SAN DIGITAL LIMITED

San Digital Data & AI SaaS Platform

A configurable SaaS platform delivering secure web applications and AI-enabled workflows. Provides reusable modules for authentication, role-based access, data capture, workflow automation, reporting and optional AI capabilities (search, summarisation, document handling). Deployable in buyer's chosen cloud environment with UK data residency, security monitoring, backup and incident management controls.

Features

• Custom SaaS applications with embedded AI workflows and automation
• Secure document ingestion, classification, and AI-assisted data extraction
• Configurable AI models integrated into business processes and applications
• API-driven integration with existing enterprise systems and data sources
• Human-in-the-loop controls for AI outputs and approvals
• Role-based access control and audit logging across services
• Cloud-hosted deployment with optional private or hybrid configurations
• Model monitoring, versioning, and controlled lifecycle management

Benefits

• Automate complex processes while maintaining human oversight and control
• Reduce manual document handling and operational processing time
• Embed AI safely into existing workflows without replacing core systems
• Improve decision-making with consistent, auditable AI outputs
• Scale AI usage across teams without increasing operational complexity
• Maintain compliance through controlled access and transparent AI behaviour
• Accelerate delivery of bespoke digital services tailored to organisational needs
• Lower long-term costs through reusable SaaS and AI components

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at lee.crossley@sandigital.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

591115287153345

Contact

Lee Crossley
07515495891
lee.crossley@sandigital.uk

About your service

• Service categories:

  Application Development and Deployment

  AI platforms

  AI software services

  • Generative AI Software Services
  • Document AI Software Services
  • Forecast AI Software Services
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Cloud platforms and enterprise systems including Microsoft Azure services, identity providers, data platforms, and existing line-of-business applications used by public sector organisations.
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: The service requires internet connectivity for cloud-hosted deployments.; Some AI features depend on the availability and quality of customer data.; Certain advanced capabilities may require configuration or integration effort.; Performance and availability are dependent on the chosen cloud environment.
• System requirements:
  • Modern web browser (Chrome, Edge, Firefox, Safari)
  • Supported operating system (Windows, macOS, Linux)
  • Secure network connectivity to cloud services
  • Buyer-managed identity and access controls

User support

• Email or online ticketing support: Yes
• Support response times: We respond within one business day during UK business hours.; Limited monitoring outside business hours, responses next working day.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Standard support (included); Email or online ticketing support during UK business hours.; Responses within one business day.; Support provided by experienced cloud and software engineers.; ; Enhanced support (optional, at additional cost); Agreed response times and priority handling.; Extended support hours if required.; Optional named technical contact or cloud support engineer.; ; Technical account management; A named technical account manager or cloud support engineer can be provided.; ; Pricing; Standard support is included in the service price.; Enhanced support and named contacts are priced on request, depending on scope and service level.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: San Digital supports buyers to get started through a structured onboarding process tailored to the service and buyer needs. This typically includes initial configuration, user setup, and guidance on integrating the service with existing systems where required.; ; Users are provided with online documentation and onboarding materials covering core features, configuration options, and best practice usage. Remote onboarding sessions and walkthroughs can be provided during implementation to support administrators and key users.; ; Additional training, workshops, or onsite support can be provided by agreement where required, at additional cost. Ongoing support is available through email or online ticketing during UK business hours.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: At the end of the contract, buyers can request extraction of their data in commonly used, machine-readable formats. Data can be exported via the service interface or API, depending on the data type and configuration.; ; San Digital will support buyers during offboarding to ensure data is provided in an agreed format and within agreed timescales. This includes structured data, configuration data, and user-generated content relevant to the service. Data belonging to other tenants is not included.; ; Where required, San Digital can provide guidance to support migration to alternative systems. Additional support beyond standard offboarding can be provided by agreement.; ; Following confirmation that data extraction has been completed, buyer data is securely deleted in line with contractual and data protection requirements.
• End-of-contract process: At the end of the contract, the service is transitioned into an offboarding period. During this time, buyers can extract their data using the service’s standard export tools or API. Standard offboarding support, including data extraction and guidance, is included in the contract price.; ; Once data extraction has been completed and confirmed by the buyer, access to the service is removed and buyer data is securely deleted in accordance with contractual terms and data protection requirements.; ; Any additional offboarding support beyond standard data extraction (such as extended access periods, bespoke data transformations, or additional migration assistance) can be provided by agreement and may incur additional cost.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The service is accessible via modern mobile web browsers.; Core functionality is available on mobile, with reduced screen-optimised layouts compared to desktop.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: The service is accessed through a secure, browser-based web interface. It provides role-based access to application features, data visualisation, configuration and administrative controls. The interface is designed to be responsive, supporting desktop and mobile browsers, and integrates with external systems via APIs where required. No client-side installation is required.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Accessibility is considered throughout design and development. The service interface is built using semantic HTML, appropriate colour contrast, keyboard navigation support and ARIA attributes where required. Accessibility checks are carried out during development using automated testing tools and manual review. User feedback is incorporated where accessibility issues are identified. Formal third-party accessibility audits can be commissioned if required by buyers.
• API: Yes
• What users can and can't do using the API: The service provides a secure, documented API that allows authorised users to integrate the service with other systems and automate workflows. Users can use the API to manage core resources, submit and retrieve data, trigger processing or analysis tasks, and read service outputs. Configuration and operational changes supported by the API are subject to role-based access controls.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Buyers can customise the service to meet their organisational and operational requirements. Configurable options include user roles and permissions, workflows, data models, integrations, dashboards and reporting, and feature enablement. AI-related capabilities can be configured to use buyer-provided data sources, models, prompts, or policies where applicable.; ; Customisation is primarily performed by authorised buyer administrators through the service interface or API. Some advanced configuration, integrations, or changes to service behaviour may be delivered by San Digital as part of onboarding or through agreed change requests.; ; End users can personalise aspects of their own experience, such as views, notifications, and saved queries, within the limits set by administrators.; ; All customisation is subject to security controls and does not affect the underlying shared platform or other tenants.

Scaling

• Independence of resources: The service is designed using multi-tenant architecture with logical separation between customers. Resource usage is monitored and managed to prevent one user’s activity from adversely affecting others. Platform capacity is scaled and managed to maintain consistent performance. Where required, resource limits and controls are applied to ensure fair usage across tenants.

Analytics

• Service usage metrics: Yes
• Metrics types: The service provides usage and operational metrics to help buyers understand how the service is being used. Metrics may include user activity, feature usage, data volumes, processing events, and basic service performance indicators. Metrics are tenant-specific and accessible only to authorised users. Metrics are intended to support operational monitoring, service optimisation, and reporting.
• Reporting types:
  • API access
  • Real-time dashboards
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure

Data importing and exporting

• Data export approach: Users can export their data using built-in export functionality through the service interface or via the service API. Data exports can be initiated by authorised users and are provided in commonly used, machine-readable formats. Exports can be performed on demand or as part of agreed offboarding processes. Access controls ensure users can only export their own data.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • JSON
  • NDJSON
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • JSON
  • NDJSON

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: We target 99.5% monthly availability, excluding planned maintenance. Service credits may be applied where availability falls below this level, as defined in the contract.
• Approach to resilience: The service is built using a cloud-native, fault-tolerant architecture hosted in UK-based datacentres on a hyperscale cloud platform. Components are deployed across multiple availability zones with automated health checks, load balancing and self-healing. Data is replicated and backed up within the UK. Datacentres provide resilient power, cooling and network connectivity. Detailed resilience and disaster recovery information is available on request.
• Outage reporting: Outages are reported via email alerts and the support ticketing system. Infrastructure-related incidents may also be referenced through the cloud provider’s public service health dashboard. API-based outage reporting is not currently provided. Major incidents are tracked and communicated until resolution, with post-incident summaries available on request.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is restricted using role-based access controls and the principle of least privilege. Administrative access is limited to authorised personnel and protected by strong authentication. Support requests are logged and managed through controlled ticketing systems, with access restricted to appropriate support staff. User access and permissions are reviewed and adjusted as required.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: Security governance is led at director level and supported by documented policies and procedures. Secure development practices, access control, incident management and supplier assurance are reviewed regularly. Physical and infrastructure security is provided by the underlying cloud provider, with governance oversight retained by San Digital.
• Information security policies and processes: San Digital follows information security policies and processes including access control, identity and authentication management, data protection and handling, secure software development, vulnerability management, incident response, backup and recovery, and supplier security assurance. Security responsibilities are owned at director level and implemented through documented procedures, with regular review and management oversight.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Service components are version-controlled and tracked throughout their lifecycle using source control and deployment tooling. Changes are proposed, reviewed and approved before release, with testing performed prior to deployment. Security impact is assessed as part of change review, including consideration of access, data handling and dependencies. Changes are logged and can be rolled back if required. Emergency changes follow defined procedures with post-change review.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Potential threats are assessed through a combination of automated vulnerability scanning, code review, dependency monitoring and review of system changes. Identified vulnerabilities are risk-assessed based on severity, exposure and potential impact. Patches and mitigations are prioritised accordingly and deployed in line with defined change management processes, with critical issues addressed as soon as practicable. Information about potential threats is sourced from cloud provider security advisories, vendor notifications, industry best practice sources, and public vulnerability databases such as CVE listings.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: The service uses logging, monitoring and alerting to identify unusual or potentially malicious activity. Logs are reviewed and alerts investigated to identify potential compromises. When a potential incident is identified, access may be restricted, affected components isolated, and investigation initiated in line with the incident management process. Incidents are prioritised by severity, with critical incidents responded to as soon as practicable. Buyers are informed of confirmed security incidents in accordance with contractual and regulatory requirements.
• Incident management type: Supplier-defined controls
• Incident management approach: San Digital follows documented incident management processes covering common events such as service disruption, security incidents and data issues. Users can report incidents via email or the online support ticketing system. Incidents are logged, assessed and prioritised based on severity, with appropriate response and escalation. For significant incidents, affected users are informed and an incident summary or report can be provided on request, including actions taken and any follow-up measures.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: A time-limited evaluation version is available by request. It includes access to core functionality in a non-production environment with usage limits. Advanced features, integrations, customisation and production support are excluded. Trial duration and scope are agreed in advance and may be restricted.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 2%
• Between £500,001 and £1,000,000: 4%
• Between £1,000,001 and £2,500,000: 6%
• Between £2,500,001 and £5,000,000: 8%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 0c5d3da8-0fbf-4984-bdaf-badca42a1c8f
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at lee.crossley@sandigital.uk. Tell them what format you need. It will help if you say what assistive technology you use.