Poppulo Omnichannel Employee Communications Platform

Service scope

Software add-on or extension: No
Cloud deployment model: Community cloud

Hybrid cloud
Service constraints: No significant constraints
System requirements: Communicators access Poppulo backend via web browser to create communications

Poppulo Emails are read on any standard email client.

Poppulo Mobile requires users download the mobile-news-app to receive communications

People data uploaded to Poppulo - People email-addresses at minimum

Speak to Poppulo Sales for further requirements

User support

Email or online ticketing support: Email or online ticketing
Support response times: Unless explicitly stated otherwise, all Poppulo users have access to the Poppulo support team by calling +44 800 085 6388 and can submit queries to support@poppulo.com. Poppulo Support agents are available to respond to phone or email queries from 6am to 2am GMT/BST, Monday to Friday (excluding December 25th and January 1st of any year).

Poppulo categorises issues into four Severity levels. The target response time is directly related to the severity categorisation of each issue:
User can manage status and priority of support tickets: No
Phone support: Yes
Phone support availability: 9 to 5 (UK time), Monday to Friday
Web chat support: No
Onsite support: No
Support levels: Unless explicitly stated otherwise, all Poppulo users have access to the Poppulo support team by calling +44 800 085 6388 or can submit queries to support@poppulo.com. Poppulo Support agents are available to respond to email or phone queries from 6am to 2am the following morning GMT/BST, Monday to Friday (excluding December 25th and January 1st of any year). A full list of international phone numbers is available on the Poppulo website at www.poppulo.com

A Customer Success Manager will be appointed to each customer who purchases Poppulo, to successfully manage the onboarding of the Poppulo solution and provide Account Management throughout the partnership with the customer.

Poppulo Customer Success Teams are based in Ireland, with the Irish team available from 9am to 5pm GMT/BST, Monday to Friday (excluding Irish public holidays, December 25th, December 26th and January 1st of any year).

The Poppulo online Knowledge Base provides quick online step-by-step guides and video tutorials to answer regular questions. Access the Knowledge Base at https://knowledgebase.poppulo.com/
Support available to third parties: Yes

Onboarding and offboarding

Getting started: The Poppulo Onboarding program begins at the point the organisation becomes a new customer. The new team is greeted by a dedicated Customer Success Manager (CSM) who works with the team leader to create a dedicated project plan.

The 90-day program is designed to ensure the Poppulo implementation
meets the customer needs, and is providing the results the customer wants as quickly as possible.

Key stages are,
Kick-off stage: Jointly scope the project.
Technical setup: Configure data and security to meet customer goals
Design Implementation: Complete branded newsletter designs
User training: Training pack and live webinar training
First send: Once the account is ready, designs are complete and technical specifications are in place, everything is ready to complete the first send

Full details at;
https://onboarding.newsweaver.com/html/6hw8xgeqcu9

Specifically for Poppulo Mobile, as part of the onboarding program Poppulo will provide full guidance around a thoughtful and strategic implementation of our software. This will include tools, tips and tricks for how to;

- Fit mobile within your IC channel landscape
- Optimise your content strategy for mobile
- Build buzz, and the tools & strategies required for buy-in & adoption
- Better measure, analyse & optimise
Service documentation: Yes
Documentation formats: HTML
End-of-contract data extraction: Data is retained for the life of the account engagement. When the account is closed, we will ask what you want us to do with your data. If you do not ask us to delete it sooner, or to keep it longer (for example to give you more time to retrieve it), we will delete the data within 90 days.

Paper records, portable media and end of life media/devices are subject to zero-filling, degaussing and/or shredding (depending on media/type) by an authorised third-party secure disposal provider. The provider certifies destruction to Poppulo, and can (if required) certify destruction to you.
End-of-contract process: At the end of the contract Poppulo shall no longer provide the Services to the Customer and the Customer shall promptly cease using the services. Each party shall promptly return or destroy all Confidential Information of the other party in its possession. Within ninety (90) days following termination, the Customer may retrieve the Customer Content in accordance with established and reasonable system access procedures. After such period, Poppulo will have no further obligation to store and/or make available the Customer Content and may delete the same

Using the service

Web browser interface: Yes
Supported browsers: Microsoft Edge

Firefox

Chrome

Safari
Application to install: No
Designed for use on mobile devices: Yes
Differences between the mobile and desktop service: Administrator interfaces (used by communicators to create, publish, and track communications) are not overtly designed for mobile devices, but mobile devices can be used.

However, subscriber interfaces (used by the recipients of communications) are designed with mobile devices in mind.

For example, email received by employee/staff audience is based on newsletter templates which are fully mobile responsive.

The Poppulo Mobile Employee News App is specifically designed for employees who need more regular communications via a mobile channel

Messages can also be published into Microsoft Teams or SharePoint and read in their corresponding apps

Speak to Poppulo for more information
Service interface: No
User support accessibility: WCAG 2.1 A
API: Yes
What users can and can't do using the API: All key services available via the web UI (adding message content, sending communications, extracting reporting information, etc) are also available via the RESTful API. API documentation is available at: https://developer.poppulo.com
API documentation: Yes
API documentation formats: HTML

PDF
API sandbox or test environment: No
Customisation available: Yes
Description of customisation: The output in the form of the newsletters or flyers or event invites can be customised to the customer branding.

A personalised greeting can be added.

The subject line and sender details can be personalised. This allows the sender to personalise the From Name, From Email Address and Reply-To Address so they are targeted at the particular subscribers receiving the communications.

Poppulo Dynamic Content feature allows the sender to target certain articles to only those subscribers for which they are relevant.

Drag/Drop provides the user creating the email the ability to move articles around their emails by dragging and dropping into position. Poppulo also provide the functionality to add, move and delete components within emails.

In the Mobile App, the in-app experience can be branded to the customer brand identity.

Mobile communications and other communications delivered in Microsoft Teams, SharePoint and Viva can be targeted based on key employee data points, and employees can self select optional categories of communications they wish to opt-in or opt-out of..

Other possibilities also exist. Please speak to a Poppulo representative.

Scaling

Independence of resources: Poppulo is a web-based SaaS platform that (currently) supports concurrent and daily use by >15,000 communicators across more than 1000 customers in more than 100 countries, communicating with approximately 25,000,000 subscribers (customer employees). There are no technical, capacity, or commercial limits on the number of UK Government users who can access, send, or receive communications at the same time.

Analytics

Service usage metrics: Yes
Metrics types: Poppulo Enterprise accounts provide Send Volumes and Quotas which enable Enterprise Users to quickly see the number of emails sent and the percentage of quota used by each Sub-Account. Enterprise users can also see the total number of user licenses available, how many have been allocated and how many are available for allocation.
Reporting types: Real-time dashboards

Resellers

Supplier type: Not a reseller

Staff security

Staff security clearance: Other security clearance
Government security clearance: None

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom

European Economic Area (EEA)
User control over data storage and processing locations: No
Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency: At least every 6 months
Penetration testing approach: Another external penetration testing organisation
Protecting data at rest: Encryption of all physical media

Scale, obfuscating techniques, or data storage sharding

Other
Other data at rest protection approach: Data at rest is always encrypted. Specifically, all systems and services are subject to FDE encryption. Including DB systems. FDE keys are at least 2048 bit in length, and the approved/default ciphers include RSA and AES. Encryption keys are stored and retrieved from Poppulo's keystore. Encryption keys, and the passwords associated with keys, are stored separately in an encrypted password database (which itself uses AES symmetric ciphers).
Data sanitisation process: Yes
Data sanitisation type: Explicit overwriting of storage before reallocation
Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach: Data (including subscriber data/email addresses, content data/email articles, subscriber activity data/email engagement reports) can be extracted by authorised users via the web UI (in CSV, HTML or PDF formats). Or via the API (in XML format).
Data export formats: CSV

Other
Other data export formats: HTML

PDF
Data import formats: CSV

Other
Other data import formats: .Txt

.XLS

.Tab

Data-in-transit protection

Data protection between buyer and supplier networks: TLS (version 1.2 or above)
Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability: Hosted Services shall be available at least 99.5% of total time each month, excluding scheduled downtime. No refunds are paid.

Product Release Related Downtime:
Poppulo targets the release of ten product updates every year. Poppulo shall notify users through in-app alerts at least four (4) business days prior to product iteration related scheduled downtime. This essential work is normally completed within five (5) hours.

Maintenance Notification:
If the Poppulo system needs to be made unavailable, Poppulo shall notify users through in-app alerts at least four (4) hours prior to the scheduled downtime. Poppulo shall attempt to avoid scheduling any downtime between 8am to 6pm GMT/BST on the EU data center and work closely with our customers to understand their communication schedules to minimise any impact of system updates or maintenance downtime.

When minor system updates take place, the platform shall be available but certain functions such as email sending and subscriber uploads may be unavailable. For these minor system updates Poppulo shall notify users through in-app alerts at least 30 minutes prior to the system update and detail which specific functions may be unavailable during that time.
Approach to resilience: Poppulo commits to a Service Level Agreement (SLA). Poppulo can also present historical evidence of service availability on request. Furthermore, upon request Poppulo can share additional information on how the service has been designed to be resilient.
Outage reporting: Severity 1 (Critical) Issues (critical production issue affecting all users that severely impacts use of the software)
Systems monitored 24/7.

Initial response posted on the Poppulo website within 1 hour at www.poppulo.com/status

Ongoing response time
Updates posted every 30 minutes at www.poppulo.com/status. If the issue has not been resolved with 2 hours, users shall be notified of the issue by email. Once the issue is resolved an update shall be posted on www.poppulo.com/status and Poppulo shall communicate a report on the reason for the outage.

Severity 2 (Urgent) issues. (Major functionality is impacted or performance is significantly reduced. An issue that is persistent and affects many users and/or major functionality with no workaround available)
Systems monitored 24/7.

Initial response time
Initial response posted on the Poppulo website within 1 hour at www.poppulo.com/status and as an in-app alert to all affected users.

Ongoing response time
Updates posted every hour at www.poppulo.com/status. If the issue has not been resolved with 6 hours, affected users shall be notified of the issue by email. Once the issue is resolved an update shall be posted on www.poppulo.com/status

Identity and authentication

User authentication needed: Yes
User authentication: Username or password

Other
Other user authentication: Poppulo offers ISO27001 accredited and OWASP aligned authentication controls and options. Commonly selected option is for Poppulo to perform user authentication (where credentials are securely stored and appropriately validated by Poppulo). In this case, where Poppulo acts as identity provider, additional multi-factor checks can be applied (eg: additional IP address or hardware token checks). Option exists for customer to perform user authentication (where credentials are stored in customers’s environment, and validated in a SAML exchange via customer’s SSO system). These types of authentication controls can be granularly applied to administrative users (sending communications), or subscriber users (receiving communications), or both.
Access restrictions in management interfaces and support channels: Poppulo User Roles ensure the users of the Poppulo account have the right amount of access and privileges. When adding a User, the customer will need to give them a User Role. For example, giving a user a Reports role will let them access the Reporting Area but not content, while the Publisher role restricts access to the Admin Area. A defined list of roles is available and Poppulo support can create custom roles if required. Only active users may receive end user support.
Access restriction testing frequency: At least once a year
Management access authentication: 2-factor authentication

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: At least 12 months
Access to supplier activity audit information: Users have access to real-time audit information
How long supplier audit data is stored for: At least 12 months
How long system logs are stored for: At least 12 months

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: Certification Europe
ISO/IEC 27001 accreditation date: Initial certification 08/08/2012 valid to 07/08/2024
What the ISO/IEC 27001 doesn’t cover: N/A. The scope of the certified ISMS program is to "protect customer and corporate information along with the services and processes that secure that information", and includes all processes, applications and sites which are relevant to the fulfillment of the scoped services.
ISO 28000:2007 certification: No
CSA STAR certification: No
PCI certification: No
Cyber essentials: No
Cyber essentials plus: No
Other security certifications: Yes
Any other security certifications: ISO27001

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001
Information security policies and processes: Poppulo operates a mature and robust Information Security Management System (ISMS). Our ISMS program is independently audited and accredited to the ISO27001:2013 standard. A regime of internal and external audits and certification reviews supports the program - including:
● internal audit - (twice-annually) by the ISMS audit team
● external audit - (twice annually) by Certification Europe - a UKAS accredited ISO certification body
● external penetration testing - (twice annually) by BCC Risk Advisory - against at least OWASP norms
● external vulnerability testing - (monthly) by Qualys - against the latest published threats/risks
● ad hoc audit/assessment - (frequently) by our customers, their auditors or their regulators
More information on our ISMS program, evidence of independent audit and certification is available as needed

Operational security

Configuration and change management standard: Supplier-defined controls
Configuration and change management approach: Change controls and processes are independently assessed for compliance with ISO27001:2013 norms. Including clauses A.12.1.2 (Change management), A.14.2.2 (System change control procedures), and A.15.2.2 (Managing changes to supplier services) of the ISO27002 codes of practice.
Vulnerability management type: Supplier-defined controls
Vulnerability management approach: Vulnerability management controls are independently for compliance with ISO27001:2013 norms. Specifically clauses 12.6.1 (management of technical vulnerabilities), 14.2.1 (secure development policy - including avoiding, finding and fixing vulnerabilities in the development lifecycle), 14.2.9 (system acceptance testing - on use of code analysis tools and vulnerability scanners), 18.2.3 (technical compliance review - penetration and vulnerability testing).
Protective monitoring type: Supplier-defined controls
Protective monitoring approach: Monitoring controls are assessed to relevant ISO27001:2013 standards, including clauses 12.4 (logging and monitoring) of the ISO27002 codes of practice.
Incident management type: Supplier-defined controls
Incident management approach: Incident management controls are assessed to ISO27001 standards, including the controls expected by ISO27002 section 16.1 (Management of information security incidents and improvements)

Secure development

Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

Connection to public sector networks: No

Equal opportunity: Equal opportunity

Creating a better understanding of Equality And Diversity in the workplace involves creating a culture of fairness and inclusion, offering all staff appropriate diversity and inclusion training, identifying and preventing unconscious biases, ensuring diversity and inclusion exist in the recruitment processes, ensuring your people are aware of indirect discrimination, and more.

All of these requires an orchestrated approach to communication, including the ability to reach all employees wherever they are, (Remote, Office, Hybrid, or Disconnected), and backed by the appropriate campaign management and measurement to ensure the employee communications organisation are doing their part to deliver on the organisational commitments around equal opportunities and diversity.
Wellbeing: Wellbeing

How organisations communicate with, and treat their staff affects how they undertake their work, display resilience at times of pressure, and manage any difficulties they may be experiencing.

Communicating with people in a personalised and targeted manner, ensuring what is being communicated is of relevance and/or of interest, and ensuring your people have a voice and feel heard, strengthens relationships and ensures everyone is on the same page. This creates a positive working environment, and improves both employee motivation and productivity.

Effective employee communications, incorporating active listening and empathy are integral to managing your employees physical and mental health in the workplace.

Pricing

Price: £20,000 a licence a year
Discount for educational organisations: No
Free trial available: No

Poppulo Omnichannel Employee Communications Platform

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

Poppulo Omnichannel Employee Communications Platform

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents