Skip to main content

Help us improve the Digital Marketplace - send your feedback

Locata Housing Services Limited

Social Housing Solution: Homelessness, Housing Register, Housing Management & Housing Standards

LocataPro, a modern configurable platform of modules for the Social Housing Sector comprising:
Social Housing Register and Allocations (Choice Based Lettings or Direct Lettings),
Homelessness Reduction & Prevention Case Management,
Temporary Accommodation Management, Rent Accounting and Arrears Management,
Support Referrals Gateway,
Housing Management,
Private Sector Standards (HHSRS etc).

Features

  • Integrated Modules covering the various functions of Social Housing
  • Users can configure workflows, communication templates, Personal Housing Plans
  • Housing Client Portal - self-service referrals and keeping information current
  • Single login across integrated modules, consistent design and user experience
  • Off-The-Shelf product with free software upgrades and updates
  • Out-the-box report templates alongside custom report builder
  • Make notes, record communications, store unlimited documents, audit actions
  • Legislatively Compliant (e.g. Homelessness Reduction Act), with integrated statutory reporting
  • Role-Based Access Control - create roles to manager user permissions
  • Access detailed Knowledge Base, Community of Users and Support Site

Benefits

  • Cross-module information sharing and reduced duplication of work between services!
  • Value for Money - Easy system configuration without setup costs!
  • Client self-service tasks and referrals saves time, reducing administrative burdens
  • User-friendly, intuitive platform, easy training, quick on-boarding and simpler implementation
  • Utilise latest features with system improvements included, without additional costs
  • Easily monitor KPIs, quickly identify needs, respond to changing demands
  • Easily manage documents, no storage costs, easily audit case history
  • Statutory compliant processes, faster and easier statutory reporting (e.g H-CLIC)
  • Prevent unauthorised access to sensitive information, control system configuration
  • Cross-organisational collaboration, easily onboard users and access detailed training resources

Pricing

£9,500 a licence a year

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at enquiries@locata.org.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

6 3 2 9 9 5 9 2 2 2 3 9 7 3 9

Contact

Locata Housing Services Limited Peter Riley
Telephone: 01895 637595
Email: enquiries@locata.org.uk

Service scope

Software add-on or extension
No
Cloud deployment model
Public cloud
Service constraints
Maintenance is performed during times that will cause the least disruption to users, usually around midnight. Should site-specific maintenance be required, which could cause service disruption, we would only perform this with consent and agreement from the client.
Software is web-based so a modern, standards-compliant web browser (Chrome, Edge, Safari) and an internet connection are required.
All subscription fees include access to the software on an unlimited user basis.
System requirements
  • Internet Access
  • Modern, standards-compliant web browser (Chrome, Edge, iOS mobile safari)
  • Proxy servers must not cache the LocataPro domain

User support

Email or online ticketing support
Email or online ticketing
Support response times
Support is available via phone or email, Monday to Friday 9am - 5pm, excluding national bank holidays.

Support issues can be logged 24/7 by email and via the LocataPro Support Portal, where users can also track the progress of their tickets. Tickets are prioritised and responded to in-line with the Service Level Agreements published below.

•Critical issues – Senior Technical Consultant assigned within 1 working hour, resolution within 1 working day.
•For all other categories of support tickets - 99% of issues will be resolved within 5 working days but the average resolution time is less than 2 working days.
User can manage status and priority of support tickets
Yes
Online ticketing support accessibility
WCAG 2.1 AA or EN 301 549
Phone support
Yes
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
No
Onsite support
No
Support levels
When a fault is logged with our Support team, it is categorised on the following basis.

Critical - System is unavailable.
High - Critical functionality is unavailable.
Medium - Non-critical functionality is unavailable.
Low - Minor errors and cosmetic issues.

We aim to respond to and resolve faults in timescales relating to their priority, explained below:

Critical issues – Senior Technical Consultant assigned within 1 working hour, resolution within 1 working day.
For all other categories of support tickets, 99% of issues will be resolved within 5 working days and that the average resolution time is less than 2 working days.

In some scenarios, fixes for Medium and Low priority faults may be deployed with the next scheduled release. This will be clearly communicated and explained via the Support Site / ticket communication.
Support available to third parties
Yes

Onboarding and offboarding

Getting started
Onboarding can be broken down into the below stages:

1. Scoping: Locata consult with you to define which modules and bolt-ons are required to fully satisfy service requirements.
2. Deployment: we setup and provide a fully functional live site based on our out the box solution. We will also perform Super User Training here, so you can configure the system to meet your exact requirements.
3. Configuration: Using the available functionality within the applicable modules, the system is configured to local requirements. This can be performed by Local Super Users with relevant permissions using the powerful no code system functionality, or Locata can configure the system on your behalf, part of implementation consultancy.
4. Training and Go-Live: We provide end-user training and can also provide train-the-trainer training. During any training we also signpost to our detailed Helpsite articles which include videos and supplementary content to assist with learning to use all system functionality. Training can be via Microsoft Teams or on-site, with on-site being our recommended approach.
5. Business as Usual: We provide you with a dedicated Account Manager to assist you with day-to-day enquiries and to ensure you utilise our products to their fullest extent, maximising value for money.
Service documentation
Yes
Documentation formats
HTML
End-of-contract data extraction
For the entirety of the contract until the Expiry Date or End Date users are able to access and download data held on the system via our Reporting tools and GDPR functionality. If clients have the data warehouse bolt-on users can extract data from the data warehouse via ODBC or ADO.

If you require an alternative solution to the above, we are happy to discuss your requirements and this will be priced according to the SFIA Rate Card. We recommend that if you have alternative requirements, you communicate them to us at least 3 months prior to your intended termination date, so we can ensure data is available for testing prior to termination of your contract.

We will destroy all copies of your data when we receive written instructions to do so or 30 days after the End or Expiry Date. Written confirmation will be provided to you that the data has been destroyed.
End-of-contract process
If you would like to opt to cease using our services, we will begin the off-boarding process, following the Data Exit Plan agreed as part of your initial Call-Off Contract. On an agreed date and time, access to back-office and public sites will be disabled and amendments to data will no longer be possible. For the entirety of the contract you will be able to access and download any data held on the system by utilising the core reporting functionality of LocataPro. Data can be downloaded for each record individually too.

Following termination of service, all copies of your data will be securely destroyed upon your written instruction or 30 days after the contract end date, whichever is sooner. Written confirmation will be provided of the data’s destruction.

Should you require us to provide data in bulk or to host your data after the expiry end date additional charges may apply dependent on your requirement. This will be priced as per the SFIA Rate Card where extra costs are to be defined. We recommend that you put any requirements in writing at least 90 days prior to the end date of your contract.

Using the service

Web browser interface
Yes
Supported browsers
  • Microsoft Edge
  • Chrome
  • Safari
Application to install
No
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
There are no differences between the mobile and desktop service. LocataPro uses responsive design in its approach to web design and means web pages look great on a variety of devices, windows or screen sizes. This allows users and your customers to enjoy the websites when viewed across all devices, such as mobiles, tablets, laptop and desktop PC’s based browsers. With more than 96% of our interactions coming via the web, 85% plus of this traffic through mobiles and tablet platforms, has led us to adopt a Mobile First strategy going forward.
Service interface
Yes
User support accessibility
WCAG 2.1 AA or EN 301 549
Description of service interface
The web-based user interface allows both the back office and the client portal to access the system. The back office enables council’s staff and partner organisations achieve all actions using the same easy to use responsive platform. Moving between modules and screens is extremely easy and user friendly. System configuration is also done via the back office using the intuitive no code set up screens.
A programmatic interface is exposed via our API.
Additionally, our system supports import and export interfaces that enable bulk interactions via batch file that can be uploaded to our SFTP site.
Accessibility standards
WCAG 2.1 AA or EN 301 549
Accessibility testing
The back office and client portal are tested using Siteimprove and Axe accessibility testing tools to ensure that the meat public sector bodies accessibility requirements.

Public facing forms strictly adhere to the GOV.UK Design System (GDS) styling thus piggy backing off the research and experience of other service teams. By utilising GDS styling it ensures customers are familiar with our forms because they are consistent with other government forms.
API
Yes
What users can and can't do using the API
LocataPro’s API provides a set of RESTful web services that allow you to access and manipulate data in your LocataPro modules. You can find these web services at [your LocataPro system url]/api.
To use these web services, you need to send and receive data in JSON format, and authenticate your web requests with JSON Web Tokens (JWT). You also need to use https for all your calls.
The API offers a wide range of functionality, which you can request in detail. Some of the things you can do with the API are:
- Search for properties, clients, cases, people and bids.
- Create properties, clients, cases, people and bids.
- Read and write journals.
- View and edit data for properties, clients, cases, people and bids.
API documentation
Yes
API documentation formats
Open API (also known as Swagger)
API sandbox or test environment
Yes
Customisation available
Yes
Description of customisation
Various elements are available for local users with the applicable permissions to customise. Permissions can be controlled at a granular level, allowing for specific parts of the system to be adjusted by those users most appropriate without granting full "admin" controls.

Functionality available to customise on all modules includes:

- Workflows, Tasks and Questions,
- Communications Templates,
- Standard User Roles / Templates,
- Journal Categories,
- Applicant "Flags" (e.g. 2-person visit),

Additional functionality can be customised, which is module specific, some examples of which are given below:

- Providers and Services (HRS),
- Personal Housing Plans (HPA2),
- Patches (Lettings and Estates),
- Schedule of Rates (PSH),
- Case types (Estates),
- Rent Arrears Rules (Estates and TARA),

Also Users with appropriate permissions can initiate these customisations, ensuring that adjustments align with their operational needs. This approach promotes flexibility and efficiency, allowing Users to tailor the system to their specific requirements without compromising system integrity or security. By empowering Users to customise elements within their scope, the system facilitates seamless adaptation to evolving organisational processes and preferences.

Scaling

Independence of resources
Each client has their own dedicated database hosted in our Microsoft Azure subscription. We use Microsoft Azure cloud computing services for all of our infrastructure, which allows us to easily and quickly scale up our system. Our architecture has been designed in such a way that resources can be scaled up without interruption to the service. We use load balancers to monitor traffic and server availability. If a server fails, traffic is automatically redirected to a healthy server. Traffic is dynamically directed to the server with the most capacity.

Analytics

Service usage metrics
Yes
Metrics types
All service issues are logged on the support site which is monitored by our dedicated UK based support team. At all times the support team includes a senior support consultant, and dedicated triage officer who accesses issues within 2 hours and determines the appropriate next steps for resolution. We have real-time dashboards reporting on issues logged, issue severity and issue age. Over the past 12 months we have had an uptime of 99.99% there were 3157 tickets logged from 153 different organisations. The average resolution time for all tickets was 1.58 days. Reporting on issue statistics is available to clients.
Reporting types
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

Supplier type
Not a reseller

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Security Clearance (SC)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
Yes
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least once a year
Penetration testing approach
‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
Protecting data at rest
Physical access control, complying with CSA CCM v3.0
Data sanitisation process
Yes
Data sanitisation type
Explicit overwriting of storage before reallocation
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
The primary operational data extraction process is via our reporting tools. The majority of the data held within the system is accessible via our in built reporting tools. This can be output to csv and so subsequently ingested by other systems.
At an additional cost, charged as per the SFIA Rate Card, we can provide an Azure SQL database as a Data Warehouse that can be connected to via ADO or ODBC and used by other systems to perform an ETL process.
Documents can be downloaded via the GDPR functionality.
Data export formats
  • CSV
  • Other
Other data export formats
  • HTML
  • XML
  • PDF
  • ZIP
Data import formats
  • CSV
  • Other
Other data import formats
  • Xlsx
  • .bak
  • .bacpac

Data-in-transit protection

Data protection between buyer and supplier networks
TLS (version 1.2 or above)
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability
We utilise Microsoft Azure's scalability infrastructure and deployment slots to ensure a high level of availability. We warrant to 99.8% uptime, and aim to ensure it is higher than this. In order to achieve these performance levels, the data centres are monitored 24/7 and the operators alert us to any issues immediately.
In terms of systems availability, if we do not meet our warranted values above (99.8% availability), we offer to refund a multiplied pro rata rate of 1.5 times for the downtime listed above, up to a maximum of the annual subscription fee, per year.
Thus, for the avoidance of doubt and as an example, if a Client is paying £10,000 per annum and the system was down for one day over and above the tolerances defined, we would refund 1.5 x £10,000/365 up to a max of £10,000.
Approach to resilience
Our solutions run under Microsoft SQL server database management system. The servers are configured in always on availability groups, and the data is physically held within Microsoft Azure storage. The data in the Microsoft Azure storage account is always replicated to ensure durability and high availability. Azure Storage automatically backs up the data so that it is protected from planned and unplanned events, including transient hardware failures, network or power outages, and natural disasters.
As well as the automated continuous backup processing within Azure storage, full database backups are made weekly supplemented by daily differential backups and transaction log backups which take place every 15 minutes. This allows us point in time recovery.
The web servers are in availability sets of at least 2 servers each, so if a server fails or maintenance on a server is required, the load will be automatically switched to the other server in the set. So patches can be applied during office hours and zero day exploit patches can be applied as soon as Microsoft has the patch available.
Outage reporting
In the event of outages, our approach ensures transparent communication and access to information across all fronts. Each of our client websites and back-office systems is equipped with a public dashboard messaging service, facilitating real-time updates for users. As an added layer of resilience, our business websites, hosted separately, serve as a fail-safe mechanism. Additionally, we employ email alerts as a primary channel for disseminating critical information independently of other systems. Furthermore, all users benefit from access to our community forums, where we proactively communicate known issues and system outages. These forums are hosted on a third-party site and remain unaffected during system disruptions, ensuring continuous access to essential updates and support resources. Through this multi-faceted approach, we prioritise transparency, accessibility, and reliability, enabling effective communication and support even during challenging circumstances.

Identity and authentication

User authentication needed
Yes
User authentication
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
Access restrictions in management interfaces and support channels
Azure Role Based Access Control (RBAC) is used to control which members of staff have access to the data centre, and then which services and environments within that.

Access is strictly on a need-to-access basis, with no access by default.
Access restriction testing frequency
At least every 6 months
Management access authentication
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
User-defined
Access to supplier activity audit information
Users have access to real-time audit information
How long supplier audit data is stored for
User-defined
How long system logs are stored for
At least 12 months

Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
Microsoft Cloud
ISO/IEC 27001 accreditation date
02/01/2017
What the ISO/IEC 27001 doesn’t cover
Nothing is not covered
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Cyber essentials
Yes
Cyber essentials plus
No
Other security certifications
Yes
Any other security certifications
CREST certified pen tests

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
ISO/IEC 27001
Information security policies and processes
Our processes and procedures promote a proactive approach to security in line with the ISO27001 standard. Regular reviews, internal and external audits ensure our policies and procedures are being correctly followed and our sites offer the highest standards of security.

Full training is provided to team members in current Data Protection legislation and the specific impact on us as an organisation and our customers. This includes for example how we handle Subject Access Requests and how to support our own client base in completing documents such as Data Protection Impact Assessments (DPIA). We can provide further information including our full processes and procedures should you require this.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Our Change Management process ensures changes are considered, planned and appropriate with an audit trail of all changes made. Changes are assessed in line with ISO27001, to ensure they don't have a potential security impact.

Changes are passed through our QA environment to ensure compliance with established security principles before being deployed to client sites. Changes are audited to ensure they are valid and appropriate.

To prevent unauthorised changes, we monitor and closely control access to development environments so only authorised and appropriately trained and experienced staff have access.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Processes are designed to adhere to ISO27001 including regular reviews, risk assessment and audit.
Penetration tests are carried out by independent CHEST / CREST credited external consultants on a regular basis. Immediate steps are taken to eliminate any vulnerabilities detected.
We encourage customers to do independent penetration testing beyond our own, and will respond to any issues detected. We publish details for security researchers to contact us should they believe vulnerability is identified, then we will investigate and take appropriate action.
Our servers are in Microsoft Azure availability sets which means patches can be applied without disruption to the service.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
Among other defences Microsoft run threat analytics on the VM to detect suspicious activity that may indicate a threat and sends real-time alerts so that we can respond.
All severs have ransomware detection software installed that monitors file changes and enables us to role back file changes.
We run software on the servers that monitors failed login attempts and blocks the IP address that they come from if there are more than 5 failed attempts.
We use Qualys SSL Labs to perform a deep analysis of the SSL on the web servers.
Incident management type
Supplier-defined controls
Incident management approach
We have a defined incident Incident management process in place focusing on any possible security incidents. Any incident with security implications reported either by clients or technical staff is immediately escalated to senior management level to conduct a detailed threat assessment. Customers are informed of the issues, processes and procedures at all stages. Our security incident management approach has been developed with the aid of external data protection specialist consultants and is regularly reviewed.

Secure development

Approach to secure software development best practice
Conforms to a recognised standard, but self-assessed

Public sector networks

Connection to public sector networks
No

Social Value

Social Value

Social Value

  • Fighting climate change
  • Covid-19 recovery
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

Fighting climate change

We promote environmental sustainability by reducing waste, limiting our energy consumption and procuring materials from sustainable sources. We also contribute towards the preservation of the environment and natural resources, within both our own company operations as well as our working partners. Locata continues to develop innovation and technological progress to guarantee the advancement of the company and its customers whilst being respectful of any environmental impact and aspiring to develop further our sustainable business operation.

The majority of carbon generated by our organisation is in the powering and maintaining of our cloud-based servers. Our current hosting partner is Microsoft, who have established the aim to be carbon negative by 2030, including the entire supply chain. By opting to utilise Microsoft as our partner, we will likewise be contributing towards fighting climate change.

Locata is a fully remote organisation. As we have no office, our employees do not contribute to carbon emissions in the form of commuting to work. We have also moved more than 90% of our meetings to being via Microsoft Teams or similar services, as opposed to attending client sites. On the occasions we meet in person as a company, we encourage our staff to car share or utilise public transport where feasible. Our carbon emissions relating to transport have reduced more than 95% as a result of these changes.

As a company, we set aside time each quarter, for our staff to undertake activities in their local areas to enhance the natural environment, such as litter picking and tree planting.

Covid-19 recovery

Although COVID-19 restrictions have been lifted there are still steps we ask our staff to take to reduce the risk of catching and spreading COVID-19.
• Get vaccinated.
• Let fresh air in if meeting indoors, or meet outside.
• Consider wearing a face-covering in crowded, enclosed spaces.
• Get tested if you have COVID-19 symptoms, stay at home if positive.

To support the COVID-19 recovery effort, our staff continue to work from home until our business needs change.

We removed the restriction of not having face-to-face meetings at staff and customer discretion. However, we continue to plan future meetings in the virtual environment in line with the Locata marketing plan.

Our products also enable our clients to promote and encourage home working for their own staff, as all functionality can be assessed remotely.

Tackling economic inequality

Locata is a not-for-profit organisation owned by Public Sector organisations and Registered Social Landlords. We reinvest profits back into our products, which we believe has an indirect impact on tackling economic inequality.

One of our product focuses is always on enabling users to spend more time taking meaningful, and impactful actions on behalf of their clients, instead of being drawn to mandatory administrative tasks. By reducing the administrative burdens on officers, we increase the time they have to help their customers, who are often economically disadvantaged, thereby increasing the likelihood of positive action and outcomes.

As a company, we aim to nurture fair and responsible relationships with our supply chain and ensure invoices are paid in a timely manner.

We support our workforce with career development and to obtain relevant training specially to develop skills with a view to continuous improvement.

Locata implements the 5 foundational principles of the Good Work Plan, ensuring our workforce; has work satisfaction, fair pay, are able to fully participate and progress within the company, that their voices are heard and they have autonomy to carry out their roles independently whilst being supported, and that their wellbeing, safety and security are looked after.

Locata manages cyber security risks throughout the supply chain, engaging with the supply chain to identify and build resilience against cyber security risks, raising cyber security awareness and also commits to adopting the technical standards and best practice detailed by the NSCS, Cyber Essentials and the Technology Code of Practice.

Equal opportunity

Locata's policy applies to employees, workers and contractors in that the company values and actively strives to have a diverse and inclusive workforce in a working environment free from discrimination. An inclusive work culture where people of different backgrounds are valued equally will ensure better outcomes for us all. We continually engage with our staff as well as external partners to help us to understand how we can make our workplace more inclusive and gain an insight into what our staff need most from us.

The company seeks to promote the principles of equality, diversity and inclusion in all its dealings with employees, workers, job applicants, clients, customers, suppliers, contractors, recruitment agencies and the public. Everyone who acts on the Company's behalf is required to adhere to this policy when undertaking their duties or when representing the Company in any other guise.

Locata offers a range of progression opportunities, supporting in-work progression, including inclusive and accessible development practices.

As a Company we take measures to tackle inequality in employment skills for example offering any required training necessary for staff to complete their roles proficiently or training to expand upon their personal development and also apprenticeships.

Wellbeing

Locata assesses each member of staff with a full working-from-home risk assessment that includes a wellbeing section.

Weekly staff meetings are held where employees to raise concerns or issues with the wider group. Regular 1-2-1 meetings are held with each staff member so they have the opportunity to raise any wellbeing concerns in a confidential and safe environment. We work under an "open-door" policy which promotes transparent and flexible communication between managers and team members. It encourages an environment where employees can freely approach managers with concerns, feedback, or ideas, fostering a culture of trust, collaboration, and continuous improvement within the organization. Processes are in place to act upon any issues identified.

Locata implements the 6 standards in the Mental Health at Work commitment by:
- Prioritising mental health in the workplace by developing and delivering a systematic programme of activity.
- Proactively ensuring work design and organisational culture drive positive mental health outcomes.
- Promoting an open culture around mental health.
- Increasing organisational confidence and capability.
- Providing mental health tools and support.

As a Company, we have access to our NatWest HR Mentor Online Resources for Staff. These interactive mental health & wellbeing courses are designed to raise and promote mental health awareness in the workplace. These 16 eLearning courses cover:

Business Communication,
Mindfulness,
Communication Skills,
Nutrition,
Conflict Resolution,
Physical Activity,
Coping with Covid-19 Anxiety,
Resilience,
Financial Wellbeing,
Sleep Essentials,
Healthy Living,
Stress Awareness,
Managing Mental Health,
Time Management,
Mental Health Awareness,
Wellbeing & Remote Working,

Locata also updates risk reviews of our supply chain at the same time. We have mitigated as many risks as possible and it is our intention to keep our services live and in good working order.

Pricing

Price
£9,500 a licence a year
Discount for educational organisations
No
Free trial available
No

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at enquiries@locata.org.uk. Tell them what format you need. It will help if you say what assistive technology you use.