportunities with routes of progression if appropriate, e.g. T Level industry placements, students supported into higher level apprenticeships.
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Other measures to provide equality of opportunity for disabled people and those with health conditions into employment, including becoming a Disability Confident employer and inclusion of supported businesses in the contract supply chain
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at paul.newman@basware.com. Tell them what format you need. It will help if you say what assistive technology you use.