GILLETT LIMITED

IsoStock

Compliance software that supports environmental regulatory requirements, to prevent or minimise emissions and impacts on the environment, allowing you to use Best Available Techniques (BAT).​ Proven track record, our software reduces the burden of managing complex spreadsheets and in-house solutions, providing an easy-to-use, reliable and fully supported solution.

Features

• Real-time tracking and reporting of radioactivity
• Aligned with Environment Agency Regulations
• Open and Sealed source stock, disposal and waste management
• ONR Nuclear Safeguards material management and regulatory reporting
• ARSAC based dose administration and IPEM excretion factors
• Radiopharmacy production from generators and elutions
• Flexible, dynamic reporting with exports
• Full audit of data (all entry, edits with historic changes)
• Encrypted and isolated data
• Single Sign On with role-based access control

Benefits

• Automatically compares data against environmental permits
• Reduces risk of permit breach
• Provides quick data collection with minimal impact on workflow
• Minimises accumulation/waste and protects the environment
• Aids increasing activity and growth through efficiencies
• Helps reduce radioactive waste that requires disposal
• Tracks material activity and inventory balances from receipt to disposal
• Real-time decay-corrected reporting and dashboard available site-wide
• Improves quality/accuracy of records and supports auditing
• Releases RPA/RWA/Clinical time

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@isostock.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

514538668023262

Contact

John Gillett
01143217031
sales@isostock.com

About your service

• Service categories:

  Applications

  Production and operations

  • Other operations
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: Requires Single Sign On using Entra ID/Microsoft 365.; Access via a browser; label printing requires a utility installed locally.; Self-hosting support options are available for sites with specific security requirements.
• System requirements:
  • Browser
  • Optional - Windows desktop or server for label printing

User support

• Email or online ticketing support: Yes
• Support response times: In line with published SLA - High priority (P1) under 8 hours Monday to Friday (excluding public holidays).
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Technical Support is included within the subscription price. ; ; This includes: error (‘bug’) fixes, ‘hand holding’, ‘how to use’, all minor Software enhancements instigated by Gillett, advice and help on all changes to setup.; ; Support can be raised via email or web form and may result in an email response or a Teams meeting with screen sharing.; ; Online knowledge base is provided with a training guide. ; ; A separate training system can be provided on request.; ; In the unlikely event of requiring on-site support (e.g. high security requirements) this would be offered with prior agreement on costs.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Following a discovery phase to support customers in supplying the required information, we undertake the initial configuration and import of information to ensure they can start using the service quickly, avoiding a steep learning curve.; ; Key users are involved with regular remote review sessions to help ensure the configuration meets the service needs.; ; The intended outcome of the sessions is that the users can start using the fully configured system on service delivery.; ; Although there is a base set of requirements we need to follow, onboarding can be tailored to the customer’s requirements, deployment model, and timeframe.; ; Online familiarisation sessions are provided as part of onboarding for key users, including live walkthroughs and demonstrations of core features. End-user training requirements are minimal.; ; Context-sensitive help, Knowledge Base and training guides are available.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: Users can extract their data at the end of the contract in a controlled and secure manner.; ; Prior to contract termination, authorised users are able to export all data screens and reports via PDF/Excel. ; ; If required, a complete data set can be provided as a SQL BACPAC. We will support the organisation to ensure confidentiality and integrity are maintained during extraction.
• End-of-contract process: Authorised users are able to export all data screens and reports via PDF/Excel, included in the cost of the subscription licence.; ; If required, a single SQL BACPAC can be provided, included in the cost of the subscription licence. ; ; Following confirmation that the customer has successfully extracted their data, and in line with contractual and legal requirements, the remaining customer data is securely deleted from the service.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Onboarding is an assisted process where we are involved at each stage, with minimal documentation required for the new system administrators. ; ; During the onboarding process, information is supplied as required via email, PDF, Excel or links to the maintained Knowledge Base.; ; The Knowledge Base is accessible to all. Other documents are tailored and supplied directly to the relevant parties as and when needed.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Some of the larger reports and more complex functions are limited due to size.
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: The user interface is designed to be intuitive, focusing on user tasks and functions to streamline data collection. A standardised layout is applied across all screens and forms, allowing for individual preferences, column selection, and options for sorting and filtering. ; ; Each screen is centred on specific tasks and typically aligns with the logistical processes that users are following. The options and headings are familiar, as they adhere to the industry’s standard naming conventions.
• Accessibility standards: None or don’t know
• Description of accessibility: Emphasis is placed on accessibility, incorporating accompanying text for colour usage as well as considerations for space, contrast, and highlights. All relevant data is readily accessible without the need to navigate through multiple menus or screens. Each function includes descriptive text, eliminating reliance on icons, and in-context help pages and a knowledge base are available for support. ; ; We are committed to reviewing accessibility considerations as part of our roadmap and in response to customer needs. We welcome feedback and offer to collaborate with customers’ accessibility teams to identify improvements that are compatible with specialist regulatory workflows.
• Accessibility testing: Testing is undertaken using in-browser testing tools to gain an initial understanding of requirements. We regularly liaise with visually impaired users for feedback during the development stage, including the use of assistive software and devices.
• API: No
• Customisation available: Yes
• Description of customisation: Each system is tailored to meet the specific needs of the organisation. All configuration options are accessible to all customers through the core 'setup' functionality integrated within the system. There are no configuration elements that require additional technical input beyond the dedicated 'Setup' screens.; ; This includes: radionuclides, departments, suppliers, compounds, pharmaceuticals, ARSAC investigations, locations, storage areas, disposal routes, container types, waste contractors, permits, users, security settings, meters, calibrators, labels, user-defined reports, and various display configurations.; ; Customers can customise the system themselves if they possess the necessary role-based permissions. Alternatively, users may request assistance, which is included as part of the support offered.

Scaling

• Independence of resources: The service uses per-customer logical separation. These logical units are distributed across shared compute and database services. The usage model has extremely low concurrency, and the service operates well below platform capacity limits. Platform utilisation is continuously monitored, and customer resources can be rebalanced or moved if required.

Analytics

• Service usage metrics: Yes
• Metrics types: Administrators have access to user login session details from within the software.
• Reporting types: Real-time dashboards
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: NCSC approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure

Data importing and exporting

• Data export approach: All data screens and reports have an export button that provides a formatted PDF or Excel file.
• Data export formats: Other
• Other data export formats:
  • Excel
  • PDF
• Data import formats: Other
• Other data import formats:
  • Excel for initial migration
  • Image formats (JPEG, PNG etc)
  • PDF
  • MS Office formats

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Expected availability of 99.5%.; ; The service is designed for high availability and normally operates continuously. The underlying Azure platform provides a 99.95% availability SLA. Application downtime is not expected under normal operation; the primary risk of unavailability is an unforeseen software defect triggered by specific data conditions, which would be managed in line with the service’s support processes. Planned updates are infrequent and typically completed in under one minute out of hours. Application availability is monitored, and issues are investigated and resolved as soon as practicable.
• Approach to resilience: The service is hosted on Microsoft Azure and uses managed platform services designed for high availability and fault tolerance.
• Outage reporting: Any significant outages, planned or unplanned, would be communicated via email from our Support Team.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
• Access restrictions in management interfaces and support channels: Management interfaces are restricted to authorised personnel using role-based access controls and strong authentication. Support access is limited to named users through controlled channels and follows defined procedures. Access is granted on a least-privilege basis, monitored, and logged, and customer data is only accessed where required to resolve support issues.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Other
• Description of management access authentication: Microsoft Entra Privileged Identity Management (PIM)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Information Security Management System (ISMS) aligned with ISO/IEC 27001:2022 and UK GDPR requirements. Information security policies are approved by senior management and apply to all employees, contractors, suppliers, and third parties with access to company systems or data. Policies cover areas including information classification, access control, asset management, incident management, business continuity, supplier security, and acceptable use.; ; The ISMS is overseen by the nominated Information Security & Data Protection Lead, who reports directly to senior management and is responsible for governance, risk management, and compliance. Operational responsibility for policy implementation sits with system owners and service leads, supported by documented procedures and technical controls.; ; Policies are communicated to staff during onboarding and reinforced through periodic reviews, awareness activities, and mandatory acceptance where appropriate. Compliance is enforced through role-based access controls, device management using Microsoft Intune, secure cloud infrastructure hosted primarily on Microsoft Azure, and logging and monitoring controls.; ; Adherence to policies is monitored through internal reviews, risk assessments, incident reporting, and management review meetings. Any breaches of policy are investigated, recorded, and addressed through corrective actions. Policies are reviewed at least annually, or following significant change, to ensure continued effectiveness and alignment with business and regulatory requirements.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Changes to the service are managed through ISO/IEC 27001-aligned change management processes. All changes are risk-assessed, approved, tested, and deployed in a controlled manner. Production changes are scheduled to minimise disruption and are logged for audit.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Vulnerability management processes comply with ISO/IEC 27001 and are supported by Cyber Essentials Plus certification. Vulnerabilities are identified through risk assessment, external assurance, and ongoing automated testing, with remediation tracked and prioritised based on risk. Vulnerability information is sourced from automated dependency analysis (NuGet advisories), OWASP-based security testing, and trusted external guidance including MyNCSC alerts.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Cloud platform monitoring provides infrastructure and service health logging with automated alerting. Alerts are reviewed by authorised personnel, and security or operational incidents are investigated and managed in accordance with defined incident response procedures.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Incidents are managed through documented ISO/IEC 27001-aligned procedures. Events are logged, assessed, and prioritised based on impact. Incidents are investigated and remediated promptly, with service restored as soon as practicable. Post-incident reviews are performed where appropriate, and notifications are made in line with contractual and regulatory requirements.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 15%
• Between £2,500,001 and £5,000,000: 20%
• Over £5,000,001: 25%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Amtivo Group Limited (British Assessment Bureau and Certification Europe)
• ISO/IEC 27001 accreditation date: Wednesday 26 November 2025
• What the ISO/IEC 27001 doesn’t cover: Excludes customer managed environments and devices
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 95fca08d-cfdd-4a4b-ad54-631e434e5afc
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 82e1c598-9c4c-4283-97e4-7726fa35bf59
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Ensuring new workers are informed of their right to join a trade union
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Structuring of the supply chain selection process to ensure fairness (e.g. anti-corruption) and encourages participation by a diverse range of businesses, including with regard to new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutual
    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Collection of the views and expertise of disabled people and their representative organisations on successfully supporting disabled employees or applicants
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Other measures to provide equality of opportunity for disabled people and those with health conditions into employment, including becoming a Disability Confident employer and inclusion of supported businesses in the contract supply chain
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of issues relating to entering the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@isostock.com. Tell them what format you need. It will help if you say what assistive technology you use.