PHONEHUB IO LTD

Prison Email

Prison Email is a secure end-to-end encrypted emailing service purpose built for secure environments. Ensuring that all communications remain identity-verified, secure, and auditable. The service incorporates communication monitoring with safeguarding, regulatory, and security policies to support early identification of negative behaviours, trends, and communication patterns that may indicate safeguarding/security risks.

Features

• Secure and automatic ID verification.
• Automatic content scanning.
• Automatic attachments scanning and blocking of policy‑violating content.
• Flexible configurations, policy enforcement and access revocation.
• Configurable retention and deletion policies.
• Administrative dashboard for reviewing activity and managing access.
• End‑to‑end encrypted sending and receiving of emails.
• Purpose-built for secure environments such as prisons and secure hospitals.

Benefits

• Support the identification of safeguarding concerns e.g., coercion, coded communication.
• Identify cases of indecent imagery/nudity and block policy-violating content.
• The service can be configured and scaled to establishment requirements.
• Full operational oversight and possess the ability to revoke access.
• All communications are recorded, according to policy and instantly retrievable.
• Access to communications is restricted, controlled, and audited.
• Detailed data can be extracted directly from the monitoring interface.
• End-to-end encryption prevents interception, tampering, or unauthorised access.
• Reduce staff resource requirement by automating monitoring
• Reduce social isolation that might otherwise lead to negative behaviour.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@phonehub.io. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

624584773562174

Contact

Alex Redston
01603340589
info@phonehub.io

About your service

• Service categories:

  Applications

  Collaborative

  • Email
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: None
• System requirements:
  • Android 6+ or iOS 10.2 and above for external user.
  • Internet speed 0.8 Mbps up, 1.6 Mbps down per terminal
  • Chromium based Browser or Android tablet for prisoners, or residents.

User support

• Email or online ticketing support: Yes
• Support response times: During normal business hours we aim to respond within 2 hours.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), 7 days a week
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 A
• Web chat accessibility testing: Our web chat is an extension of our email ticketing system powered by Zendesk, who endeavour to meet or exceed WCAG 2.1 AA wherever possible
• Onsite support: Yes
• Support levels: We provide support for both prison staff by email and telephone call with remote access via VPN for technical support staff where required. All prisons have a direct named contact who can be reached 7 days of the week. Phone and email support goes directly to both technical and customer service team. All queries responded to rapidly, typically within 1 hour. Technical support available within similar timeframes. We operate as a social venture putting social impact above profit, therefore we do not charge for technical support where it is our software or service which is at fault. Where equipment may have been damaged by prisoners or another external cause we will charge an appropriate amount to cover our reasonable expenses and the replacement of any items which have physically failed or been broken.
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: Onsite installation and training is provided for prison staff and management. Detailed documentation is included for reference, including training videos. Documentation and instruction materials are provided for end users, including video guides.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Users can extract all required data, including reports and usage stats, directly from the management portal. Data can be downloaded in standard formats suitable for secure storage or transfer. If additional assistance is required at the end of the contract, we will support staff in completing data extraction and confirming that all necessary information has been retrieved. After the contract ends, data is retained or deleted in line with contractual and statutory requirements. At the customer’s request, we can provide confirmation of deletion once retention periods have been met. These extraction capabilities are included within the service; optional bespoke exports outside the standard portal tools can be provided at additional cost if required.
• End-of-contract process: We will provide reasonable handover assistance where specified in the contract, including knowledge transfer and access management support. All customer data will be returned or securely deleted in accordance with contractual and statutory requirements.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: We take on board the core principles of WCAG 2.2 when designing all documentation, to ensure that our materials are perceivable, operable, understandable, and robust wherever possible. We try to ensure that all information and instructions are clear and navigation methods should be easy to understand and use. Where training videos are used, captions are generated.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Linux or Unix
  • MacOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Professional users can use the service from their work laptops, mobiles or tablets. Social users can access it from their mobile device / tablet via an app. Residents access the service via a browser. All methods are similar in user experience.
• Service interface: Yes
• User support accessibility: EN 301 549
• Description of service interface: The service interface is a secure web dashboard that allows staff to review, manage and monitor email communications between residents and their approved contacts. Users can search and filter messages, manage permissions and view communication histories. Access is role-based and available through chromium web browsers.
• Accessibility standards: None or don’t know
• Description of accessibility: Our service interface has been built using the GOV.UK Design System. We took this decision to build on the Design System’s strong accessibility foundations and its alignment with WCAG 2.2 AA requirements.; ; Additionally, we test key user journeys against the WCAG principles to ensure the interface is perceivable (clear structure and readable content), operable (keyboard-accessible), understandable (consistent layouts and predictable interactions) and robust (compatible with assistive technologies).
• Accessibility testing: We have carried out basic accessibility testing using screen-reader and text-to-speech tools to ensure key user journeys can be completed non-visually. This included checking page structure, form labels, focus order and navigation. Issues identified during testing were addressed to improve clarity and compatibility with assistive technologies.
• API: Yes
• What users can and can't do using the API: The API allows establishments to integrate the service into their existing systems and automate key workflows. Through the API, users can generate usage reports, schedule visits, upload identity documents, retrieve and manage contact lists, edit relationships, and view or update restrictions on resident communications.; ; The API can also be used to customise certain elements of the service to meet local operational needs.
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Prison Email behaviour can be customised at a jurisdiction level, individual establishment level or for an individual prisoner.; ; Customisation can include service parameters, AI behaviour, end user device integration, custom network configuration, booking systems, user management and general service portal operation; ; API integration including Open ID connect or O-Auth or service user information may also be customised.; ; All customisations are managed through regular service review meetings.; ; Restrictions can be managed by prison staff with the appropriate role.; ; Customisations are made by our in-house, full-time development team and we will consider all suggestions made by customers.

Scaling

• Independence of resources: Our service runs on Kubernetes in Google Cloud. Each product environment has its own cluster and project, which keeps workloads separate and avoids customers affecting each other. We set resource limits on each cluster so that no single process can use all the CPU or memory.Capacity automatically scales to meet scheduled demand. All hardware and network connections are chosen to be highly scalable. If demand increases, we can scale the cluster to add more capacity, so one customer’s usage doesn’t impact anyone else.

Analytics

• Service usage metrics: Yes
• Metrics types: Number of emails by time period. Service usage. Security incidents, reasons for denied emails (for example, if an email was flagged as having indecent imagery and cancelled automatically as a result). Data can be provided by individual user, establishment, PGD, or the entire estate. Other custom analytics can be provided upon request.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Approved staff with the relevant role-based access control can export data in an encrypted format directly from the dashboard at any time using built-in export tools. Data can be downloaded in CSV or PDF formats without needing technical support.
• Data export formats:
  • CSV
  • ODF
  • Other
• Other data export formats: PDF
• Data import formats: Other
• Other data import formats: N/A

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Services are available 24/7, 365 days with guaranteed SLA of 99.9% of availability.
• Approach to resilience: Information available on request
• Outage reporting: Email alerts and a public dashboard where applicable.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Limited access network (for example PSN)
  • Username or password
• Access restrictions in management interfaces and support channels: Two-factor authentication required to access management interfaces and support interfaces. Access is restricted using Role Based Access Control to approved user accounts, VLAN on the network and access to the network interface. Routing restrictions are in place with registered MAC addresses on switch ports and access to the admin LAN is restricted to admin's only. VPN's are in place to ensure the data is secure during transit.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We follow security processes as documented in our Information Security Management System (ISMS) Policy Manual, based on ISO27001 standards.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Phonehub IO Ltd has a formal documented Change Management process in place as defined in its ISO27001 management system. The Change Management Board (CMB) meet weekly to approve or reject requests for changes, to ensure the integrity of the process.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: For known product vulnerabilities we regularly apply all operating system and software updates. Daily automated third party vulnerability scanning using tenable.io and Harbor.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Pervasive security controls with Next Generation Antivirus (NGAV); Endpoint Protection and Response (EDR); and Threat Graph.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Phonehub IO Ltd has a set of defined policies and procedures for incident management in accordance with ISO27001 best practice. The Information Security team will assess the seriousness of any situation and will take necessary action to limit any potential impact. All incidents are logged and reviewed.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 3%
• Between £1,000,001 and £2,500,000: 5%
• Between £2,500,001 and £5,000,000: 7%
• Over £5,000,001: 9%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: LRQA
• ISO/IEC 27001 accreditation date: Thursday 28 November 2024
• What the ISO/IEC 27001 doesn’t cover: The scope of our ISO27001 approval does not have any exclusions.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Eff8f530-c361-4261-9610-331aaae65c9d
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 9235c2de-5e8a-4631-a5da-b42c2510f91a
• Other security certifications: Yes
• Any other security certifications: IT Health Check

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
    • Other measures to offer development opportunities for the target cohort(s) in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@phonehub.io. Tell them what format you need. It will help if you say what assistive technology you use.