COREFILING LIMITED

True North Data Platform

The True North Data Platform (TNDP) is a regulatory reporting platform for the management and testing of XBRL taxonomies and thepreparation, submission, validation and transformation of financial and ESG reports.

Features

• Digital accounts filing
• XBRL validation
• Data modelling
• Taxonomy creation and maintenance
• Submission portal
• Data transformation
• Searching and extraction of iXBRL/XBRL data
• XBRL instance rendering and review
• GraphQL API suite for taxonomy editing and instance processing
• Webform and Excel submission capability

Benefits

• Allows a high-level of self service
• Hides complexity for average user
• Allows user to easily integrate with their own UX
• Supports high-volume submission of very large instances
• Easy integration with business automation of workflow
• Powerful analytics to drive up submission quality
• Easy on-boarding of new and amended mandates
• Filers do not require XBRL expertise

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@corefiling.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

585443400267460

Contact

John Doyle
01865 203192
tenders@corefiling.com

About your service

• Service categories:

  Applications

  Enterprise resource management

  Financial

  • Financial and Accounting Applications
  • Corporate Tax Management Applications
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: None
• System requirements:
  • Typically client wants to use own user directory
  • Browser (Chrome, Edge, IE, Firefox, etc.)

User support

• Email or online ticketing support: Yes
• Support response times: Target response times are determined by the priority of the issue. Priorities range from 1 (business solution unavailable) to 4 (user query).
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: No
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: We offer a standard support model which includes the services of an account manager. Support is not charged separately but is included in the annual subscription.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We provide on-site and on-line training and documentation. For major engagements we assign a project manager who will start by arranging a requirements workshop.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: THe nature of our business is that filed accounts and prudential reports are held in a document store according to the retention requirements of the client. At contract end the contents of this store can be transferred electronically.
• End-of-contract process: Subscription contracts automatically renew unless terminated by either party. In the event of termination, any client data is destroyed or returned and access to the platform is removed. There is no charge for off-boarding in line with the contract termination provisions.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Distributed as PDF by project and IT management. Installation guides can also be downloaded directly from our software portal.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 A
• Description of service interface: The service interface with TNDP consists of APIs delivered over HTTPS. These are either REST APIs or GraphQL APIs; where file uploads are required, these are in one of the standard XBRL formats (XBRL, iXBRL or OIM CSV/JSON). Authentication and authorization are handled via OAuth2/OpenID Connect.
• Accessibility standards: None or don’t know
• Description of accessibility: Accessibility standards do not directly apply to our primary service interface, which is APIs. However where our browser based user interface is used, we have our own accessibility standard which follows the WCAG standards as closely as is feasible.
• Accessibility testing: Our staff perform ad-hoc manual testing using screen readers and filters to simulate the most common types of colour blindness; however we have not done formal testing with users of assistive technlology.
• API: Yes
• What users can and can't do using the API: Every action which users can do through the graphical user interface is available via the API.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • PDF
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: The service is hosted on AWS which provides a scalable platform and the TNDP scales horizontally to ensure sufficient capacity to deal with all user's workloads.

Analytics

• Service usage metrics: Yes
• Metrics types: Usage metrics are included in periodic account review and B2B usage reports.
• Reporting types:
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: In-house destruction process
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: Data is exported in SQL, CSV or JSON. Data transformation and export is a standard feature of the service.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • JSON
  • SQL
  • XML
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • JSON
  • XBRL
  • IXBRL
  • XML

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Standard target availability is 99.5%.; We do not provide refunds for missing this target.
• Approach to resilience: The service deployed into multiple AWS Availability Zones. Automated management systems monitor nodes and software services for failures and will restart or replace them as required. Further details available on request.
• Outage reporting: Clients are notified by our Support Team.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Management Interfaces require end-user authentication using individually issued credentials.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: The information security management system is built upon an information security policy framework. In conjunction with this policy, the following policies make up the policy framework:; ; AcceptableUsagePolicy; AccessControlPolicy; BackupPolicy; BusinessContinuityPolicy; ChangeManagementPolicy; ClearDeskPolicy; ContinualImprovementPolicy; CryptographicControlPolicy; InformationClassificationAndHandlingPolicy; InformationSecurityAwarenessAndTrainingPolicy; InformationTransferPolicy; MobileAndTeleworkingPolicy; PasswordPolicy; PhysicalAndEnvironmentalSecurityPolicy; PrivacyPolicy; RecordsManagementPolicy; RemovableMediaPolicy; SecureDevelopmentPolicy; SecurityUpdatePolicy; SoftwarePolicy; SystemManagementPolicy; ; These policies are made readily and easily available to all employees and third-party users.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: For deployment of configuration and software changes to hosted production systems used by clients, all changes go through a change request and approval process including review and sign off from relevant staff including representatives from the infrastructure, QA and development teams to ensure that potential impacts are considered.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Threat and vulnerability information is obtained from our external penetration testing, frequent vulnerability scans and engagement with specialist security firms. Patches to critical issues occur within 1 day.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Services are continually monitored, with centralized logging and intelligent threat detection services including AWS GuardDuty. Incident response follows a planned incident response procedure with timelines dependent on severity.
• Incident management type: Supplier-defined controls
• Incident management approach: CoreFiling has a defined Incident Response Procedure. Users report incidents via our support team, who are also responsible for providing clients with incident updates and reports.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Temporary access and documentation to our TNDP platform for evaluation purposes. Typically for no more than 3-months duration.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Amtivo Group Ltd T/A British Assessment Bureau Ltd
• ISO/IEC 27001 accreditation date: Monday 28 July 2025
• What the ISO/IEC 27001 doesn’t cover: Nothing specified.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: C2a17d93-856b-4a2e-be3f-8ea575d529c3
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Other measures to offer development opportunities for the target cohort(s) in the contract workforce
    • Creation of outreach activities to create a pipeline of employees for the future contract delivery

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@corefiling.com. Tell them what format you need. It will help if you say what assistive technology you use.