CHARACTER COUNTS LTD

EasyPeasy

EasyPeasy is an evidence-based digital intervention supporting parents of children aged 0-5. It strengthens the home learning environment, boosts parental wellbeing, and helps close development gaps at scale. Commissioned by local authorities, it improves early years outcomes and GLD, delivering scalable, preventative early help aligned with Best Start in Life.

Features

• Evidence-based, digital home learning programme delivered via mobile app
• Personalised, AI-driven content recommendations tailored to needs by child age
• Real-time impact dashboard with engagement, usage, and outcome reporting
• Secure practitioner and parent accounts with role-specific access permissions
• Automated push notifications, emails, and in-app messages driving engagement
• Special educational needs adaptations embedded across all activities
• Multi-language support and accessible design, meeting recognised accessibility standards
• Local authority configurable content, signposting, and co-branded resources
• Power BI API enabling secure data integration with council systems
• Moderated community features ensuring safeguarding, quality assurance, and user safety

Benefits

• Improves Good Level of Development outcomes, narrowing gaps for children
• Provides evidence-based, quality-assured parenting support outside traditional working hours
• Enables earlier intervention through real-time insights into engagement and development
• Reduces practitioner workload by supporting families digitally between appointments safely
• Improves consistency of practice using shared, evidence-based guidance across services
• Expands reach to disadvantaged families without increasing frontline staffing capacity
• Strengthens commissioning decisions using robust impact data and cost-effectiveness evidence
• Supports flexible working with secure remote access to tools/insights
• Automates engagement and follow-up, reducing manual communications and administrative burden
• Enables practitioner to focus on relational, targeted, and complex support

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@easypeasyapp.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

711936613486563

Contact

Jen Lexmond
+44 204 572 2650
hello@easypeasyapp.com

About your service

• Service categories:

  Applications

  Production and operations

  • Other operations

  Service industry and public sector operations

  • Healthcare
  • Education
  • Other
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: EasyPeasy has minimal constraints for buyers. The service is cloud-based and accessed via standard web browsers or mobile apps, with no specialist hardware or software required. Planned and emergency maintenance may occasionally affect availability and are excluded from the 99.9% uptime commitment. Support is provided during UK business hours (Monday–Friday, 9am–5pm), with defined response times based on incident priority. The mobile app meets Android and Apple device acceptability criteria, including support for older devices, to ensure broad and inclusive access.
• System requirements: N/A

User support

• Email or online ticketing support: Yes
• Support response times: Within 1 business day
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: No
• Support levels: N/A
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: EasyPeasy supports users through a structured onboarding process including guides, videos, and comprehensive documentation. Practitioners receive two-hour tailored online training covering programme use, engagement strategies, and data insights. Delivery leads are guided through implementation, account setup, and data access and insights. Offboarding is managed securely, with access removed promptly and data handled in line with GDPR and local agreements.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
  • Other
• Other documentation formats:
  • Video recording
  • Microsoft Excel (.xlsx)
  • Microsoft Powerpoint (.pptx)
• End-of-contract data extraction: When a contract ends, EasyPeasy supports clients to extract their data through a controlled off-boarding process. Data is identified, reviewed, and provided in an agreed, commonly used format (e.g. CSV) via a secure transfer mechanism, not email. Once the client confirms receipt, access is revoked and remaining personal data is deleted or anonymised in line with our retention policy. The process is logged, auditable, and overseen by the Data Protection Officer to ensure UK GDPR compliance.
• End-of-contract process: At contract end, EasyPeasy follows a clear and auditable offboarding process at no additional cost. We update all systems in line with the contract expiry date, close off the commercial SLA deliverables, and update all relevant CRM records to ensure accuracy. Parents and practitioners receive advance communications about access ending, and any unscheduled or scheduled practitioner training is cancelled. We deactivate the authority’s impact dashboard, web portal, landing pages and surveys, and redirect public links. Local authority data and contacts are removed from internal systems, and access permissions are reviewed. Financial and renewal records are closed, and an offboarding call is held to gather feedback and ensure a transparent, compliant close.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: EasyPeasy operates two complementary services with distinct purposes. The mobile app is designed for parents, carers, and practitioners, delivering an evidence based programme of activities, tips, videos, and local service information to support early years development. The desktop service is an Impact Dashboard, used by Local Authorities and partners to view data on engagement, reach, and outcomes. It focuses on reporting and insight rather than direct user interaction or content delivery.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: The EasyPeasy app uses a mobile-first, card-based interface designed for parents, carers, and practitioners. Content is presented through a simple feed and structured collections, with clear navigation, large touch targets, accessible language, and visual prompts to support ease of use on smartphones.; ; The Impact Dashboard is a desktop, web-based interface designed for Local Authorities and partners. It uses charts, tables, and filters to present aggregated data on reach, engagement, and outcomes, optimised for analysis rather than day-to-day interaction.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: EasyPeasy has carried out interface accessibility testing using platform-standard tools including Google Accessibility Scanner (Android) and Xcode Accessibility Inspector (iOS). These tools are used to identify common accessibility issues such as missing labels, contrast, focus order, and touch target size. Findings are reviewed and prioritised based on user impact and remediated as part of ongoing product improvements. Formal usability testing with assistive technology users is planned as part of our continuous accessibility roadmap.
• API: Yes
• What users can and can't do using the API: Via the API used for our Power BI integration, authorised users can:; Retrieve reporting data required to populate the Impact Dashboard (e.g., registrations, engagement, usage, outcomes) in a structured format for analysis and visualisation; Filter data based on permitted parameters (e.g., date ranges and Age range scope), aligned to role-based access controls; Refresh dashboards in Power BI on a scheduled basis using the configured connector/credentials.; ; Users can’t: Create, edit, or delete user records or engagement data via the API (read-only reporting use); Access personal data beyond what’s permitted for reporting (the API is designed to support aggregated/anonymised outputs for LA reporting); Bypass access controls (e.g., query other Local Authorities’ data) or change permissions through the API; Trigger operational actions in the EasyPeasy app (e.g., messaging users, modifying content, or account management).
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: Parents and caregivers can create and share ideas and activities with the wider community, alongside commenting, favouriting, and liking content. Local Authorities and practitioners can customise content, service signposting, and local resources to meet community priorities, as well as selecting priority topics. Physical and digital awareness raising materials are co-branded and customised, with guidance from our team to ensure relevance, engagement, and alignment with local strategies.

Scaling

• Independence of resources: EasyPeasy is hosted on AWS and designed using a scalable, cloud-native architecture. Core application services automatically scale based on demand and have rate limits in place, ensuring consistent performance as user numbers fluctuate. Workloads such as reporting and analytics are separated from live user services to avoid contention. Performance is continuously monitored, with alerts in place to identify and address issues early. This approach ensures that individual users are not adversely affected by spikes in demand from other users.

Analytics

• Service usage metrics: Yes
• Metrics types: EasyPeasy provides service metrics through its Impact Dashboard and Power BI reporting, designed to support service oversight and evaluation rather than individual tracking. Metrics are grouped into three areas: registration (e.g. number of users joining the service), engagement (e.g. aggregate usage of activities and content), and location-based reporting using high-level geographic indicators such as postcode district or ward. Location data is presented only in aggregated, anonymised form to help clients understand reach and coverage, not to track individual users.
• Reporting types:
  • API access
  • Real-time dashboards
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
  • Other
• Other data at rest protection approach: In addition to encryption and physical security controls, EasyPeasy protects data at rest through strict access controls and architectural isolation. Databases are not publicly accessible and can only be reached through controlled application services. Access is limited using role-based permissions and the principle of least privilege. Backup data is protected using the same encryption and access controls as production systems. Regular access reviews, change management controls, and monitoring help ensure data remains protected throughout its lifecycle
• Data sanitisation process: Yes
• Equipment disposal approach: In-house destruction process
• Data sanitisation type: Data Erasure

Data importing and exporting

• Data export approach: App users can export or manage their data through defined data subject request processes and in-app controls. Users may request access to their personal data, which is securely provided in a commonly used electronic format. Users can also delete their account directly within the app, triggering deletion or anonymisation of personal data in line with our retention policy. All requests are identity-verified, logged, and completed within statutory timeframes, with oversight from the Data Protection Officer.
• Data export formats:
  • CSV
  • Other
• Other data export formats: Microsoft Excel (.xlsx)
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • Microsoft Excel (.xlsx)
  • PNG
  • MOV
  • MP4
  • JPG

Data-in-transit protection

• Data protection between buyer and supplier networks: Other
• Other protection between networks: N/A
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Service uptime: We guarantee that the service will be available 99.9% of the time (excluding scheduled maintenance and emergency maintenance).
• Approach to resilience: EasyPeasy is designed for resilience in line with the government’s Cloud Security Principle 2 (Asset protection and resilience). Our service is hosted on AWS, using resilient data centre infrastructure with built-in redundancy, fault isolation, and managed availability controls. Production services operate in the AWS London region with the ability to fail over to a secondary European region under our Business Continuity & Disaster Recovery Plan. Databases are not publicly accessible and our API is rate-limited to protect service availability. Further detail on our data centre resilience and architecture is available on request.
• Outage reporting: EasyPeasy reports service outages through a defined incident communications process. When an outage or significant service disruption is identified, our Customer Support team notifies affected clients directly via email, outlining the nature of the issue and the expected impact. Updates are provided as needed during the incident, and a follow-up confirmation is sent once the issue has been resolved. This ensures clients are kept informed throughout the incident lifecycle.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
• Other user authentication: EasyPeasy uses role-appropriate authentication methods across its services. For the mobile app, users authenticate using an email and password, or via third-party authentication providers including Google and Apple, ensuring a secure and familiar sign-in experience. User are also required to validate their email via a code.
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels at EasyPeasy is restricted through role-based access control (RBAC) and the principle of least privilege. Only authorised staff are granted access to administrative systems, support tools, and data views required for their role.; ; Access is provisioned and removed through formal onboarding and offboarding processes, with permissions approved by designated system administrators and recorded in the approved software register. Strong authentication, including MFA where available, is enforced. Access rights are reviewed regularly, and all administrative activity is logged to support oversight, audit, and incident investigation.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Other
• Description of management access authentication: For staff and administrative access, we enforce strong authentication controls. Multi-factor authentication (MFA) is enabled where available, with Google-based authentication used where native MFA is not supported. All software and cloud applications are recorded in an approved software register, which documents administrators, user roles, and access levels. Access is granted on a least-privilege basis and reviewed regularly.

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users receive audit information on a regular basis
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: In addition to Cyber Essentials Plus, our security governance aligns with the following recognised standards and frameworks:; • UK Software Security Code of Practice; • UK GDPR / Data Protection Act 2018; • NCSC Cloud Security Principles
• Information security policies and processes: EasyPeasy follows a defined set of information security policies covering access control, data protection, incident management, acceptable use, supplier management, business continuity, data minimisation. Policies are approved by leadership and owned operationally by the Data Protection Officer, working closely with Product and Engineering.; ; Compliance is ensured through role-based access control, mandatory staff training, onboarding and offboarding processes, regular risk and access reviews, and incident reporting procedures. Adherence is monitored through ongoing governance reviews, audit evidence (e.g. Cyber Essentials Plus controls), and escalation via senior management where issues are identified.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: EasyPeasy operates a controlled configuration and change management process covering application code, cloud infrastructure, and third-party services. Service components are tracked throughout their lifecycle using version control, approved software registers, and ticketed change records. Changes are subject to multi-team code review involving Engineering, Product, and, where relevant, Security and Data Protection oversight. All changes are assessed for operational, security, and data-protection impact, including access controls and data flows. Higher-risk changes trigger additional security review or DPIA updates and follow defined testing, approval, and monitored release processes.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: EasyPeasy operates a risk-based vulnerability management process across application code, infrastructure, and third-party services. Potential threats are assessed through regular risk reviews, dependency monitoring, access reviews, and supplier assurance, with severity judged based on likelihood, impact, and data risk.; Patches and updates are prioritised by risk. Critical vulnerabilities are addressed as soon as practicable, with fixes deployed following expedited testing and change approval; lower-risk patches are included in planned release cycles.; Information on threats is sourced from AWS security advisories, NCSC guidance, supplier notifications, vulnerability databases, GitHub vulnerability scanning, and internal monitoring, with findings logged and tracked through to resolution.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: EasyPeasy uses protective monitoring to identify and respond to potential security compromises across our services. We monitor system activity, access logs, and service alerts provided through AWS and application-level logging to detect unusual behaviour, unauthorised access attempts, or service anomalies.; ; When a potential compromise is identified, it is assessed immediately and escalated according to our incident response process. Actions may include access restriction, investigation, containment, and remediation, with involvement from engineering, product, and the DPO as appropriate.; Incidents are responded to promptly, with initial triage typically within hours, and critical issues prioritised for immediate action and stakeholder notification where required.
• Incident management type: Supplier-defined controls
• Incident management approach: EasyPeasy operates a documented incident management process with predefined response procedures for common events, including service outages, security incidents, and data protection issues. These processes define roles, escalation paths, and required actions.; ; Users and clients can report incidents via our Customer Support channels or designated contact emails, with internal staff escalating issues through defined internal workflows.; ; Incidents are logged, investigated, and managed through to resolution. Where appropriate, affected clients are informed during the incident and provided with follow-up communications or incident summaries outlining the issue, impact, actions taken, and resolution.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: EasyPeasy offers a free, publicly available version of its app, accessible via the Google Play and App stores. This provides a limited subset of content and functionality for reference purposes. Full programme features, population-level access, implementation support, and optimisation are only available through a commissioned local authority partnership.
• Link to free trial: App Store: https://apps.apple.com/gb/app/easypeasy-parenting-tips/id1180585219 Play Store: https://play.google.com/store/apps/details?id=com.easypeasyapp.epappns

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 096cd44f-3314-4372-aa76-84524fa272a9
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 2b5dc3b5-9745-4f65-8084-512200deb697
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
    • Methods for engaging with different parts of the community (including the education system and charities representing the community) and how communities come together to inform decisions, strategy and projects to leave a positive legacy for future generations
    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)
    • Measures to engage users and communities and build relationships to increase community integration build trust and influence how the contract is delivered
    • Support for community-led initiatives relevant to the contract. Illustrative examples: improving transport links; reducing loneliness; helping with English language proficiency; and facilitating social mixing among people with different backgrounds

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@easypeasyapp.com. Tell them what format you need. It will help if you say what assistive technology you use.