OFFICELABS LIMITED

Morae Physical

Morae Physical is a browser-based physical records management system that enables organisations to register, classify, locate, govern, and audit physical information assets, including files, boxes, and offsite storage holdings. The service supports retention, legal hold, chain-of-custody controls, and defensible disposal across the full physical information lifecycle.

Features

• Registration and classification of physical records and containers
• Location tracking across on-site and off-site storage
• Check-in, check-out, and transfer workflows
• Retention scheduling and automated disposal controls
• Legal hold management
• Barcode and label generation
• Full audit trail and reporting
• Role-based access control

Benefits

• Defensible control of physical information assets
• Reduced storage costs through governed disposal
• Improved audit readiness and traceability
• Reduced operational risk from lost or unmanaged records
• Alignment between physical and digital governance strategies

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@officelabs.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

513704671398647

Contact

Graham Bidwell
01392 24 0 365
sales@officelabs.co.uk

About your service

• Service categories:

  Applications

  Content workflow and management

  Content services

  • Enterprise Content Management Applications
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Morae Physical can integrate with information governance, records management, and lifecycle management software, including other Morae products and supported Microsoft 365 services. These integrations support alignment between physical and digital information governance, including shared classification structures and retention policies, but are not required for standalone use.
• Cloud deployment model: Public cloud
• Service constraints: The service requires internet connectivity to access the browser-based application.; Appropriate user permissions are required to manage physical records, locations, and workflows.; Service performance and configuration depend on the volume of physical records, transaction activity, and organisational records structures.
• System requirements:
  • Modern web browser supporting secure HTTPS connections
  • Internet connectivity to access the cloud service
  • Supported operating systems for browser-based access
  • Administrative access to configure users, roles, and records structures
  • Supported Microsoft 365 tenant or other connected governance systems
  • Appropriate permissions for configuration and data exchange
  • Sufficient licences for connected Microsoft 365 services

User support

• Email or online ticketing support: Yes
• Support response times: Support requests submitted via email or the online ticketing system are monitored during UK business hours, Monday to Friday, excluding public holidays. Initial responses are typically provided within one business day. Requests received outside business hours are reviewed on the next working day. Response times may vary depending on the nature and priority of the request.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Support is provided as a standard service level included with the software subscription. This includes access to email and online ticketing support during UK business hours, Monday to Friday, excluding public holidays. Support covers incident logging, fault investigation, and resolution of software-related issues.; ; Enhanced support services, including extended support hours, prioritised response, onsite assistance, and advisory support, are available at additional cost and are procured separately under appropriate Cloud Support listings.; ; OfficeLabs does not provide a dedicated technical account manager or cloud support engineer as part of the standard software subscription. Where required, customers may procure named technical resources, implementation support, or ongoing service management through separate Cloud Support services.; ; All support requests are managed through a structured ticketing process, with issues prioritised based on impact and urgency.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Users can start using the service through a structured onboarding process supported by documentation and guided configuration within the service interface. Online documentation is provided to help administrators configure record classes, file plans, retention schedules, locations, user roles, and permissions.; ; Optional onboarding assistance, including remote guidance sessions, configuration support, and administrator training, can be provided where required. These activities are not mandatory to use the service and are available at additional cost under appropriate Cloud Support services.; ; Where onboarding support is provided, it focuses on enabling administrators to understand the service configuration, governance options, and operational workflows, allowing the buyer to operate and manage the service independently once initial setup is complete.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Users can extract service-generated data, including configuration information, registers of physical records, reports, and audit outputs, using standard export and reporting capabilities provided by the service prior to contract termination.; ; Where the service is used alongside other systems, ownership and control of the underlying physical records and any external source data remain with the buyer at all times. Users are responsible for exporting any required outputs before the end of the contract period.; ; Optional assistance with data extraction, validation, or transition planning can be provided at additional cost under appropriate Cloud Support services but is not required to extract data from the service.
• End-of-contract process: At the end of the contract term, access to the service is withdrawn in line with the agreed notice period. Users are responsible for exporting any required records, reports, or configuration data before access ends.; ; The contract price includes access to the software service and standard support during the contract term. Activities beyond standard access, such as extended access periods, assisted data extraction, transition support, or consultancy services, are not included in the contract price and can be provided at additional cost through separate Cloud Support services if required.; ; Where the service aligns with external systems or repositories, ownership and control of those systems and any associated data remain with the buyer at all times.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Documentation is provided in digital formats that can be accessed through standard web browsers. Users can apply browser-based accessibility features such as screen magnification, zoom, text resizing, and keyboard navigation. Documentation is structured to support clear navigation and readability.; ; Accessibility of the documentation depends on the capabilities of the underlying documentation platform and the user’s chosen assistive technologies. Users can request alternative formats or additional support where reasonable adjustments are required.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: The service provides a secure, browser-based user interface for managing physical records, containers, locations, and lifecycle activities. Authorised users can register physical records, manage classifications and retention schedules, process check-in and check-out requests, apply legal holds, and track the movement and status of records.; ; The interface supports search, filtering, reporting, and audit review to support records governance, compliance, and operational oversight. Role-based access controls restrict access to administrative and operational functions. No client-side software installation is required to access the service.
• Accessibility standards: None or don’t know
• Description of accessibility: The service is accessed through a standard web browser and supports common accessibility features provided by modern browsers and operating systems, including keyboard navigation, screen magnification, zoom, and screen reader support where available. Core operational and administrative functions are accessible through the web interface.; ; Some advanced configuration activities, such as complex retention modelling or bulk administrative updates, may be less suitable for certain assistive technologies due to the nature of the workflows.
• Accessibility testing: No formal testing has been conducted specifically with users of assistive technologies. Accessibility is supported through the underlying web platform and standard browser accessibility features. Where accessibility issues are identified, these can be raised through the support process and are reviewed to determine whether reasonable adjustments can be made.
• API: Yes
• What users can and can't do using the API: The service provides APIs to support integration with related Morae services and selected third-party systems. API access is used to enable controlled data exchange, synchronisation of reference information, and integration into wider information governance and records management architectures.; ; APIs are not intended for unrestricted end-user development or real-time operational automation. Access and usage are subject to service configuration and licensing.
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: Customisation is performed through the secure, browser-based administrative interface. Authorised administrators configure settings using standard configuration screens, forms, and rule definitions provided by the service.; ; Configuration changes are applied within the service without the need for software redeployment. Optional assistance with configuration, data setup, and governance modelling is available through professional services where required.

Scaling

• Independence of resources: The service is delivered using a cloud-based architecture that provides logical separation between customer environments. Each customer’s data, configuration, and operational activity are isolated to ensure that usage by one customer does not affect the performance, availability, or security experienced by others.; ; Capacity is managed and monitored by the service provider to ensure sufficient resources are available to support expected transaction volumes, record counts, and reporting activity. Where required, resources can be scaled in line with customer demand to maintain consistent service performance.; ; No customer has visibility of, or access to, another customer’s data or workloads.

Analytics

• Service usage metrics: Yes
• Metrics types: The service provides operational and governance metrics relating to the management of physical records, including record and container counts, location inventories, movement history, request activity, retention status, and audit events. Metrics support operational oversight, compliance monitoring, and audit readiness.; ; Metrics are derived from system activity and configuration data and are available subject to user permissions.
• Reporting types:
  • Real-time dashboards
  • Regular reports
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Morae Group

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure

Data importing and exporting

• Data export approach: Users export data using built-in reporting and export features within the service interface. Authorised users can export registers of physical records, container inventories, location data, audit logs, and configuration information prior to contract termination.; ; Exports are initiated through the secure, browser-based interface without the need for additional tools. The service does not store or export the physical records themselves; it manages metadata, status, and governance information relating to those records.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • PDF reports
  • Structured text formats for analysis outputs
• Data import formats:
  • CSV
  • Other
• Other data import formats: Structured text formats for configuration data

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The service is delivered as a cloud-based software service and is designed to be available during normal operating conditions. Availability depends on the underlying cloud hosting platform and internet connectivity.; ; No specific uptime percentage is guaranteed as part of the standard service offering. The service is provided on an “as provided” basis and does not include service credits or automatic refunds linked to availability levels. Availability incidents are managed through the support process in line with the service’s incident management procedures.; ; Any enhanced availability commitments or bespoke service level agreements would need to be agreed separately and are not included as part of the standard service.
• Approach to resilience: The service uses a cloud-based architecture that leverages the resilience features of the underlying hosting platform. The hosting environment provides redundancy across infrastructure components, including compute, storage, and networking, to reduce the impact of component failure.; ; Monitoring and recovery mechanisms are used to support service continuity. The service benefits from resilient datacentre operations, including controlled physical access, environmental protections, and backup power and connectivity, as provided by the cloud hosting provider.; ; Data protection measures, including replication and backup, are used to support recovery in the event of service disruption.
• Outage reporting: Service availability issues are managed and communicated through the support process. Users can raise incidents via email or the online ticketing system and receive updates on status and resolution progress.; ; The service does not provide a public status dashboard or customer-accessible outage reporting API. Where outages relate to the underlying cloud hosting platform, relevant service health information may be referenced as appropriate.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is restricted through authenticated user accounts and role-based access controls. Administrative privileges are limited to authorised personnel with defined responsibilities. Support channels are accessible only to verified customer contacts and OfficeLabs support staff. Access rights are reviewed periodically to ensure they remain appropriate. Where third-party platforms are used to deliver management or support functions, their native access control mechanisms are applied in line with organisational security policies.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: OfficeLabs operates a formal information security management framework aligned with ISO/IEC 27001. Documented policies and procedures cover areas including access control, data protection, incident management, risk assessment, supplier management, and business continuity. Policies are reviewed regularly to ensure continued relevance and effectiveness.; ; Overall responsibility for information security sits with a named board-level role, supported by operational security leads who oversee day-to-day implementation. Security risks are identified, assessed, and managed through a structured risk management process, with findings escalated where required.; ; Compliance with security policies is supported through defined processes, role-based responsibilities, staff awareness activities, and internal review mechanisms. Security incidents and weaknesses are reported through established channels and managed in line with documented incident response procedures.; ; Third-party services used in the delivery of the service are assessed as part of supplier and risk management processes to ensure appropriate security controls are in place. The effectiveness of information security controls is monitored and reviewed as part of ongoing governance activities.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Configuration items relating to the service are identified and managed through documented configuration and change management processes. Changes are requested, assessed, approved, and implemented in a controlled manner, with records maintained to track components throughout their lifecycle. Proposed changes are reviewed for potential security, availability, and operational impact before implementation. Where changes may affect security controls, additional risk assessment and mitigation steps are applied. Changes are tested where appropriate and implemented in line with defined procedures to reduce the risk of unintended impact.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Potential threats are identified through a combination of vendor security advisories, cloud provider notifications, vulnerability disclosures, and internal review. Reported vulnerabilities are assessed based on risk, impact, and exploitability. Remediation actions are prioritised accordingly. Security patches and updates are applied in a controlled manner and within reasonable timescales based on severity and operational impact. Where vulnerabilities relate to third-party components or hosting platforms, remediation is coordinated with the relevant suppliers. Vulnerability status and remediation actions are tracked through established operational security processes.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Protective monitoring activities are used to identify potential security events and compromises through review of service logs, alerts, and notifications from underlying platforms and suppliers. Potential incidents are assessed to determine impact and severity. Where a compromise is suspected, predefined incident response procedures are followed to contain, investigate, and remediate the issue. Incidents are responded to promptly and prioritised based on risk and potential impact, with escalation applied where necessary in line with documented security and incident management processes.
• Incident management type: Supplier-defined controls
• Incident management approach: The organisation operates documented incident management processes covering identification, assessment, response, and resolution of security and service incidents. Pre-defined procedures are in place for common incident types to support consistent handling and escalation. Users can report incidents through email or the online ticketing system. Incidents are logged, prioritised based on impact and urgency, and managed through to resolution. Where appropriate, users are provided with updates and post-incident information outlining the nature of the incident, actions taken, and any relevant follow-up.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: A limited, time-bound assessment can be provided to analyse a defined subset of data sources. The trial includes discovery, classification, and reporting outputs. Remediation, automation, and ongoing governance features are not included. Trial scope, duration, and data volumes are agreed in advance.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 3%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 7%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 12%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Alcumus ISOQAR
• ISO/IEC 27001 accreditation date: Tuesday 7 October 2025
• What the ISO/IEC 27001 doesn’t cover: The ISO/IEC 27001:2022 certification applies to the OfficeLabs Information Security Management System (ISMS) as defined in the documented scope and Statement of Applicability.; ; The certification does not cover customer-owned systems, infrastructure, networks, or devices that are not operated or managed by OfficeLabs, including client environments accessed for consultancy or delivery purposes. It also does not extend to third-party platforms or services used by OfficeLabs, except where these are governed through supplier due diligence, contractual controls, and ongoing risk management within the ISMS.; ; End-user locations, home networks, and personal equipment are not directly certified, beyond the organisational policies and controls applied to remote working. Activities, information assets, or processing operations that fall outside the formally defined ISMS scope are also excluded.; ; As with all management system certifications, the ISO/IEC 27001 certification is based on limited audit sampling and does not guarantee the absence of all non-conformances.; ; All information assets, systems, and services within the defined scope are managed in accordance with ISO/IEC 27001:2022, with risks outside the scope addressed through governance, supplier management, contractual obligations, and risk assessment processes.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 89b8902b-27bd-4ea6-a83b-54fad105966b
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 8c841283-44fe-4dc5-85ee-6208d10fd4a5
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@officelabs.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.