CREATESHIFT LTD

ProdPad

ProdPad gives product managers a dedicated home for their product strategy. It brings vision, objectives, roadmaps, ideas, and customer feedback into one collaborative space. Teams use ProdPad to make evidence-based decisions and deliver better outcomes with clearer governance. ProdPad provides a single source of truth for prioritisation and product planning.

Features

• Centralised workspace unifies product vision, objectives, outcomes for strategic clarity.
• Now-Next-Later roadmapping, hierarchical portfolios, products and initiatives.
• Backlog and idea management with workflows and impact/effort analysis
• Customer feedback aggregates channels including email, integrations, API, and imports.
• AI-powered analysis of feedback, ideas, themes, and signals.
• Portfolio-level visibility across products, teams, and strategic programmes.
• Integrations with Jira, Azure DevOps, Trello, GitHub, Slack, and Teams.
• Secure role-based access, audit trails, and collaboration controls.
• Real-time reporting tracks progress, alignment, roadmap activity, and feedback trends.
• Hosted or Self hosted SaaS platform.

Benefits

• Improve strategic alignment with one place to understand priorities.
• Make better decisions using evidence, customer insight, and clear objectives.
• Reduce wasted work by focusing teams on real problems.
• Speed up planning cycles through clear roadmaps and repeatable processes.
• Increase transparency with stakeholders through published roadmaps and shared information.
• Strengthen accountability with auditable decision history and clearly documented rationale.
• Raise product quality by connecting feedback, ideas and highlighting needs.
• Improve delivery confidence with outcome-driven plans instead of deadline-driven lists.
• Reduce operational overhead by consolidating tools and workflows into one.
• Support enterprise-level product management with hierarchy, permissions, and reporting capabilities.

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at accounts@createshift.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

656083717387122

Contact

Janna Bastow
+1 (888) 240-1020
accounts@createshift.com

About the service

• Service categories:
  • Applications
    • Engineering
      • Collaborative product data management
        • Collaborative product data management
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: The service can be integrated with a range of other services such as Jira and ADO but neither is required in order to use the service.
• Cloud deployment model: Public cloud
• Service constraints: No.
• System requirements: Modern browser (Firefox, Chrome, Edge)

User support

• Email or online ticketing support: Yes
• Support response times: On average - within 24 hours
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• AI chatbot: Yes
• Web chat support accessibility standard: None or don’t know
• How the web chat support is accessible: We use HelpScout: They aim to meet or exceed the Web Content Accessibility Guidelines 2.1 Level A (WCAG 2.1 A) across all of our products. They have work still to do, but they are moving toward that goal.
• Web chat accessibility testing: https://www.helpscout.com/company/legal/accessibility-statement/
• Onsite support: Yes
• Support levels: https://prodpad.com/service-level-agreement
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We provide a full onboarding experience tailored to the team:; ; – Guided in-app onboarding and setup checklists; – Online training sessions delivered by our Customer Success team; – Knowledge base with articles, videos, templates, and best-practice guides; – Optional onboarding workshops for teams needing structured rollout support; – Email support and live chat for ongoing assistance; – Demo data sandbox for safe exploration without affecting real work
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
  • Other
• Other documentation formats: Training sessions if applicable.
• Documentation accessibility standard: EN 301 549
• End-of-contract data extraction: CSV or XSLX (feedback, ideas), PDF (Roadmaps and canvases), JSON ( everything via the API)
• End-of-contract process: When an account is cancelled the user access to the account is locked and is only accessible by re-activation with valid payment details.; ; We do not hard delete data by default, a hard deletion can be requested. If requested we will act on the request and hard delete the data from production datastores at which point the data is only recoverable for upto 30 days from backups. After which the data is no longer recoverable.; ; CreateShift will, as part of the ProdPad Service, use reasonable endeavours to provide a level of support that is appropriate to the nature of any issues requiring support during normal business hours (UK time). The Customer can access such support through the following means:; Email: help@prodpad.com; Help desk: https://help.prodpad.com; In-app messenger service

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• Description of service interface: ProdPad provides a web-based service interface accessible through any modern browser. Users log in to manage ideas, feedback, product roadmaps, release plans and team collaboration from a central workspace. The interface offers intuitive navigation, configurable views, search and filtering tools, and role-based access to control user permissions. Admin users can manage workspaces, users, integrations and security settings through the same interface. The design supports keyboard navigation, responsive layouts and compatibility with common assistive technologies. All changes made through the interface are saved in real time and synchronised across teams, providing a consistent and user-friendly product management experience.”
• Accessibility standards: None or don’t know
• Description of accessibility: We are actively working towards WCAG 2.2 AA compliance with annual reviews of our accessibility standards.
• Accessibility testing: Direct Testing With:; Screen magnifiers and zoom tools; Keyboard-only navigation; High-contrast and custom colour-scheme settings; ; We test with users who have:; Colour-vision differences
• User support accessibility: EN 301 549
• API: Yes
• What users can and can't do using the API: ProdPad offers an API (Application Programming Interface) that allows programmatic access to its data (ideas, feedback, roadmaps, etc.). ; ; You can use this API to:; ; Retrieve data (via GET calls); Create new items (via POST); Update existing items (via PUT) ; ; It also supports custom webhooks, so you can have actions in ProdPad trigger workflows in other tools. ; ; The base URL for the API is https://api.prodpad.com/v1/ (over SSL) and the version shown is 1.1.4. ; ; Authentication uses an API key (Bearer token) in the Authorization header
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: What can be customised:; – Roadmap hierarchy (portfolio/product/initiative levels); – Idea workflow stages; – Tags, personas, business areas, and product lines; – User roles, permissions, and access controls; – Integrations with delivery tools (Jira, ADO, Trello, etc.); ; How users customise:; – Through the in-app admin settings; – Through configuration panels on each roadmap, workflow, or data type; – Via integrations and API for advanced configurations; – Via workspace-level setup guided by onboarding tools; ; Who can customise:; – Workspace administrators (all settings); – Product managers or product owners (roadmaps, workflows, backlogs); – Team leads and programme managers (portfolio-level structures); – Contributors (limited to their access permissions); ; Other customisations available on request.

Scaling

• Independence of resources: We constantly monitor the peformance of the app to ensure that is performant. Additionally the frontend app is designed to not be dependent on the performance of the servers

Analytics

• Service usage metrics: Yes
• Metrics types: We are able to share Usage Metrics of users within the ProdPad account via dashboards and reports on request.; ; We do not share hosting service usage as its a shared instance.
• Reporting types:
  • Real-time dashboards
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Other
• Other data at rest protection approach: Data at rest is encrypted using AWS Key Management Service (KMS) across storage services (block, object, file) and managed/distributed by AWS under FIPS/NIST validated modules.
• Data sanitisation process: Yes
• Data sanitisation type: Data Erasure
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: Feedback and Ideas - Select all items in each state and for each object type and export to XSLX or CSVPDF; ; Roadmaps can be exported to PDF via the published roadmaps feature, create a published roadmap, then save and print to PDF. ; ; Almost all app data can be extracted using the public API
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • XSLX
  • PDF
  • JSON (via the public API)
• Data import formats:
  • CSV
  • Other
• Other data import formats: JSON (via the public API)

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Where the Customer has paid for access to the ProdPad Service, we will use commercially reasonable endeavours to make the ProdPad Service available with an uptime rate of 99%, except for:; - planned maintenance for which 24 hours’ notice will be given; or ; - unscheduled maintenance during normal business hours (UK time) or otherwise, for which we will use reasonable endeavours to give the Customer advance notice.; ; CreateShift will, as part of the ProdPad Service, use reasonable endeavours to provide a level of support that is appropriate to the nature of any issues requiring support during normal business hours (UK time). The Customer can access such support through the following means:; Email: help@prodpad.com; Help desk: https://help.prodpad.com; In-app messenger service; Support for Customers using the ProdPad Service for free will be provided entirely at CreateShift’s option and discretion.
• Approach to resilience: Production service uses clusters of service for main components. In addition we manage a secondary site for failover to that is outside the main region but within EEA.
• Outage reporting: Email alerts and public dashboard.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
• Other user authentication: MFA is in progress.
• Access restrictions in management interfaces and support channels: Access to support channels forces 2FA verification.; ; Admin management tools/console access is restricted by VPN
• Access restriction testing frequency: At least once a year
• Management access authentication: Dedicated link (for example VPN)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: SCO2 Type II; Cyber Essentials
• Information security policies and processes: Procurement Policy; Anti-Bribery Policy; Asset Management Policy ; Access Management Policy; Data Breach Policy; Disaster Recovery Plan Policy; Risk Assessment and Management Policy ; Security Response Plan Policy ; Software Development Life Cycle Policy; System Change Management Policy; Vulnerability and Threat Management Policy; Password Policy; Remote Access Policy; Secure Workspace Policy ; Data Information Classification Policy; Data Retention & Disposal Policy; Removable Media Policy ; Acceptable Use Policy ; Acceptable Encryption Policy; Social Engineering Awareness Policy; Bring Your Own Device Policy

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Tracking of components and changes:; - New features and fixes are captured and refined in ProdPad, then pushed into our delivery workflow and tracked.; - Development is done in feature branches with mandatory PR reviews.; - All changes are tested in a full staging replica of production; ; - Approved items are included in standalone release branches; - Security impact: Potential security considerations are reviewed during ideation and development; ; Configuration management:; - Core service components (RDS MySQL etc.) are tracked internally alongside package versions and end-of-life dates - reviewed monthly.; - Security patches for supported components are applied automatically.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We operate continuous vulnerability management process combining automated detection, external intelligence, and annual pentests.; ; Threat assessment:; - Weekly automated vulnerability scans are run across our infrastructure and code dependencies.; - Dependency-monitoring tools to identify emerging risks in third-party libraries.; - Monitor multiple external security feeds for new relevant threats.; - Independent annual penetration tests; ; Patch deployment:; - Security patches for supported system components are applied automatically.; - Application-level dependency updates are triaged on detection and applied as part of our bi-weekly releases.; ; Threat intelligence sources:; - Vendor advisories (AWS, Redis, MySQL, EventStore).; - CVE/NVD feeds and standard industry security bulletins.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Centralised logging, AWS CloudWatch & GuardDuty to continuously monitor our infrastructure for anomalous behaviour or indicators of compromise. Alerts sent to Slack and immediately notify DevOps and CTO.; ; Potential compromises are triaged using our incident-response plan: confirm the alert, contain the affected component, remediate the issue, and record actions. If customer data may be affected, we follow our notification procedure.; ; We operate business-hours monitoring with escalation for high-severity incidents; the CTO also monitors critical alerts out of hours. High-severity alerts are acted on immediately. Logs are retained for three months (with longer-term storage in S3) to support investigation and audit.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: Yes
• Incident management approach: We have a documented incident management policy and predefined processes for common events, including detection, triage, containment, remediation and post-incident review. Incidents are identified through user reports and through our internal monitoring and alerting.; ; Users can report incidents via email or through our in-app feedback widget. When an incident affects a customer account, we provide an incident report on request outlining the impact, timeline, actions taken and any follow-up measures.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: There is an initial 14 day trial that can be extended at request. ; All features of ProdPad are available in this trial.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 20%
• Between £250,000 and £500,000: 30%
• Between £500,001 and £1,000,000: 40%
• Between £1,000,001 and £2,500,000: 40%
• Between £2,500,001 and £5,000,000: 40%
• Over £5,000,001: 40%

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: E7f24502-18b9-42f8-8a41-9d75fec37700
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: Yes
• Any other security certifications: SOC II Type 2

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Activities to cascade good practice on fair working conditions throughout the supply chain
  • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
  • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at accounts@createshift.com. Tell them what format you need. It will help if you say what assistive technology you use.