METASTREET LTD

Private Housing Regulation Software & Apps

Private rented sector regulation software covering case management, compliance, and enforcement, including advanced property licensing across all regimes, HHSRS hazard assessment, licence auditing, and a mobile Inspector App. Tenure intelligence and stock condition analytics provide data-led insight into housing quality, risk, and regulatory prioritisation.

Features

• Developed by sector experts - expert project support included
• Covers all aspect of private housing regulation and enforcement
• Fully compliant - meets legal requirements out of the box
• Specialised mobile inspection app and penalty module
• Team management, notifications and detailed workflows
• Integrated payment gateways & self service reports
• Direct DB and Open APIs & no exit fees
• Full case management and hazard assessment (HHSRS)
• Artificial intelligence and subject non-compliance insights
• Fully customisable - client branding & Gov.uk guidelines

Benefits

• Works out of the box and stands alone
• Drive up service efficiency and reduce administration costs
• Productivity boost - smart workflows, validation and notifications
• Designed by practitioners - experienced in delivering public services
• Mobile working Inspector App - cloud based - works offline
• Secure by design, 2FA, encrypted document storage, audit logs
• Auto scaling AWS architecture to support peaks in traffic
• Full payment integration (Stripe and Capita Pay)

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at team@metastreet.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

555929798177945

Contact

Team Metastreet
02089383768
team@metastreet.co.uk

About the service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Public Order and Safety
  • Other
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: None
• System requirements:
  • Modern web browsers
  • Smart phone for two factor authentication
  • Each user needs unique e-mail address

User support

• Email or online ticketing support: Yes
• Support response times: Provide e-mail and on line support 9a.m to 5p.m Monday to Fridays. (except bank holidays) Response times set out in our service standards.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes, at an extra cost
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: Provided by third party
• Onsite support: Yes, at extra cost
• Support levels: Technical account manager support Support package can be tailored to clients requirements
• Support available to third parties: No
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: Training will be available online User documentation available through the 'help centre' Support line available Training videos A training/test system will be set up and available throughout the life of the contract.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: We will assist in the migration of data to the buyer or a new supplier as detailed in the agreed exit plan. This will be in a structured JSON format.
• End-of-contract process: Obligations as required by the agreed exit plan and contract are included in the price of the contract.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Menu structure
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: The Metastreet API is organised around REST. Our API has predictable resource-oriented URLs, returns JSON-encoded responses, and uses standard HTTP response codes, authentication, and verbs.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: A wide range of elements are configurable on set up, including branding - e.g logo, favicon, accent colour; fee levels; licence conditions, notices and letters; bespoke additional conditions system e-mails; split fee (part B payment); Configuration of application form - required documentation; public register configuration; message on payment screen .

Scaling

• Independence of resources: Metastreet ensures consistent performance for all users through logical tenant isolation, controlled resource allocation, and elastic cloud scaling. Each council operates within defined service limits, supported by rate-limiting and throttling to prevent excessive demand. Core services scale automatically to manage peak load, while continuous monitoring identifies and mitigates abnormal usage, ensuring fair and reliable performance across the platform.

Analytics

• Service usage metrics: Yes
• Metrics types: Metastreet’s status page displays historical uptime percentages for core components (Council Admin Back Office, Front-end Forms, Inspection App, Council API) over the past 90 days, incident history with status updates, and real-time system health indicators. It provides transparent availability and performance data to build trust and inform users of operational status.
• Reporting types:
  • Real-time dashboards
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: Less than once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest: Physical access control, complying with another standard
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: Open APIs Direct DB interface CSV files
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: 99%
• Approach to resilience: Metastreet is designed for high resilience using a cloud-native architecture hosted on Amazon Web Services (AWS). The platform runs across multiple availability zones within the AWS London region, protecting against single datacentre or component failure. Core services use managed, highly available infrastructure with automated backups, redundancy, and continuous health monitoring. Capacity scales elastically to handle demand spikes without service degradation. Regular disaster-recovery testing, defined RTO/RPO targets, and incident management procedures ensure rapid recovery. AWS datacentres provide resilient power and physical security, independently audited against recognised international standards. Further detail are available on request.
• Outage reporting: E-mail alerts and public dashboard

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Metastreet restricts access to management interfaces and support channels using role-based access control and the principle of least privilege. Administrative access is limited to authorised personnel and protected by strong authentication, including multi-factor authentication. Access approvals are logged and reviewed regularly. Support tools are segregated from production systems, with controlled, auditable access to customer data only when required. All access activity is monitored, and permissions are promptly revoked when staff change roles or leave the organisation.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Metastreet operates a formal information security management framework aligned to ISO/IEC 27001 and UK government cloud security principles. Core policies include an Information Security Policy, Data Protection Policy, Security Incident Management Policy, Access Control Policy, and New Starters and Leavers process. These define requirements for data handling, encryption, access control, incident response, and supplier management. Overall accountability for information security sits with the Director, supported by senior technical leadership. Day-to-day controls are embedded into engineering, operations, and support workflows, including least-privilege access, MFA, secure development practices, and audit logging. Compliance is assured through regular internal reviews, independent external penetration testing, annual policy reviews, and ongoing risk assessment. Staff receive security and data-protection training, and adherence to policies forms part of operational procedures. Security incidents are formally logged, assessed, and reported in line with defined escalation and notification timelines, including statutory reporting where required.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Metastreet operates formal, supplier-defined configuration and change management processes aligned with ISO/IEC 27001 principles and the UK government’s Operational Security guidance. System configurations are version-controlled and changes follow a structured lifecycle: request, impact assessment, peer review, testing, approval, and controlled deployment through CI/CD pipelines. Changes are logged and auditable, with separation between development, test, and production environments. Automated monitoring and rollback procedures are in place to minimise risk and restore service quickly if issues arise. Emergency changes follow an expedited but documented approval process, with post-implementation review to ensure continued security and stability.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Metastreet follows a supplier-defined vulnerability management process aligned with ISO/IEC 27001 principles and UK government operational security guidance. Potential threats are assessed through continuous monitoring, risk-based reviews, and regular external penetration testing by a CREST-approved provider. Vulnerabilities are prioritised by severity and potential customer impact. Critical patches are deployed urgently, while lower-risk updates follow controlled release cycles with testing and rollback procedures. Threat intelligence is sourced from AWS security advisories, software vendors, dependency disclosures, NCSC guidance, and recognised vulnerability feeds such as CVE databases. All findings are tracked to resolution with management oversight.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Metastreet operates supplier-defined protective monitoring aligned with ISO/IEC 27001 principles and UK government operational security guidance. Potential compromises are identified through continuous monitoring of system health, security events, access logs, and anomalous behaviour across the platform. Automated alerts support rapid detection and investigation. When a potential compromise is identified, incidents are logged, triaged by severity, and containment actions taken where required, followed by remediation and recovery. Incidents are escalated to senior management and customers are notified where appropriate. Critical security incidents are investigated and acted upon immediately, with lower-severity events addressed within defined operational timescales.
• Incident management type: Supplier-defined controls
• Incident management approach: Metastreet operates a formal incident management process aligned with ISO/IEC 27001 principles and UK government operational security guidance. Pre-defined procedures exist for common security and service events, including outages, data incidents, and performance degradation. Users can report incidents via the support service desk or by contacting the operations team directly. Incidents are logged, triaged, and managed according to severity, with escalation to senior management where required. Customers are kept informed during incidents through direct communications and status updates. Following resolution, incident reports and post-incident summaries are provided where appropriate, including root cause and corrective actions.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Metastreet provides a sandbox trial environment, allowing buyers to explore core functionality safely using non-live data. In addition, other Metastreet modules can be made available on a time-limited trial basis, typically up to six weeks, subject to agreement and onboarding status.
• Link to free trial: Contact team@metastreet.co.uk for a demo

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 7%
• Between £1,000,001 and £2,500,000: 9%
• Between £2,500,001 and £5,000,000: 11%
• Over £5,000,001: 13%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: Citation ISO
• ISO/IEC 27001 accreditation date: Friday 1 November 2024
• What the ISO/IEC 27001 doesn’t cover: No parts excluded
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: Yes
• PCI DSS certification accredited by: Stripe (self certification)
• PCI DSS accreditation date: Monday 10 November 2025
• What the PCI DSS doesn’t cover: No parts excluded
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 9ccd6bf9-4db7-4ba0-ad56-a985c83e04de
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at team@metastreet.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.