WORLDLINE IT SERVICES UK LIMITED

Trusted Electronic Monitoring

Centralised and unified application for managing the entire application chain required for electronic monitoring: implementation, logistics management, monitoring of offenders (alarm management), control (statistics and centralised monitoring)

Features

• Case Management: Centralises data for individuals under judicial monitoring (offender)
• Real-Time Alarm Processing: Monitors and manages alerts from electronic devices
• Integrated Telephony System: Allows direct calls to individuals and agents
• Equipment Logistics Management: Manages hardware ordering, stock levels, and returns.
• Configurable Scheduling: Defines individual schedules with rules for authorisations.
• GPS Movement Tracking: Provides live and historical location data
• Advanced Role-Based Access: Granular permission system controlling actions and visibility.
• Supervisory Dashboards: Offers real-time statistics and key performance indicators.
• Automated Report Generation: Creates customisable official documents and statistical reports.
• Secure Data Handling: Ensures data is protected with strong encryption.

Benefits

• Centralise all case information for quick and easy access.
• Reduce administrative workload by automating official report generation.
• Improve human decision-making with access to historical case data.
• Respond immediately to critical alerts for faster, effective intervention.
• Streamline communication by calling directly from the application.
• Simplify equipment management from ordering to stock monitoring.
• Easily create and enforce complex individual monitoring schedules.
• Verify compliance by tracking individuals movements in real-time.
• Gain instant insights into caseloads with supervisory dashboards.
• Securely control user access based on specific job roles.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at WLopportunities@worldline.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

485187263947127

Contact

Christine Best
+447812325539
WLopportunities@worldline.com

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Public Order and Safety
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: The solution does not include the supply of electronic bracelets. We do not handle logistics services (stock management, shipping to management centers, or related operations). ; ; Buyers should plan hardware procurement and logistics separately. ; Our offering is hardware-agnostic and can interface with any equipment or logistics suppliers via open APIs to complete the solution.
• System requirements:
  • “Statistics” module requires “Tableau” licenses (which we can propose extra).
  • Oracle database license may be requested (depending on security requirements)
  • Geocoding service required to translate coordinates to addresses (and back).

User support

• Email or online ticketing support: Yes, at extra cost
• Support response times: Worldline provides a native First Line Support (FLS) that responds immediately to production issues. An optional Level 2 support team can be added as needed.; Worldline is also flexible to work with a supplier chosen by the buyer for ongoing support, ensuring alignment with existing contracts and SLAs.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: No
• Support levels: Worldline’s core business is critical online services, and our offering includes Level 1 (24/7), Level 2 (business hours) and Level 3 (business hours) support for key user groups of the purchaser.; ; Related costs will be assessed during the contracting phase, depending on availability requirements and customer volume.; ; A Service Delivery Manager (i.e. Technical Account Manager) is responsible for ensuring proper management of tickets (incidents and service requests), coordinating changes, and providing regular reports to the purchaser.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We provide onsite training to key users. Additional trainings may be discussed as part of the call-off contract. Our solution is evolving: for each new version or new feature during the project's lifetime, a demonstration can be given to key users.; ; We provide training material (user guide, service description) and can add tooltip on the service (at extra cost). ; ; We can also provide a training environment (at extra cost). This dedicated, isolated environment is production-isolated in terms of operation but contains fictitious data, allowing your users to practice using the solution without impacting production.
• Service documentation: Yes
• Documentation formats: ODF
• End-of-contract data extraction: Worldline can provide a complete export of the database in raw SQL. The use of PostgreSQL or Oracle database engines (if requested), which are industry standards, allows us to facilitate this export/import even if the target SQL engine is different.; A more “open” format such as CSV can be considered upon request, but we do not recommend it due to the volume, complexity, and criticality/confidentiality of the application data.
• End-of-contract process: The client takes possession of any associated documentation, and the data generated or ingested by the system, subject to applicable data retention and privacy obligations.; ; Standard data extraction: SQL/CSV exports are provided as part of the baseline service to support ongoing data access.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Onboarding and offboarding documentation will be customised for each call-off contract. Accessibility standard to meet will be aligned with the buyer

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: Our application is divided into different menus for ease of use:; - Offenders management; - Calendar; - Logistics; - Tracking/Monitoring; - Management; - Billing; - Settings; Access to menus depends on each user's specific permissions (fully configurable). Each menu provides access to all the information and actions needed to carry out electronic monitoring. The interface is modern, rich, but its organisation and ergonomics allow for efficient and fast work.
• Accessibility standards: None or don’t know
• Description of accessibility: Accessibility is integrated from the product’s design start, supported by WCAG 2.0‑trained experts. In early design deliverables, ergonomists and UX specialists ensure key accessibility principles—intuitive navigation, consistent terminology, robust interaction methods (including form error handling), and proper semantic structure (heading hierarchy). Developers are trained to consider accessibility throughout interface creation. Our Q&A specialists are WCAG 2.0‑certified and play a crucial role in audits. This combined expertise ensures ground‑work design and final assessments align with international best practices, delivering a reliable, comprehensive approach from concept to audit.
• Accessibility testing: Each new version, even minor ones, is automatically tested using a Cypress module via our continuous integration chain.; This technology enables end-to-end testing, simulating real users to test that the application is working properly.
• API: No
• Customisation available: Yes
• Description of customisation: The application configuration module allows customers to configure and customise the application completely independently (i.e., without Worldline's intervention). Our application therefore enables you to configure:; ; Different user profiles and their associated rights, in a very detailed and granular manner (geographically, of course, but also by legal procedure, for example);; Document or report templates generated by the application (in a format that can be read and edited using standard office software);; The precise definition of all alarms (triggered based on events reported by the hardware) via the “nomenclature.” The nomenclature lets you configure all the behaviours of the application and the integrated rules engine: combination, correlation, repetition, absence.; Finally, and of course, Worldline also has the capacity to carry out specific developments in order to meet the customer’s strict requirements.

Scaling

• Independence of resources: Measures depend on the chosen hosting type at call-off: a dedicated instance or a tenant on a multi-client platform.; In the case of a multi-tenant platform, several measures ensure isolation and performance for each tenant, such as:; ; - applicative thresholds to protect against abusive usage of the features (thresholds set according to agreed usage); - use of microservices to maximise scalability of the core features; - capacity planning to ensure permanent over scaling of the platform to absorb traffic peaks; - use of scalable infrastructures

Analytics

• Service usage metrics: Yes
• Metrics types: We offer four levels of metrics:; - The management module provides a wide range of business-oriented metrics and statistics directly within the application.; - The statistics module, based on Tableau software, offers all the advantages and possibilities of a complete DataWarehouse.; - Upon request, we can provide access to an ELK module (Kibana) , which allows you to obtain application performance metrics from the application logs.; - Our application is also monitored by tools such as Zabbix and Grafana, allowing you to obtain and format “low-level” operating statistics.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: Logical access control is also used for protecting data (databases can only be accessed through the predefined channels and according to user permissions)
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: The application offers numerous export features: reports, intervention reports, etc.; As the data in the application is highly sensitive/confidential, these features are limited to business needs, based on our experience in electronic monitoring. We can, of course, look into any new export requests.; ; For statistics, our application, which is based on Tableau software, benefits from all data export and reporting features.
• Data export formats:
  • CSV
  • ODF
• Data import formats: Other
• Other data import formats: We don’t offer manual data import features for security reasons.

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Availability of the Services (monthly uptime): 99.5%.; ; Incident management; Mean Time to Notify (MTTN) Service Level for all Services: 30 minutes for Severity 1 incidents from Worldline awareness .; ; Mean Time to Restore (MTTR) Service Level for all Services:; ; - 4 hours for Severity 1 incidents;; - 1 Business Day for Severity 2 incidents, if no Change Management Process is needed;; - 3 Business Days for Severity 3 incidents, if no Change Management Process is needed.; ; Service support availability:; - Level 1 support: 24/7/365.; - Level 2: Business Hours (on duty for Severity 1 incidents).; - Level 3: Business Hours (on duty for Severity 1 incidents).; ; Incident Severity Definition; -Severity 1: An error that disables or materially impairs major service function or the Customer’s operations. If a workaround exists, reclassified as Severity 2.; - Severity 2: An error reducing performance in any non-critical process.; - Severity 3: An error visible only on a single end-user system or non-essential components.
• Approach to resilience: Our service design follows the below principles for ensuring resiliency:; - asynchronous data processing for managing traffic peaks and avoiding locks (for a selected set of workflows); - active/passive Disaster Recovery Plan; - microservice replication (at least one replicate per microservice), combined with a live API based health check
• Outage reporting: Incidents are tracked using a ticketing tool with an alerting mechanism.; ; Our service delivery teams inform customers according to agreed contractual terms.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
• Access restrictions in management interfaces and support channels: Users shall use the service login page, and use the appropriate authentifier depending on their role and the service configuration.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Other
• Description of management access authentication: Users shall use the service login page, and use the appropriate authentifier depending on their role and the service configuration.

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Worldline France has established and certified an Information Security Management System (ISMS) in accordance with the ISO/IEC 27001:2013 standard, covering its operations and the projects entrusted to it by its clients. All services and deliverables provided under this engagement are included in the ISMS and benefit from all associated security measures—both technical and organisational—based on current best practices as well as the legal and regulatory requirements applicable to Worldline and its clients.; ; All employees receive mandatory training in security policy.; Security incidents can be reported either via the line manager or the project's CISO, or via a dedicated mailbox.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Change management is a formal process for handling modifications to the platform, including software updates and configuration changes to adapt to evolving circumstances, regulations, and technologies. It relies on strict documentation and application version control, as well as validation steps with clearly identified responsibilities as defined in the quality assurance plan. These validation steps include risk management, specifically security risks, for updating the risk register and implementing appropriate actions for each case.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Weekly security scans are conducted on IP addresses exposed to the internet. The results are sent to the Security Officer responsible for project security for analysis.; ; Technical updates are also carried out at least twice a year to keep the service up to date and resolve known vulnerabilities .; Known vulnerability tracking is carried out in collaboration with the Security Officer, and deployment decisions are made according to the severity of the threat: from deployment within 24 hours to periodic updates.; Security scans are based in particular on OWASP, Qualys and SonarQube references.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Worldline’s security incident management policy outlines procedures for response, categorisation, handling, and communication of events affecting Worldline’s or clients’ data. Incident priority is determined by scope and impact on information systems. ; For attacks involving client data, Worldline delivers a preliminary incident report within 48 hours, detailing investigation status, understanding of the attack, scope, impact, and mitigation actions taken. Relevant logs or traces are provided once the incident is confirmed. ; Additionally, Worldline can deploy a Security Operations Centre (SOC) to correlate log sources and quickly detect potential malicious behaviour affecting data.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Application and platform monitoring is carried out 24/7 by operational teams who can be contacted at any time via phone or ticketing. ; The monitoring centre analyses and categorises incidents, taking appropriate action according to the type of event and established procedures. ; Incident tracking is available through the ticketing system, and a post-incident report is produced for major or critical incidents.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 1%
• Between £500,001 and £1,000,000: 1.5%
• Between £1,000,001 and £2,500,000: 2%
• Between £2,500,001 and £5,000,000: 2.5%
• Over £5,000,001: 3%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: EY CertifyPoint
• ISO/IEC 27001 accreditation date: Tuesday 1 August 2023
• What the ISO/IEC 27001 doesn’t cover: Nothing
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: EY CertifyPoint0
• ISO 9001 accreditation date: Tuesday 1 August 2023
• What the ISO 9001 doesn’t cover: Nothing
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: USD AG
• PCI DSS accreditation date: Wednesday 16 October 2024
• What the PCI DSS doesn’t cover: All Worldline services which are not part of a card payment solution (PCI DSS only applies to card payment related services). All Worldline teams are nevertheless trained to PCI DSS requirements and the Worldline Information Security Management System is aligned with PCI DSS requirements
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: A4af5190-7f45-41c3-ab5a-c40a1557bd92
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at WLopportunities@worldline.com. Tell them what format you need. It will help if you say what assistive technology you use.