THE GORDIAN GROUP LIMITED

Kykloud - Property Asset Management

Kykloud is a cloud based, property asset management software application used by property investors, owners, operators, and consultants in public and private sectors. It is comprised of two main components: Mobile data collection and a web-based property and project management portal with a real-time desk top publishing and reporting engine.

Features

• Bespoke Survey Template and reports to specific client needs
• API allows system connectivity and data sharing with other platforms
• Data ownership: Users maintain 100% ownership of their data
• Data Security: the highest levels of data integrity is applied
• Condition Inspections, compliance and energy audits
• Mobile Building inspections
• Portfolio analytics across the entire property portfolio

Benefits

• No hidden charges: unlimited report generation, free of charge
• Continous improvements: comprehensive product & services with monthly updates
• Real-time project View: full project tracking and control
• Improve & control quality: data integrity and cross-project consistency
• Service Availability: hosted on UK approved data centres
• Project Support: 9-5 help desk & dedicated Account Manager/Customer Success
• Industry Recognition

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at owainjames.page@gordian.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

709599535129708

Contact

Owain Page
0800 066 8060
owainjames.page@gordian.com

About the service

• Service categories:

  Application Development and Deployment

  Software quality and life cycle

  • Automated software quality
  • Software change, configuration and process management
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: Providing internet access/4g or 5g is available for download and upload, there are no constraints to use the service
• System requirements: Secure Internet Access/4G or 5G

User support

• Email or online ticketing support: Yes
• Support response times: Average response time is less than 4 hours from Monday to Friday, although we strive to respond within an hour. We do not provide Kykloud support on weekends, but do commit to responding first thing Monday morning if a request is submitted over the weekend
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Urgent calls: Application issue affecting all users; the system is inoperable. - Response within 30 minutes. - Escalation: Immediately to technical ; Notification to senior management­ immediately; Account Manager informed. High calls: Bug affecting key functionality and limiting ; the available functionality of the system. - Response within 1 hour - Escalation: Immediate notification to Help Desk Supervisor; Notification to helpdesk manager if SLA not met. Normal calls: A specific functional area is inoperable while other areas of the system are functioning normally. - Response within 4 hours - Escalation: Notification to helpdesk manager if SLA not met. Low calls: Advice, "how to" calls. Reports of less critical errors. - Response within 24 hours - Escalation: Notification to helpdesk manager if SLA not met. Request for Change: Request for new feature; feedback on a usability issue. - Acknowledged within 1 working day
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: During the customers onboarding & implementation process the Kykloud Professional Services team will work closely with the customer and end-users to determine exact requirements for the software and then deliver the necessary configuration and services to start their journey using Kykloud. Onsite training, online training and online help documentation are provided. Dedicated Account/Customer Success Managers plus an IT Support team are provided to work with the customers during their time with Kykloud to ensure that they are maximising the software's capabilities and functionality.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
  • Other
• Other documentation formats:
  • Excel Spreadsheets
  • Word Documents
• End-of-contract data extraction: Secure FTP transfer from Support Department
• End-of-contract process: A request to terminate, or at the end of the contract, a request to end is controlled by the assigned Account Manager. Outstanding costs will be settled.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Documentation and data can be accessed from within the KyKloud Web based application.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
  • ChromeOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Differences between the mobile and desktop service; Supported devices include Smartphone and Tablet that can access the latest device operating systems. The Kykloud Mobile software product is distributed via AppleTM AppStoreTM and Google Play. Kykloud Mobile software is installed on Apple iPadTM & Android tablet devices. Kykloud guarantees to maintain availability of software services as described above, ensuring Mobile software users can access data created on the Kykloud Core system, and upload data created in the Kykloud Mobile software to the Kykloud core system. All data held within the Kykloud Core system is backed up and is secure from loss.
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: Description of service interface; Kykloud has an internal API service interface that is used by the browser and iPad/Android application. It is not exposed publicly other than via the iPad/Android application.
• Accessibility standards: None or don’t know
• Description of accessibility: This is a topic that has been discussed in general but no project as yet to set aside for this specifically. As our web application is growing and we have more resource in Kykloud and engagement with User Experience teams we see accessibility hitting our design and development teams. We need to provide interaction with our product without any user barriers.
• Accessibility testing: The application makes use of voice recognition, Optical Character Recognition to assist customers with disabilities
• API: Yes
• What users can and can't do using the API: APls are granular in nature and require assistance from the service provider to address specific requirements/links. Access to Kykloud API is controlled via the Kykloud support function. Requests for application access keys are made via email. All software development is undertaken within a sandbox area. Access will not be given access to the full production API until it has been validated and certified. Kykloud does not charge additional fees for the use of Kykloud API but does operate a fair usage policy. All API activity via application keys and user accounts are monitored, together with the performance levels associated with it.
• API documentation: Yes
• API documentation formats: Other
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Description of customisation; What can be customised - Kykloud has been designed to be a flexible tool that allows users to personalise their survey templates/mandates, reporting and to add custom fields to capture their important and relevant data. How users can customise - Kykloud can be customised through the application or through Excel templates for custom survey templates working with our Professional Services team who provide their expertise and consultancy for customers during their onboarding. Who can customise - Customers are able to conduct some of their own customisations via their Mobile devices or by using the Kykloud web portal. Other complex customisations may require Kykloud's Professional Services assistance.

Scaling

• Independence of resources: 1. Kykloud's multi-tenanted environment strictly regulates and controls separation between users; so there is no adverse performance impacts; between users. 2. Interactive dashboards are deployed to continuously monitor performance across all aspects of the production infrastructure,; i.e. network, software, hardware and human; resource. 3. Technology future-proofing is a; prevailing feature of Kykloud's strategic planning; that ensures growth is achieved in a measured; and controlled manner.

Analytics

• Service usage metrics: Yes
• Metrics types: This can be in the form of a Dashboard to show progress of survey programme. We also collate metrics on individual usage of the Kykloud Portal ad Mobile Applications
• Reporting types:
  • Real-time dashboards
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: No
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: All Kykloud Core data is stored within ISO27001; accredited data centres, and all backups will be; encrypted and replicated to secondary ISO27001; accredited data centres. Customer data is stored; and accessed via their own dedicated url. All data; will be backed up using industry recognised; standards with a recovery point of 1 hour. Data; export is guaranteed; a customer can request a; full copy of their data at any time. Data is; transferred via secure FTP by the Kykloud Support; Department to a dedicated repository at the; buyer's site.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: Private network or public sector network
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)

Availability and resilience

• Guaranteed availability: Kykloud provide 99.5% availability, and generally exceeds this target. Kykloud Core: The hub of Kykloud software services - accessed via the web used by Kykloud customers to access and ­ manage asset data will be available no less than: 99.5% Kykloud Mobile: Kykloud Mobile software and­ will have access and availability for resilience/guaranteed­ communication between client device (running the Kykloud mobile software) Kykloud Core no less; than: 99.5% Kykloud API: Application Programming Interface used for integrating other products and data with Kykloud services and data will be available not less than: 99.5%
• Approach to resilience: Information provided on request
• Outage reporting: Outages will be reported by email alerts; such occurrences will be continually monitored by the Support Desk who will keep users informed of any adverse status by means of regular email bulletins.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Access restrictions are independently validated and include, but not limited to, the following processes: ISP 03: Access Control and Account Management
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Dedicated link (for example VPN)
  • Username or password
  • Other
• Description of management access authentication: Description of management access authentication; If this pertains to system administrator access to the underlying server/network environment, then it would be username and password. If this is referring to the management of system administrators that administer sites/portals through a browser for customers / it's administrator level access to the underlying network/servers, this would also require a VPN connection too. Only authorised administrators with UK security clearance are allowed this access.

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: Between 6 months and 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: Between 6 months and 12 months
• How long system logs are stored for: Between 6 months and 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Other security governance standards; ISO 9001:2015 MoD DART Accreditation Cyber Essentials Part 1 and Part 2 PCI DSS
• Information security policies and processes: Compliance to the following Security Policies is ; enforced through internal process improvement ; processes and by external certification audits: ISP 02 Risk Management and Assessment ISP 03 Access Control and Account Management ISP 04 Security Incident Management ISP 05 Asset ; Management and Information Classification ISP 06 Acceptable Use ISP 07 System Security and ; Network Access ISP 08 Business Continuity Plan; ISP 10 Security Patching ISP 11 Information Media Mobility, Storage and Disposal ISP 12 Physical Security and Access ISP 13 Systems Usage Logging and Audit ISP14 Staff recruitment, changes and leaving
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Examples of how configuration and change impact assessments are independently validated would include, but not limited to, the following processes: DSP 01: Design and Development Methodology DSP 02: Change and Configuration Control
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Examples of how vulnerability management ; processes are deployed by independent validation ; would include, but not limited to, the following processes: ISP 02 Risk Management and; Assessment ISP 10 Security Patching ISP 13 Systems Usage Logging and Audit
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Examples of how actual and potential security; incidents are identified and managed in a; responsive and effective manner would include,; but not limited to, the following processes: ISP 04:; Security Incident Management
• Incident management type: Supplier-defined controls
• Incident management approach: Incidents are reported by users to a single source; at the Kykloud Support Desk. SLA regulations are; then applied. A pre-defined process is; documented in ISP 04 - Security Incident; Management procedure that ensures all internal; and external incidents are promptly reported and; effectively managed.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Description of free trial; Full system features are made available for one month trial period to selected users.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 2.5%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 7.5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 12.5%
• Over £5,000,001: 15%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: Amtivo Group Limited T/A British Assessment Bureau Ltd.
• ISO/IEC 27001 accreditation date: Tuesday 1 April 2025
• What the ISO/IEC 27001 doesn’t cover: Gordians NSR - National Schedule of Rates; MTC QS; Capital Planning on Gordian Cloud Platform
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• ISO 9001 certification accredited by: Amtivo Group Limited T/A British Assessment Bureau Ltd.
• ISO 9001 accreditation date: Tuesday 1 April 2025
• What the ISO 9001 doesn’t cover: Gordians NSR - National Schedule of Rates; MTC QS; Capital Planning on Gordian Cloud Platform
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: None of the criteria
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at owainjames.page@gordian.com. Tell them what format you need. It will help if you say what assistive technology you use.