Queue-it ApS

Queue-it

A virtual waiting room is a cloud-based solution for websites and applications to manage online traffic surges. When traffic exceeds a site or app's capacity, traffic is redirected to a virtual waiting room using a HTTP 302 redirect, then returned back to the website in a fair, controlled order.

Features

• 24/7 Website Traffic Management and Peak Protection
• Custom Virtual Queue Design
• Queue System Detailed Reporting Capabilities
• E-mail Notifications
• Online Queue Connectors
• Bots and Abuse Management
• Queueing Notifications and Logs
• Virtual Waiting Room API
• First in first out (FIFO) Queue
• Load Testing for Online Traffic Management Issues

Benefits

• Avoid website crashes and slowdowns during high website demand.
• A fair citizen experience with a custom virtual queue system.
• Streamlined online application management and online registration processes
• Reduce complaints, maintain reputation with reliable website performance.
• Ensure maximum application availability on critical service websites
• Bot protection; mitigate bots and abuse on critical service websites
• Safeguarding measures for government digital infrastructure.
• Ensure website uptime and mobile application uptime during critical events
• Scaling cost reduction
• Fair and accessible government websites through FIFO online queueing system

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@queue-it.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

512263690743795

Contact

Malou Toft
+45 77 34 08 02
info@queue-it.com

About your service

• Service categories:

  Applications

  Production and operations

  • Other operations
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Queue-it is a SaaS solution hosted in AWS. Therefore, no hardware constraints apply. Customers will get a notice about any planned maintenance arrangements that require the suspension of access to the Services in advance.
• System requirements: Queue-it is SaaS, no system requirements

User support

• Email or online ticketing support: Yes
• Support response times: We provide Mon-Fri 24h support to all customers and 24/7 support to customers with Pro or Enterprise subscription.The response time SLA is subscription dependent: Standard: 4 hours, Pro and 2 hours, Enterprise 1 hour.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: No
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: We have two levels of support that are accessible to all our customers.; Level 1: email support provided by the support team. ; Level 2: involve Solutions Architects for complex troubleshooting or project-based involvements. Each customer has a dedicated Solutions Architect during the onboarding period. After the onboarding is complete, they have an assigned Account Manager or Customer Success Manager. Post-onboarding level 2 support is charged at an hourly fee of €0,00 / hour.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Each customer has an assigned Solutions Engineer or Architect to assist them with onboarding. We provide online training, documentation and ad-hoc assistance and advisory required for successful integration and setup. ; The onboarding includes a monitoring bridge with the customer for the first go-live session to make sure the first-time use of Queue-it is successful.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Customers can export metrics of the waiting rooms they used, as well as the latest versions of their setup configuration. This is managed via the admin platform (GO Platform) and data will be available from the start of the engagement with Queue-it. Statistics and other information can also be fetched from the API.
• End-of-contract process: Customers should remove Queue-it integration from their website or mobile application and end all the active waiting rooms at the contract expiration date. When the contract ends, their account will be switched to a limited-access mode.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
  • Other
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Our virtual waiting room is designed to work on desktop, mobile, and mobile applications with no significant difference. Our control panel can be accessed via mobile devices but it is optimized for desktop access.
• Service interface: Yes
• User support accessibility: WCAG 2.2 A
• Description of service interface: Customers interact with Queue-it service using the self-service platform called "Go". The platform allows them to set up and monitor their waiting rooms and provides access to their historical data. It has three levels of user access: admin, user and read-only. The changelog allows customers to see the log of their users' activity. Queue-it also has an API available to manage the account.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: To deliver accessible products we pay attention to Accessibility throughout our release cycle. We train everyone involved in delivering our products around assistive technology and Accessibility best practices. This includes, UX designers, engineers, and product managers. We test our products before release using both manual and automated techniques. Conducting regular research with agents, admins and end users who rely on assistive technology to collect feedback and help us prioritize improvements. Systematically tracking both remediation and new feature progress to drive quality improvements. Finally, we listen to feedback from customers.
• API: Yes
• What users can and can't do using the API: Queue-it offers a REST-based API. The API must be accessed through the customer specific endpoint and is authenticated through API key. HTTPS is required. ; Capabilities: API key management, Change logs, Integration rules and configuration, Invite-only lists, Secure link sharing, Waiting room creation and management, Alias, Dynamic information, Waiting Room Statistics, Waiting room search and listing, bulk operations.; Full documentation of the API endpoints can be found here: https://api2.queue-it.net/.; The API endpoint is not scaled to end-user volumes. If data from the API is supposed to be used for end-user functionalities, then access should be created via a server-side service with a cache (e.g. with 15 second flush time). If traffic is excessive, it may be throttled automatically.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Our service is fully customisable to fit the needs of our clients. The placement of the queue page can be customised, so it is only protecting a specific part of your infrastructure where bottlenecks occur. The design and features of our queue page can be customised based on the needs of the client: to show the expected wait time, number of citizens in line in front of you, send email alert, invite-only queue and more. Our experienced team is ready to support you to meet your needs and requirements.

Scaling

• Independence of resources: The Queue-it system is designed with auto-scaling and fault tolerance in mind. Under sustained load, components scale automatically, and any malfunctioning servers are removed from the load balancers. Customers are hosted in logical segments under unique hostnames, ensuring their workloads remain isolated. We can also move individual customers from one segment to another as part of disaster-recovery procedures or proactively when an account needs isolation.

Analytics

• Service usage metrics: Yes
• Metrics types: We provide the metrics about the traffic passing through customers' waiting rooms (e.g. Inflow, Number of visitors currently waiting, Expected wait time, bot and datacenter traffic, etc.) that allows our customers to assess their usage of our service. In addition to this, we have diagnostics metrics that help customers detect issues in the service setup or website performance.
• Reporting types:
  • API access
  • Real-time dashboards
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: Users can export their data from the Queue-it self-service platform where there is a statistics section where users can analyze past performance of waiting rooms and export data from their account.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • .xls
  • .png
  • .jpeg
  • .svg
  • .json
• Data import formats: Other
• Other data import formats: .json

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Queue-it has a bespoke optional Enterprise SLA agreement with availability, uptime and response guaranties. The SLA will refund on monthly fees upon agreement.
• Approach to resilience: Queue-it SaaS has been designed from the outset with a fault tolerant high availability architecture. We have tracked uptime since Q4 2012 using Pingdom and can provide documentation and historic reports upon request.
• Outage reporting: Outages will be reported on our public status page here: http://status.queue-it.com/; As well as in the notifications in the GO platform.

Identity and authentication

• User authentication needed: No
• Access restrictions in management interfaces and support channels: Access to the management interface is role-based. Each user has a single role—Read Only, User, Administrator, or Owner—with permissions strictly limited to that role. Only Administrators and Owners can manage users, and at least one Owner must always exist. Accounts use unique IDs and email addresses, and MFA can be enforced at the account or individual level. User Groups can be created to manage notification access. Support channels follow the same access model: only authorized users can request changes, and Owners or Administrators must approve sensitive actions such as MFA resets or user modifications.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Other
• Description of management access authentication: Each user signs in with an ID and password, and MFA can be enforced using an authenticator app or text message. The platform also supports Single Sign-On (SSO) using the OpenID Connect (OIDC) authorization flow, which is compatible with all major identity providers, including Microsoft Entra ID and Okta.

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: No
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Queue-it is ISO27001 certified, which means that maintains a fully operational ISMS composed of multiple security policies that can be distributed to interested parties upon request (e.g. information security policy, backup policy, disaster recovery plan). Key security policies are acknowledged by employees on onboarding and once a year afterwards.
• Software Security Code of Practice: No

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Different services are deployed to production on a daily basis, using automated Canary deployments. To minimize the risk, the deployment is done in a stepwise process.; We have a test/ production environment, and the whole process starts with a code review and approval process.; Then, it’s deployed to EU Partition A, but only for availability zone A. When it’s observed that no alarms are triggered and no issues are seen, then it’s deployed to EU Partition A availability zone B. If all is still good, then it’s deployed as to additional segments.; We also have thorough functional tests.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Queue-it has weekly reoccurring tests to identify vulnerability in our external systems. The patches are deployed into production after careful testing. The patches are released based on a pre-defined SLAs. Penetration tests are conducted twice a year and the vulnerability management policy in place is in compliance with ISO27001 standard.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Queue-it has multiple monitoring solutions deployed into our production environment. These notifications are sent to mail, Team or OpsGenie. Our main threat detection is GuardDuty in AWS. We have a 24/7 duty team to react on alerts
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Queue-it defines an incident as an event that causes disruption to or a reduction in the quality of a service which requires an immediate emergency response. An incident can e.g., be caused by a bug in our own software, an infrastructure issue, a hacker attacks, etc. Queue-it has pre-defined processes for common events. In additional, users can report incidents via Queue-it Zendesk system and Queue-it provides incident reports in accordance with its "Queue-it Incident Response Plan"
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Our free trial allows you to explore the functionality of Queue-it and test integration. The trial period is indefinite, but only offers limited functionality as you will not be able to run a production-level event with the free trial.
• Link to free trial: https://queue-it.com/free-trial/

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 10%
• Between £250,000 and £500,000: 12.5%
• Between £500,001 and £1,000,000: 15%
• Between £1,000,001 and £2,500,000: 17.5%
• Between £2,500,001 and £5,000,000: 20%
• Over £5,000,001: 25%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: LL-C (Certification) Czech Republic a.s
• ISO/IEC 27001 accreditation date: Monday 7 July 2025
• What the ISO/IEC 27001 doesn’t cover: The certificate covers the entire service of Queue-it.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@queue-it.com. Tell them what format you need. It will help if you say what assistive technology you use.