Ember Technology Ltd

Feel Good Hub – Active Travel

A public engagement platform for increased participation in active travel. Feel Good Hub is a proven behaviour change application that helps local authorities drive participation and awareness of active travel infrastructure and sustainable transport initiatives in local communities and workplaces.

Features

• iOS & android Mobile Apps, Web Portal and Admin System
• Underpinned by the Transtheoretical Model of Behaviour Change
• Delivers themed and localised Active Travel experiences, challenges
• Action focused, supports habit formation and maintenance
• Captures active travel journeys by mode (walk, wheel, cycle)
• Delivers bite sized information and motivational messaging
• Seasonal, topical, super local engagement campaigns
• Embedded social models, groups and invite codes for viral sharing
• Use our published challenges & experiences or design your own
• ISO27001, Cyber Essentials Plus, Net Zero Hosting in UK AWS

Benefits

• A unique, fun and compelling way to drive AT participation
• Associate with national & international awareness campaigns and themes
• Leverages social behaviour change dynamics and community engagement
• Re-enforces inclusion, community cohesion, and support
• Supports Active Travel habit formation
• Localisation and branding for strong community identity
• Co-designed challenges and experiences for maximum uptake
• Supports co-sponsorship, branding, and super localisation
• Unlimited experience formats, themes, and methods of participation
• Reduce carbon and burn calories

£12,000 to £24,000 a licence a year

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at steven.wexelstein@ember.ltd. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

697298690693061

Contact

Steven Wexelstein
07875235377
steven.wexelstein@ember.ltd

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
• Service constraints: No Constraints
• System requirements:
  • Accessed through a web browser
  • No system requirements solution is provided as a SaaS solution

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: According to our SLA for support which is available on request/during the G-Cloud clarifications stage.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.1 AA or EN 301 549
• Phone support: No
• Web chat support: Yes, at an extra cost
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.1 AA or EN 301 549
• Web chat accessibility testing: It’s a 3rd party tool that has been tested by Zoho
• Onsite support: Yes, at extra cost
• Support levels: Ember Technology Standard SLA:; Priority 1 (Critical Impact): Response within 1 business hour, and resolution within 3 business hours.; Priority 2 (Significant Impact): Response within 4 business hours, and resolution within 1 business day.; Priority 3 (Minimal Impact): Response within 1 business day, and resolution within 4 business days.; ; Pricing will be dependent on deployment model and we can clarify during the G-Cloud clarifications stage.; ; We will provide an Account Manager and a dedicated Support Manager
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Ember provides the following onboarding, branding, localisation and configuration support based on our services rate card. ; Performance objectives and initiation session; Localisation – configured and deployed for any community or local authority area.; Technical configuration of all functionalities and reporting requirements; Integration with other services and information systems; Brandable in line with your branding guidelines and strong local brand identities; Content planning, analysis, migration, and SEO optimisation support; Data migration and import from legacy systems, databases, and CRM’s; Dedicated Project Management allocated; Admin, reporting and CMS training; Report configuration & integration with client preferred BI systems
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: The off-boarding process includes several steps to ensure data is securely handled and regulations are adhered to:; Notification and Acknowledgment: Once we receives a termination notice from you, we acknowledge and initiate off-boarding procedures.; Data Extraction: Ember supports clients in extracting their data, providing tools and guidance for exporting in formats like CSV or JSON.; Data Sanitization: After data retrieval, we securely delete all residual data from systems using rigorous sanitisation processes to ensure no sensitive information remains.; Equipment Handling: Any hardware provided is either returned or disposed of following environmental and regulatory standards.; Contract and Financial Closure: We finalise all administrative tasks and financial settlements to formally close the contract.; Feedback Collection: We then seek your feedback on their service experience to enhance our quality management and service delivery.; Continued Support: We offer additional support post-off-boarding to address any residual queries or concerns, ensuring a smooth client transition.; This streamlined approach ensures compliance and client satisfaction throughout the off-boarding phase.
• End-of-contract process: Off boarding is included in the initial cost.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: No differences
• Service interface: Yes
• User support accessibility: WCAG 2.1 AA or EN 301 549
• Description of service interface: The service users interface with the application using a web browser.
• Accessibility standards: WCAG 2.1 AA or EN 301 549
• Accessibility testing: We've performed assistive testing with focus groups in Alpha and Beta and we audit the site using Accessibe.com. It has also been tested using : WAVE (Web Accessibility Evaluation Tool), Tenon, HTML_Sniffer and Lighthouse.
• API: Yes
• What users can and can't do using the API: Using our API's external developers can perform a range of actions, including data retrieval, manipulation, and system interactions. Certain administrative functionalities may be restricted for security and data integrity purposes, ensuring robust and reliable service delivery.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: The service can be customised to adopt any banding, data import/export and we can customise workflows or business logic as part of the mobilisation and setup of the service. Full details of the customisation options are described in our Service Description document.

Scaling

• Independence of resources: We provide a highly redundant, load balanced environment with scalable bandwidth on demand and our reporting services are provided using an isolated infrastructure.

Analytics

• Service usage metrics: Yes
• Metrics types: Usage statistics, system performance reporting and database reporting.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Physical access control, complying with CSA CCM v3.0
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Via the system or through our support service.
• Data export formats:
  • CSV
  • Other
• Other data export formats: Json
• Data import formats:
  • CSV
  • Other
• Other data import formats: Json

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: 99.5% availability per 30 day period
• Approach to resilience: We provide a highly redundant, load balanced environment with scalable bandwidth and services on demand.
• Outage reporting: Outages are reported via support desk and included in monthly service reports.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
• Access restrictions in management interfaces and support channels: We deploy a multi-tiered authentication approach. For non-logged-in users, we employ CAPTCHA and IP blocking mechanisms. Authenticated public access users access the service via email/password authentication, integrating multi-factor authentication (MFA) for privileged/Admin accounts. For organisational Active Directory-linked accounts, we configure Single Sign-On (SSO) for seamless access. This layered approach ensures secure authentication while accommodating various user roles and data sensitivities.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: QMS International
• ISO/IEC 27001 accreditation date: 26/10/2021
• What the ISO/IEC 27001 doesn’t cover: Nothing
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Ember maintains robust security governance through ISO27001 certification. Our approach includes policies, risk assessments, and continuous monitoring to safeguard data integrity, confidentiality, and availability, ensuring compliance and trust with industry standards and client expectations.

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: Change management processes are carried out using Change Requests and Change Control Notes which are maintained within our Change Management system. All concerned parties are informed of the status of the request as changes or progress is made as applicable.
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: We scan all our services for emerging vulnerability intelligence and patching using intruder.io which is deployed against the live service once a month. Intruder.io provides web application scanning, host vulnerability scanning, and external perimeter - proactively identifying any design, configuration, or patching weaknesses. When identified, any threats are assessed in context and where warranted, mitigations are implemented in accordance with their severity. These controls and processes are monitored as part of our ongoing ISMS/ISO27001 auditing programme.
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: We implement a comprehensive protective monitoring process using Pingdom for uptime monitoring, Intruder.io for vulnerability scanning, and Observium for network monitoring. Potential compromises are detected through anomaly detection, Intruder.io scans, and Observium alerts. Upon identifying a potential compromise, we then isolate affected systems, investigates the breach, and implements necessary security patches. Our response times are:; ; Critical incidents: Responded to within 1 business hour, resolved within 3 business hours.; Significant incidents: Responded to within 4 business hours, resolved within 1 business day.; ; These response times ensure minimal disruption and uphold the security of hosted applications.
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: Our incident management system, part of our Business Continuity plan, swiftly addresses service disruptions. Our comprehensive process includes incident identification, categorisation, prioritisation, and resolution. Clients can report incidents via dedicated emails, a ticketing system, or directly to account managers. Each incident is acknowledged promptly and tracked with a unique identifier. We keep stakeholders informed through regular updates via email, client portals, or calls. After resolving incidents, we generate detailed reports outlining the root cause, actions taken, and preventive measures. These reports are securely shared with stakeholders to ensure transparency and continuous improvement in our processes.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Covid-19 recovery
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  As an ISO14001 certified business we understand that Climate Change is one of the largest risks to the world future and we have significantly invested in our operations and hosting architectures in order to take positive actions that will help to reduce its impact it has on the climate. ; These actions include:; Achieving and maintaining ISO14001 and running quarterly audits on our EMS system. ; Using suppliers with sound environmental policies.; Purchasing equipment that has the best possible energy rating.; Rearchitecting of our hosted services to use containerisation to reduce the energy demands.; Increased use of remote working reducing the impact of travel; When travel is required, the focus is on transporting staff on public transport.; The use of natural light within the office and fitting of energy-efficient lights

  Covid-19 recovery

  Our engagement with our local community as an important factor in our success as a company and with the impact of COVID-19 we have looked at ways to support our staff, customer, suppliers, and our local communities that include.; Recruiting people with a focus on further training including actively taking part in the SkillSeeker programme which allowed one of our members allowed people who have lost jobs in other industries an opportunity to retrain.; Supporting our staff with their recovery and allowing changes in their working environments/relationships that allow them to support their family and communities.; Allowing customers flexibility in contract terms, so that they can continue in business and finding other ways to support them.; Implemented a flexible working plan, where people can be onsite or offsite, depending on their comfort level.; We moved office to improved space and working environment for our staff.

  Tackling economic inequality

  We are actively participating in a number of programmes that are aimed at tackling inequality within our local communities. ; We are members of the Tech Talent Charter. ; We have the Developing Young Workforces’ Young Person Guarantee in place.; One of our Directors participates on the Digital Inclusion board of a national home care charity. ; One of our Directors is a member of the Developing Young Workforce Board. ; We recruit people with a focus on further training, allowing people who have lost jobs in other industries an opportunity to retrain.; Staff have developed and supported CPD objectives that allow them to develop and increase their opportunities.; Embrace and support emergent technology in our supply chain to provide growth and leverage the opportunities.; Actively engage our supply chain in the bidding process and support them in achieving the levels needed to deliver the service.

  Equal opportunity

  Ember actively works towards equality in the following ways:; We involve our Charity partners in User Research helping them become more Digitally inclusive while providing valuable user feedback for our clients. ; We are a Disability Confident committed organisation. ; Training is available to any staff member who is interested and is discussed during the hiring process to make sure that people have the support to improve.; Our staff support several charities that focus on inclusion for disabled people, and this behaviour is encouraged.; We support our staff who decide to undertake further education, making sure that they have the time and flexibility to both work and study. This support is also in most cases financial.; We deliver training on modern slavery to our staff during reviews and have appointed Directors for them to flag any concern that they have about internal staff, our suppliers, or customers.; We do not discriminate on any perceived groupings such as race, sex, background when hiring or promoting staff and this can be seen by the naturally occurring diversity within our staff, the management team and Board.; We have regular staff assessments, which include pay and mobility that we oversee to make sure of equality.

  Wellbeing

  The wellbeing of our staff and wider working environment is critical to our activities:; Our approachable culture means our staff can raise any concerns to any colleague in an anonymised process.; With our staff who may require support, an assessment of the possible support and a discussion on what is practical is undertaken, at which point a Board member is made responsible for the follow up.; Our office and working environments are audited annually to make sure they are safe.; Staff are made aware of mental health through discussion and training, and we endeavour to offer support to any member of staff that needs support; We encourage staff to engage with the community.

Pricing

• Price: £12,000 to £24,000 a licence a year
• Discount for educational organisations: No
• Free trial available: No

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at steven.wexelstein@ember.ltd. Tell them what format you need. It will help if you say what assistive technology you use.