QRoutes

QRoutes Lite

QRoutes Lite is a low cost, highly effective, cloud based GIS tool for planning SEND or adult social care transport. It is a cost-effective version of the full QRoutes product, designed to meet the planning needs of smaller local authorities. See https://qroutes.co.uk for more on how customers benefit from QRoutes.

Features

• Fast, automated and effective route optimisation
• Latest Ordnance Survey (OS) map data
• Automated address cleansing using OS Address Base
• Assign and schedule Passenger Assistants
• Specify who can travel with whom
• Automatically identify the best route for a new passenger
• Export route itineraries with maps
• Web service API for system integration
• Specify generic vehicle types or actual vehicles
• Manage routes for assigned vehicles, e.g. avoiding low height bridges

Benefits

• Produces high quality results - better than human planners
• Planners can use their expertise to improve results further
• Planners can re-plan provision quickly throughout the year
• Brings all planners up to a similar high level
• Cost savings - typically 10% - 15% of provision
• Keeps cutting costs through rapid re-planning
• Highly effective when planning SEND transport
• Highly effective when planning social care & health transport
• Highly effective when planning single centre transport
• Highly effective at integrating disparate transport provisions

£14,200 to £19,100 a licence a year

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at david.stewart@qroutes.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

658015137206793

Contact

David Stewart
0117 3329499
david.stewart@qroutes.co.uk

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: Customers must use a web browser which support standard TLS 1.2 or above for data in transit protection.
• System requirements:
  • A web browser supporting security standard TLS 1.2 or above
  • A program to view and edit CSV files (e.g. Excel)

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: The user can contact support via the in-application help (including via web chat when agents are available). Tickets can also be raised by email to support@qroutes.co.uk. ; ; QRoutes will reply to all emails and tickets within 1 normal working day.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.1 AA or EN 301 549
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: QRoutes prides itself in working closely with customers. The subscription price includes example processing of the customer's data, tailored training for all users, planning workshops, and unlimited online support.; ; Each customer is provided with a technical account manager and a support manager.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: QRoutes runs an on-boarding process to identify the customer's needs and to tailor the services to best meet those needs. Training and workshops are provided remotely or onsite using, wherever possible, the customer's own data. ; ; QRoutes Customer Success staff will also meet regularly with the customer during the subscription to ensure the customer is extracting value from the service. There is in-application help and support is always available through support@qroutes.co.uk.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: The application does not retain a customer's data. The customer uploads their data, processes it and downloads the output.
• End-of-contract process: The customer simply decides whether to re-subcribe or not. There is no tie-in of any sort.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.1 AA or EN 301 549
• Description of service interface: QRoutes Lite provides a GIS-based user interface through a web browser. The user can customise the visual view to suit their preference, e.g. from choosing a greyscale map view through to a full colour version. The user can also select what is shown on the map, e.g., to focus on a single route.
• Accessibility standards: WCAG 2.1 AA or EN 301 549
• Accessibility testing: We seek feedback from all users on the usability of the interface during training, workshops, and user conferences. We also have a feedback box on log-out for users to leave comments.
• API: Yes
• What users can and can't do using the API: Users first create a log-in account on the cloud software. They then use those same authentication details to begin a session via the API. The core routing and scheduling functionality is provided - the loading of trip data, the setting of scheduling parameters, and the retrieval of the planned itineraries.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Customer account administrators can control what functionality is available for standard users and how it is configured, including: ; Routing & scheduling performance objectives; ; Road speed calibration settings; ; Passenger type definition and management;; Vehicle type definition and management

Scaling

• Independence of resources: QRoutes has a scalable hosting architecture, whereby multiple servers are available for the potentially extensive back-end computations. Customer processing requests are allocated to free resource, meaning no one customer's usage affects another. The servers are used exclusively by QRoutes applications.

Analytics

• Service usage metrics: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Physical access control, complying with another standard
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: Users download their processed data directly from the application as CSV files (or via API).
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: QRoutes uses commercially reasonable endeavours to make all its services available to users at qroutes.co.uk 24 hours a day, seven days a week, except for planned maintenance carried out between 10.00 pm to 2.00 am UK time.
• Approach to resilience: QRoutes' services are hosted by iomart (www.iomart.com) in the UK. Each application is backed up to isolated locations with a dedicated recovery environment. QRoutes maintains an additional environment on Microsoft Azure (UK South) that can be used for additional resilience in the event of the loss of 2 datacentre environments.; ; QRoutes will establish the severity and impact of any outage within 15 minutes and troubleshoot the cause within 30 minutes. Normal service will be resumed within 60 minutes.
• Outage reporting: QRoutes notifies all its users by email (and through the application log-in screen) of any scheduled service down time 1 week, and again at 1 day, prior to the down time. ; ; QRoutes emails affected users as soon as there is any unexpected outage and keeps users updated with the reasons for the outage and the likely time for the resumption of the service.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to all user accounts is by username and password (2-factor authentication is optional) or by Identity Federation e.g., Entra ID. Users must have an email address from their organisation's domain. ; ; There are two levels of customer user: User and Administrator. Only an Administrator can change the configuration of the service and view the audit history for all of the organisation's users.; ; Security settings are customisable for each customer including the implementation of their password policy (e.g., a minimum character length and the use of any or all of uppercase letters, lowercase letters, numerals, and symbols).
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Alcumus ISOQAR Ltd
• ISO/IEC 27001 accreditation date: 27/10/2023
• What the ISO/IEC 27001 doesn’t cover: One of the disaster recovery solutions in place uses Microsoft Azure, which has it's own accreditations for ISO27001 to secure resources and data.
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: One Compliance Cyber Limited
• PCI DSS accreditation date: 23/02/2024
• What the PCI DSS doesn’t cover: This PCI DSS certificate covers the hosting provider for QRoutes software infrastructure.
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: QRoutes ' services are hosted by iomart (www.iomart.com).; ; The iomart Information Security Management System (ISMS) determines and outlines how iomart organises and manages the company’s information security in relation to internal information systems, operation, and support including the provision of complex managed and cloud computing services for customers. The verifying body is ISOQAR.; ; iomart is also accredited with Cyber Essentials Plus. Its business ICT defences have been assessed as satisfactorily protected against commodity cyber threats, i.e. attacks using identified capabilities and techniques freely available on the internet. The verifying body is Alcumus.

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: Software updates are evaluated on a test server hosted by the same data centre company as the live servers. Change requests are processed in the support site (https://www.qroutes.zendesk.com) and the corresponding workflow, along with new feature development, is managed in JIRA. ; ; New versions are triple-blind tested manually for functionality, usability and security before their release to the live servers. An automated test suite is also run prior to deployment on the test server and after deployment on the live servers. It contains functional, regression, performance and stress tests.
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: The iomart vulnerability management process is aligned with ISO27001:2013 control A12.6.1 which addresses 3 key areas:; Timely identification of vulnerabilities; Assessment of or exposure to a vulnerability; Defined measures to address the risk.; ; QRoutes also runs regular penetration testing of its application; several QRoutes customers also perform penetration testing of the service.; ; Patching for operating systems and applications are monitored and applied in a timely manner.
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: Iomart Protective Monitoring process is aligned with ISO27001:2013 control A.12.4 which details: Event Logging; Protection of log information; Admin & operator logs; Clock synchronisation; Incident Management. ; ; QRoutes operational staff also monitor account log-in attempts and usage for abnormal activity on a daily basis.
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: Iomart incident management process is aligned with ISO27001:2013 control A.16.1 which details: The full incident management procedure; Responsibilities & procedures; Assessment of and decision on security events; Response process; Evidence collection; Learning from incidents. ; ; QRoutes reviews any incidents at its monthly management and board meetings.

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  QRoutes is in general used to minimise the number of vehicles required, and the total miles travelled by those vehicles, to deliver journeys to school. The reductions in mileage can be significant. Please see our website for case studies, including one authority who found they were able to cut the total number of miles travelled to a school by 46%. The QRoutes User can further quantify CO2 emissions by entering the relevant details for each vehicle in the fleet.

  Tackling economic inequality

  QRoutes Lite can be configured to produce routes for vehicles matching those available locally, improving supply chain resilience. ; ; QRoutes Lite saves money on dedicated transport to educational centres, enabling authorities to spend more on the provision of the education.

  Equal opportunity

  Every child has the right to meet with other children and to join groups and organisations. But this is harder for children with a disability, especially for those whose family is one of the 50% of families with a disabled child that live in poverty (Disability Rights, January 2024). ; QRoutes helps keep the costs associated with school transport in check, releasing more money to be spent in the classroom. This is important for all children, but especially for those who have to overcome more hurdles than most to get there.

  Wellbeing

  QRoutes has benefits for both school transport planning teams and their clients. School transport costs have risen by up to 3x over the last 5-10 years and planners are often under pressure to find efficiencies. This is already an exceptionally complicated task. Fierce pushback from families, schools, and other stakeholders can make it even more stressful. QRoutes is the UK’s leading route optimisation tool for school transport because planners trust its results. It enables them to quickly quantify and communicate the impact of alternative options with confidence and clarity. It improves the client experience by enabling planners to reliably keep travel time within statutory limits so that children can arrive at school fresh and ready for the day.

Pricing

• Price: £14,200 to £19,100 a licence a year
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: QRoutes and customer staff will co-plan the transport to a school or other common destination using the customer's choice of data.
• Link to free trial: Please contact info@qroutes.co.uk to set up a free trial.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at david.stewart@qroutes.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.