SYNECTICS SOLUTIONS LIMITED

Sonar

Sonar is an ongoing risk monitoring service that provides continuous screening of existing customer portfolios to support compliance with the Money Laundering Regulations. It enables organisations to monitor back book customers for emerging risk indicators, supporting timely identification, review and management of financial crime risk.

Features

• Continuous customer risk monitoring
• Automated screening of back book customers
• Configurable risk rules and thresholds
• Real-time alert generation
• Secure cloud-based processing
• Web-based user interface
• API integration for system connectivity
• Audit logging and traceability
• Compliance reporting tools

Benefits

• Continuously monitor customers for emerging risk
• Reduce manual periodic review effort
• Detect financial crime risk earlier
• Support compliance with money laundering regulations
• Prioritise high-risk customers efficiently
• Improve consistency of monitoring decisions
• Reduce operational burden
• Strengthen ongoing due diligence
• Scale monitoring across large portfolios

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at publicsectorservices@synectics-solutions.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

558213864493709

Contact

Louise Williams
0333 234 3409
publicsectorservices@synectics-solutions.com

About your service

• Service categories:

  Applications

  Enterprise resource management

  Financial

  • Treasury and Risk Management Applications
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes
• What software services is the service an extension to: Sonar is not an extension of third-party software services. It is commonly used in conjunction with SIRA and National SIRA, extending their capabilities by providing continuous, ongoing risk monitoring of existing customer portfolios.
• Cloud deployment model: Private cloud
• Service constraints: Sonar is delivered as a cloud-hosted SaaS service and requires network connectivity and a supported web browser or system integration. Service effectiveness depends on the availability and quality of customer-provided data. Planned maintenance is carried out during scheduled maintenance windows. Bespoke functionality beyond agreed configuration may require additional professional services.
• System requirements:
  • Modern, standards-compliant web browser
  • Secure internet connectivity
  • HTTPS access enabled
  • Supported desktop or laptop device
  • API connectivity for integrations
  • Secure data transfer capability
  • Data conforming to provided schema

User support

• Email or online ticketing support: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes
• Support levels: Synectics Solutions provides structured support for the Sonar service in line with agreed service level agreements. Sonar includes Help Desk support for 12 hours per day as standard, delivered via telephone. Extended support, including 24-hour cover, can be provided where required at additional cost.; ; Once onboarded, customers are assigned a Client Success Manager at no additional cost. The Client Success Manager provides general assistance, acts as a primary point of contact, and supports the raising and coordination of issues with the Help Desk.; ; Standard Help Desk support and Client Success Manager services are included in the service price. Extended hours, 24-hour support or additional specialist support services are available at additional cost and are agreed on a case-by-case basis.; ; Where required, dedicated technical account management or specialist cloud support engineers can be provided as part of enhanced support arrangements, subject to agreement and additional cost.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Synectics Solutions supports users in getting started with Sonar through a structured onboarding process. A dedicated Project Manager is assigned to take overall responsibility for the project plan, coordinate and support onboarding, and lead implementation and production rollout. The Project Manager also provides full training on the solution, delivered remotely or on-site as required, ensuring users are fully supported from initial setup through to live operation.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: When the contract ends, Synectics Solutions works with the customer to support data extraction in line with the termination policies defined in the contract. Data is provided in agreed formats and transferred securely prior to service termination, ensuring a controlled and compliant exit process.
• End-of-contract process: At the end of the contract, Synectics Solutions works with the customer to agree the service exit process, including data extraction, service disablement and data deletion, in line with contractual terms. Once termination is confirmed, the service is disabled and fully decommissioned, and customer data is securely deleted following agreed processes.; ; Standard end-of-contract activities, including coordination of service shutdown, data extraction in agreed formats and confirmation of decommissioning, are included in the contract price. Any additional or non-standard activities, such as extended access periods, bespoke data handling or additional support, may be provided at additional cost subject to agreement.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Onboarding and offboarding documentation for Sonar is provided in standard digital formats that are accessible via commonly used devices and assistive technologies. Where required, Synectics Solutions works with customers to provide documentation in alternative formats or to offer additional support during onboarding and offboarding to accommodate individual accessibility needs.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: Sonar is accessed through a secure, web-based user interface. Users are presented with a loading screen for referred enquiries and can monitor high-risk customers using watch list and diary functions. The interface includes screens for rule administration, task management and reporting. All functionality and screens are controlled through role-based permissions to ensure appropriate access.
• Accessibility standards: None or don’t know
• Description of accessibility: Sonar is accessed through a secure, web-based user interface available via standard browsers. Users can review referred enquiries, monitor high-risk customers using watch list and diary functions, manage tasks, administer rules and view reports, subject to role-based permissions. The interface supports standard browser accessibility features, allowing users to apply their own accessibility and assistive technology settings.; ; Access to functionality is controlled through role-based access controls to ensure users only interact with features relevant to their role. Users cannot modify core risk models, underlying system logic or access screens and data outside their authorised permissions.
• Accessibility testing: Formal interface testing with users of assistive technology has not yet been undertaken for Sonar. Accessibility considerations are being addressed as part of ongoing user interface updates, with internal usability and quality assurance testing used to review core user journeys. Feedback from users is considered, and further accessibility testing, including with assistive technologies, is planned as the interface enhancements are delivered.
• API: Yes
• What users can and can't do using the API: Sonar does not provide a customer-facing API for service setup, data submission or configuration changes. Users cannot use an API to supply data to Sonar or retrieve results programmatically.; ; Service setup, onboarding and configuration changes are managed through the web-based user interface and agreed change processes rather than through an API. Users manage rules, tasks and monitoring activities through the interface, subject to role-based permissions.; ; Where required, Sonar can integrate with external systems by calling third-party services via their APIs to support screening or enrichment. These integrations are implemented and managed by Synectics Solutions and are not controlled directly by end users.; ; As no customer-facing API is provided, users cannot automate configuration, data ingestion or reporting through API access. This ensures controlled operation of the service and protects the integrity of the underlying monitoring and risk assessment processes.
• API documentation: No
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: Users can customise Sonar to meet their operational and compliance needs through configurable service options.; ; The matching ruleset can be fully customised to user specification. Alert handling is configurable through permission-based task lists and workflows, enabling organisations to align alert management with their internal processes and roles.; ; Customisation is performed through configuration options within the service interface and agreed during onboarding or via formal change requests. Changes do not require code changes where standard configuration is used.; ; Customisation is carried out by authorised customer users, such as administrators, with support from Synectics Solutions where required. Customisations outside the standard configuration, or requiring changes to core functionality, may require developer resources and can incur additional costs.

Scaling

• Independence of resources: Synectics Solutions ensures users are not adversely affected by demand from other users through a resilient and scalable service architecture. Capacity and performance are regularly tested to confirm sufficient headroom. Load balancing is used to distribute demand efficiently, supported by multiple internet connections and redundant components to provide resilience and consistent service performance across users.

Analytics

• Service usage metrics: Yes
• Metrics types: Sonar provides service metrics to support monitoring, audit and service management. Standard and bespoke reports are available covering contracted service levels, service usage and user activity. Reporting supports oversight of performance, compliance and auditing requirements, and can be tailored to customer needs where required.
• Reporting types: Regular reports
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Primarily through the reporting suite embedded in the User Interface.
• Data export formats:
  • CSV
  • Other
• Other data export formats: XLSx
• Data import formats: Other
• Other data import formats: Pipe delimited text files

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Synectics Solutions guarantees **98% service availability**, measured in accordance with the customer’s agreed service level agreement. Planned development, upgrades and maintenance are carried out within scheduled maintenance windows and executed outside normal operating hours to minimise user impact.; ; Availability targets, measurement criteria and exclusions are defined in the SLA. Where guaranteed availability levels are not met, service credits or other remedies are applied in line with the contractual terms agreed with the customer.
• Approach to resilience: Sonar is designed with resilience built into both the application and infrastructure layers to protect assets and maintain availability. The service is load balanced across multiple virtual machines, enabling continued operation if individual components fail and allowing workloads to be migrated to new physical hardware when required. Systems are built to be highly fault tolerant, using dual power supplies and redundant network connections.; ; The service is hosted in highly resilient data centres equipped with uninterruptible power supplies, backup generators and FM200 fire suppression systems. Data centres are served by multiple internet service provider connections to ensure network resilience. A dedicated Business Continuity Management department oversees continuity planning, testing and response. Further details of the resilience architecture can be provided on request.
• Outage reporting: Service outages are reported directly to customers in line with contractual arrangements. Where an outage exceeds the customer’s contractual targets, Synectics Solutions notifies the client directly with details of the issue, estimated resolution times and proposed remediation. Notifications are typically provided via direct communication such as email or telephone. The service does not provide a public status dashboard or an outage reporting API.

Identity and authentication

• User authentication needed: Yes
• User authentication: Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is tightly controlled. Sonar users can only access the service from allow-listed IP addresses. Each client accesses a dedicated service instance identified by a unique domain. All users authenticate using unique user IDs verified by the application, with role-based access controls enforced. Client administrator accounts are provided to manage user provisioning, permissions and access levels within their organisation.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users receive audit information on a regular basis
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Cyber Essentials,; Specified Ant-Fraud Organisation (SAFO) Status
• Information security policies and processes: Synectics Solutions operates a formal Information Security Management System (ISMS) certified to **ISO/IEC 27001:2013**, supported by fully documented security policies and procedures.; ; Overall responsibility for information security rests with the **Chief Information Security Officer (CISO)**, who reports to the **Legal & Compliance Director**. An **ISMS Review Committee**, including at least one Director, meets twice annually to review security posture, risk and compliance. A **Security Strategy Group** meets fortnightly to oversee security governance. A dedicated **IT Security team** manages operational security, while **physical security** is the responsibility of the Facilities team.; ; Synectics adheres to **Cyber Essentials**, established **Security Operating Procedures (SyOPS)**, and **protective monitoring controls** selected from **GPG13**, informed by **IS1 risk assessments**. Monitoring is designed to protect **OFFICIAL** information. An assessment against **GPG43 (RSDOPS)** has been completed, systems have been continuously accredited since 2009, and all **14 government cloud security principles** are met in the secure delivery of services.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Configuration and change management processes are operated in line with ITIL V3.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Synectics Solutions operates a structured vulnerability management process aligned with its ISO/IEC 27001–certified ISMS. Potential threats are assessed through annual penetration and vulnerability testing, continuous monitoring and risk-based analysis. Where significant risks are identified, the Business Continuity Plan is invoked to manage remediation. Patch deployment follows a defined patching policy, prioritised by risk and severity. The IT Security team monitors multiple threat intelligence sources, including NCSC guidance, vendor advisories, AlienVault Open Threat Exchange and industry feeds, and participates in the NCSC Cyber Security Information Sharing Partnership (CiSP).
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Synectics Solutions operates protective monitoring in line with documented security policies and accredited RMADS. Potential compromises are identified through continuous monitoring using intrusion prevention and detection systems (IPS/IDS) and a Security Information and Event Management (SIEM) solution, providing oversight, assurance and user accountability. Annual penetration and vulnerability testing further supports detection of weaknesses.; ; When a potential compromise is identified, incidents are assessed, contained and investigated in accordance with the Information Security Incident Management policy. Response actions are prioritised by severity, with prompt escalation and remediation to minimise impact and reduce the risk of recurrence.
• Incident management type: Supplier-defined controls
• Incident management approach: Synectics Solutions operates a formal incident management process aligned with NCSC guidance, industry best practice and ISO/IEC 27035. Pre-defined processes and playbooks are in place for common security and service incidents, supported by documented escalation and response procedures. Users report incidents through dedicated helpdesk facilities via telephone or email. Incidents are assessed and managed in line with the Security Incident Management Policy, with remediation supported by relevant departmental Business Continuity Plans. Incident reports are provided to customers and can be reviewed during onsite visits or secure video conferences.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Sonar does not provide a free production version. A time-limited proof of concept can be offered to demonstrate how the service supports ongoing risk monitoring within existing processes. The proof of concept is scoped with the customer and excludes full production functionality.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BSI Assurance UK Ltd
• ISO/IEC 27001 accreditation date: Sunday 14 December 2025
• What the ISO/IEC 27001 doesn’t cover: There are no exclusions, it covers the entire organisation
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 5481ad36-f8b8-4fbf-a885-0fc0b874aed6
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 45d04f71-6b83-45f8-a067-3157e440a657
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Ensuring new workers are informed of their right to join a trade union
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain
    • How the supplier will work with NGOs, trade unions or other businesses to address modern slavery risk
    • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering
    • Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at publicsectorservices@synectics-solutions.com. Tell them what format you need. It will help if you say what assistive technology you use.