TOOLAGEN LIMITED

FraudOps - Fraud Investigation Management Platform

FraudOps is an AI-powered investigation management platform. It replaces spreadsheets and siloed tools with a single intelligent workbench, automating workflows, centralising evidence, and accelerating investigations—helping teams free up capacity, reduce leakage, and deliver faster, fairer, and fully compliant outcomes.

Features

• Centralised Investigation Case Management
• Workflow Automation & Task Orchestration
• AI-Powered Case Summaries & Insights
• Integrated Data & Intelligence Sources
• Smart Case Prioritisation & Triage
• Real-Time Dashboards & Management Information (MI)
• Evidence & Document Management
• Audit Trails & Compliance Controls
• Customisable Fraud Screening Workflows
• Agentic AI Investigator & Intelligence Agent

Benefits

• Faster Investigation Turnaround
• Increased Investigator Capacity
• Reduced Benefit Fraud Leakage
• Improved Operational Efficiency
• Greater Transparency & Control
• More Consistent Investigation Outcomes
• Stronger Regulatory Compliance
• Lower Operational Costs
• Better Investigator Experience
• Scalable Growth Without Complexity

Service documents

• Pricing document

  ODT

• Service definition document

  ODT

• Terms and conditions

  ODT

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@toolagen.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

595415596037888

Contact

Amar Galla
07931870343
sales@toolagen.com

About the service

• Service categories:
  • Applications
    • Production and operations
      • Service industry and public sector operations
        • Social Security Administration
        • Adult Social Care
        • Children's Social Care
      • Other operations
        • Other operations
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: FraudOps is an investigation case management platform enhanced with an Agentic AI Investigator and intelligence agents to support investigative workflows. As a cloud-delivered service, it operates with scheduled maintenance windows for feature updates, fixes, and infrastructure upgrades, which are communicated in advance.; ; FraudOps is hosted on Microsoft Azure and can be deployed either in a FraudOps-managed tenant or a client-supplied Azure tenant, depending on security and governance requirements. Optimal value is achieved when FraudOps is adopted as the primary investigation workbench and required integrations are prioritised.
• System requirements: Any modern Browser

User support

• Email or online ticketing support: Yes
• Support response times: Standard support is available for UK business hours. Standard response times is within 1 business days. ; ; Higher response SLAs can be made available if needed.; ; Support is provided via an email ticketing portal.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Standard Support is included as part of our product. The Response times are : ; ; Emergency - 2 Business Hours; High - 2 Business Hours; Medium - 1 Business Days; Low - 2 Business Days; ; Bespoke Support Levels can be provided and quoted if needed including our of business hours support.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We would provide comprehensive onboarding support. It includes setting up the service as per the clients requirements, helping with any integrations and training users. Training can be done via Teams. For UK customers, onsite training can also be provided at an additional cost.; ; User Documentation & Help Guides are provided.
• Service documentation: Yes
• Documentation formats: PDF
• Documentation accessibility standard: WCAG 2.2 A
• End-of-contract data extraction: Data can be extracted as CSVs and files downloads when contract ends. It can also be requested via Support to extract and provide a full data dump along with all documents and files.
• End-of-contract process: There are no extra end of contract charges. When the contract ends, clients can request a full dump of their data if required and it will be uploaded to a file share as provided by the client. This will consist of a series of CSV files and documents.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: WCAG 2.2 A
• API: Yes
• What users can and can't do using the API: We have APIs which can be used to integrate with other line of business systems. Current APIs allow passing referrals and investigations, to generate a case in our system. We also have inbound email support to create a case via email.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: Each enterprise client is provisioned in their own Microsoft Azure subscription. For multi tenant version, each client has a separate database provisioned along with separate search indexes. Application services are scaled up as demand increases.

Analytics

• Service usage metrics: Yes
• Metrics types: There are detailed inbuild reports in the application where you can get these metrics.
• Reporting types: Real-time dashboards
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
• Equipment disposal approach: In-house destruction process

Data importing and exporting

• Data export approach: Users have detailed reports available in the application. Each report has a CSV export button which allows for immediate export.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: FraudOps targets 99.9% monthly availability, excluding scheduled maintenance. The platform is hosted on Microsoft Azure and designed for high resilience. In the event availability falls below the SLA, customers may receive service credits in accordance with contractual terms.
• Approach to resilience: We use the Microsoft Azure Cloud for our application. It is deployed as a containerised solution and uses Microsoft suggested practices for resiliency.
• Outage reporting: We have email alerts at this stage to report any outages. Future roadmap will include other options as appropriate.

Identity and authentication

• User authentication needed: Yes
• User authentication: Multi-Factor Authentication (MFA)
• Access restrictions in management interfaces and support channels: Only key people have access to management interfaces and support channels. All access is monitored and also supports MFA.
• Access restriction testing frequency: At least every 6 months
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: No
• Security governance approach: Our internal security governance is modelled around the security framework by UK National Cyber Security Centre (NCSC) “10 Steps to Cyber Security” guidance. For our Azure configurations, we currently follow the CIS Benchmark standards.
• Information security policies and processes: FraudOps operates an information security framework aligned to the UK National Cyber Security Centre (NCSC) “10 Steps to Cyber Security” guidance. Our policies cover governance, risk management, access control, secure development, incident response, and data protection.; ; Security oversight is led by senior management, with defined ownership for policy approval, implementation, and review. Policies are embedded into day-to-day operations through role-based access controls, secure development practices, regular reviews, and staff awareness. Compliance is monitored through internal checks and ongoing risk assessment, with policies reviewed and updated as the threat landscape evolves.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We are currently in the process of modelling our process based on CAIQ-Lite.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We are currently in the process of modelling our process based on CAIQ-Lite.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We are currently in the process of modelling our process based on CAIQ-Lite.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: Yes
• Incident management approach: We are currently in the process of modelling our process based on CAIQ-Lite.

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 5%
• Between £250,000 and £500,000: 10%
• Between £500,001 and £1,000,000: 15%
• Between £1,000,001 and £2,500,000: 20%
• Between £2,500,001 and £5,000,000: 20%
• Over £5,000,001: 20%

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Plans to engage the contract workforce in deciding the most important workplace issues to address
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Activities to cascade good practice on fair working conditions throughout the supply chain
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
  • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors

Service documents

• Pricing document

  ODT

• Service definition document

  ODT

• Terms and conditions

  ODT

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@toolagen.com. Tell them what format you need. It will help if you say what assistive technology you use.