AMS

AMS Request Portal - SAR, FOI

AMS Request Portal is a secure, cloud-hosted request management service designed to support the electronic submission and handling of Subject Access Requests (SARs), Freedom of Information (FOI) requests and other information requests via online forms. The service provides case management, reporting and secure digital disclosure to support authorised users.

Features

• Digital web forms
• Central request management portal
• Reporting tools and reports
• Electronic records and file delivery
• Breach & Task management
• 256-bit AES encryption
• Full audit trail
• UK data sovereignty
• Two-Factor Authentication
• PACS integration & online DICOM viewer

Benefits

• Improve efficiency with one central solution
• Reduce postage and burn-to-disk costs
• Modernise the request process with electronic web forms
• Provide an improved patient experience
• Speed up the process to minimise breaches
• Save time with automatic report creation
• Instant email notifications to improve visibility and speed-up response times
• Improve security and avoid lost documents
• Improve compliance and accountability with full audit trail
• Empower your external users to manage their request(s)

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@ams-ltd.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

663893809891088

Contact

Sales Team
01202 652070
sales@ams-ltd.com

About your service

• Service categories:

  Applications

  Content workflow and management

  Content services

  • Enterprise Content Management Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: All communication to the service requires TLS 1.2 or higher to ensure a high level of secure encryption. Some older browsers that don't support TLS 1.2 are not supported.
• System requirements:
  • Any web browser (except older browsers that don't support TLS1.2)
  • Optional PACS: Windows 2016-2025 Server, 8GB-RAM, 75GB-HDD, MultiCore 3.6GHz 64-bit

User support

• Email or online ticketing support: Yes
• Support response times: Response times are prioritised based on severity during UK business hours (9 to 5 Monday to Friday, excluding public holidays):; ; Level 1 – Business critical: Response within 2 hours.; Level 2 – Degraded service: Response within 4 hours.; Level 3 – General issues: Response within 8 hours.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Standard support included with the service. All customers have a dedicated account manager with whom they can escalate support if needed.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Full documentation is provided included, Quick Start Guide, User Guide, Online Videos, FAQ's and Admin Guide.; ; Online and onsite training is available.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • ODF
  • PDF
• End-of-contract data extraction: Data can be extracted via the portal, which includes reporting tools.; ; Every client has their own separate SQL database and storage account, which we can make accessible to the client.; ; There are options for AMS to create export tools to deliver the client data in a bespoke format, based on client requirements.
• End-of-contract process: Access to the portal to download data can be provided for a period of time after termination, at no additional cost.; ; Access to your SQL database and storage account can be provided. The only additional costs for this would be the Data Download charges at the contract rate.; ; Bespoke data export solutions would be quoted on a case by case basis for engineering time, dependent on your requirements.; ; All customer data will be deleted no later than 60 days after the effective date of termination, unless otherwise agreed in writing between the parties.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The web platform has been designed to be mobile friendly, and the same interface is used for both with no limitations. Requestors can take advantage of a mobile device camera to take and securely upload photos of identity documents.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Web interface that enables requestors to make SAR and FOI requests via online forms. Web interface for Request Handlers to manage requests and securely disclose information. Admin interface for configuration and management of the system.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Accessibility evaluations are conducted through internal self-assessments using industry-standard tools and methodologies. This includes the following tools:; ; Accessibility Insights for Web: This tool is designed to assist developers in identifying and resolving accessibility issues. It provides automated checks and guided assessments for WCAG compliance.; ; WAVE Evaluation Tool: WAVE can identify many accessibility and Web Content Accessibility Guideline (WCAG) errors but also facilitates human evaluation of web content.; ; NVDA Screen Reader (NonVisual Desktop Access): Testing with NVDA ensures that our platform is navigable and functional for users who depend on screen readers to access digital content.
• API: No
• Customisation available: Yes
• Description of customisation: The following customisations can be carried out by AMS on behalf of the customer: ; - Design forms; - Interface branding: including logos and images; - Email template content; - Home page and request selection page content

Scaling

• Independence of resources: The service is designed to ensure that one customer’s usage does not adversely affect others. Demand is managed through load balancing across service components, isolated tenant resources and fair usage rate limiting to prevent excessive consumption. Customer data is stored in separate storage accounts and databases, and processing capacity is managed to minimise contention. Where appropriate, compute resources are scaled or burst capacity is used to accommodate changes in demand and maintain consistent service performance.

Analytics

• Service usage metrics: Yes
• Metrics types: Metrics for consumption (number of requests & credits; storage usage, request metrics per status (e.g. completed, outstanding, breached, compliant, rejected); survey report (feedback or scores from requestors).
• Reporting types: Real-time dashboards
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: A wide range of technical and process controls are in place in line with ISO 27001 to protect data at rest.
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure

Data importing and exporting

• Data export approach: Data can be extracted via the portal. This includes requests, audits and users. Files can be downloaded.; ; There are options for AMS to create export tools to deliver the client data in a bespoke format, based on client requirements.
• Data export formats:
  • CSV
  • Other
• Other data export formats: PDF
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: SLA: 99.5% availability of the Cloud Services per calendar month, excluding any Scheduled Maintenance.; ; If the SLA is not met the customer will be refunded 10% of the service fees for the month.
• Approach to resilience: The service is hosted in Microsoft Azure on multiple load shared virtual machines. Each virtual machine is in different Azure Availability Set.; ; SQL Server and Storage Account resilience is provided by Microsoft Azure as a managed service.; ; All data is backed up to a different Azure UK region.
• Outage reporting: Outages and scheduled maintenance are reported via a public dashboard and email alerts.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces is restricted through role-based access controls and unique user accounts protected by username and password authentication. Multi-factor authentication is supported for administrative access. Optional geo-fencing is available to restrict access to management interfaces by public IP address. Access to support channels is restricted to authorised customer contacts, and requests are verified before any administrative action is taken.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We operate a documented Information Security Management System (ISMS) aligned with ISO/IEC 27001, including an Information Security Policy and supporting policies and procedures covering areas such as access control, data protection, incident management, supplier security and secure development.; ; Overall responsibility for information security sits with senior management, who provide governance and oversight as part of day-to-day operations.; ; All policies and procedures are communicated to staff as part of onboarding and ongoing training, with compliance reinforced through documented processes, role-based access controls and management oversight. Evidence of key controls and activities is maintained and reviewed.; ; Policies and processes are reviewed at least annually, and compliance is monitored through internal review and independent external audit as part of our ISO 27001 certification.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Service components are tracked throughout their lifecycle with assigned ownership to ensure accountability for configuration, maintenance and retirement. Asset owners are responsible for understanding the security and operational characteristics of each component.; ; Changes are managed through a controlled change process and assessed for purpose, scope and potential security impact. Where a change may introduce or alter risk, a risk assessment is carried out in line with the organisation’s risk management framework. Risk and process owners identify potential impacts and required controls. Where necessary, testing plans and rollback procedures are defined to maintain service security and resilience.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: An asset register is maintained, with asset owners responsible for identifying and managing vulnerabilities, supported by the Technical Director and Operations Director. Potential threats are assessed through regular risk assessments and review of technical vulnerabilities. Microsoft Defender for Cloud is used to monitor the environment and identify and report new vulnerabilities. Critical or high-severity vulnerabilities and patches are deployed immediately, with other patches applied in line with a defined patching schedule. Vulnerability information is obtained from cloud provider alerts, supplier advisories and penetration testing results.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Protective monitoring is provided using Microsoft Defender for Cloud to continuously monitor the service environment and identify indicators of potential compromise through security alerts and events. Alerts are reviewed to detect abnormal or suspicious activity and to assess whether a potential security incident may exist.; ; Where a potential compromise is identified, the event is logged and prioritised for investigation. Initial assessment and triage are carried out promptly, with higher-severity alerts escalated without undue delay in accordance with the incident management process.
• Incident management type: Supplier-defined controls
• Incident management approach: We operate a documented incident management process for information security events. Incidents can be reported by users or staff via an incident reporting process and are assessed and escalated without undue delay. Where required, affected customers are notified by email. Once an incident is contained and corrective actions are completed, an incident report is prepared and shared with affected customers and relevant authorities where applicable. Preventative actions are identified to reduce the risk of recurrence, and audit records are retained to support review and assurance activities.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: The standard trial includes full functionality for 30 days.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Approachable Certification
• ISO/IEC 27001 accreditation date: Friday 15 November 2024
• What the ISO/IEC 27001 doesn’t cover: The ISO/IEC 27001 certification applies to the information security management system supporting the design, development, operation and support of AMS cloud-based SaaS services.; ; The certification does not extend to customer controlled environments, end-user devices, networks, browsers or identity systems, nor to third-party systems or data sources integrated or accessed by customers outside the AMS service boundary.; ; Physical security of underlying data centre infrastructure and hardware lifecycle processes are managed by the cloud hosting provider and are not directly within the Supplier’s operational control, although they are subject to contractual and assurance arrangements.; ; While the Supplier provides the technical controls to support secure operation, customer-specific configuration choices, including data classification decisions, retention policy settings, access control assignments and the use of optional service features, are determined and managed by the Buyer.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Afb5448d-e534-45df-b635-bc510114db0f
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@ams-ltd.com. Tell them what format you need. It will help if you say what assistive technology you use.