EXCHANGE COMMUNICATIONS INSTALLATIONS LIMITED

Zoom Phone provided by Exchange Communications

Zoom is an all-in-one collaboration platform that makes connecting easier, more immersive, and more dynamic for people and businesses. Zoom Phone solutions help hybrid teams collaborate and get more done.

Features

• AI-powered collaboration platform that streamlines your communications and improves productivity
• Artificial intelligence seamlessly embedded throughout the entire platform experience
• Simple licence structure
• Comprehensive cloud phone system built for organizations of any size
• Call Handling, voicemail, softphone, conferencing, presence
• Instant messaging designed to simplify and accelerate user communications
• Employee experience platform driving stronger communication and engagement
• Supports multiple modern handset makes, no need to replace
• Unified platform for creating virtual events, webinars, and digital experiences.
• Developer platform with 2,500+ ready-to-use integrations for seamless connectivity.

Benefits

• Unified cloud communication platform designed for simplicity and reliability
• AI Companion integrated across platform at no extra cost
• Single, centralised admin console enables fast deployment and effortless scalability
• Affordable subscription pricing with transparent licensing for all users
• Hundreds of updates delivered annually to enhance platform performance
• Intuitive interface ensures quick adoption and seamless user experience
• Powerful dashboards simplify administration and user activity reporting
• MSI management streamlines deployment of development releases efficiently
• Technical support available 365x24x7
• High-availability platform ensuring uninterrupted communication, collaboration, and continuity

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bids@exchangecommunications.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

744294492477892

Contact

David Morse
0141 776 8859
bids@exchangecommunications.co.uk

About your service

• Service categories:

  Applications

  Production and operations

  • Other operations

  Service industry and public sector operations

  • Healthcare
  • Education
  • Other
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Not Applicable
• System requirements:
  • Internet connection—broadband wired or wireless, including 3G and 4G
  • Speakers and microphone—built-in, USB, or wireless Bluetooth connectivity supported
  • Webcam or HD webcam—built-in or USB plug-in optional.

User support

• Email or online ticketing support: Yes
• Support response times: We acknowledge receipt within 1 working hour and all questions are responded to within 4 working hours
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: None or don’t know
• How the web chat support is accessible: Through the web chat functionality on our website the end user can request Live Chat, send a message or request Call Back
• Web chat accessibility testing: Currently undergoing Website upgrade
• Onsite support: Yes, at extra cost
• Support levels: Silver (level 1) - 09:00 to 17:00 Mon-Fri excluding public holidays, Phone/Fax/ email support, Proactive monitoring, Dedicated service desk team, customisable notification, Remote diagnostics, Escalation process Price per Annum 5% of RRP of supported item. Silver (level 2) - As per Silver Level 1 except 08:00 to 20:00 Mon-Fri excluding public holidays Price per annum - 7% of RRP of supported item Gold - As per Silver level 2 except 24x7x365 excluding public holidays Price per annum - 10% of RRP of supported item. Platinum - 24x7x365 as per Gold including Software release management Price per annum - 12% of RRP of supported item. All clients receive a named service desk contact and primary Avaya expert engineer. Mutually agreed SLA's - 30 mins to 1 day response times, 1 hour to 2 day fix times available
• Support available to third parties: Yes
• AI chatbot: No

Onboarding and offboarding

• Getting started: Customers will have access to Zoom's Customer Success Advisors. Starting with the onboarding journey, the CS Advisor team guides where customers can get started with learning via the Zoom Learning Center and various support guides. Once our customers are live on their Zoom solutions, this team provides proactive digital deliverables to help customers drive adoption and maximize their investment in Zoom. Our Customer Success program is focused on ensuring customers achieve the value they expect throughout their Zoom journey. This approach enables faster response times with group knowledge for better and more efficient support. Self Service Offerings also include: Zoom Learning Center (Learn anytime, anywhere and expand your product knowledge), Zoom Community (get involved, become a leader, and connect with other Zoom users and customers), Zoom Support (find answers to your product questions in our many articles and training materials, or contact the support team for technical assistance), and Webinars (attend onboarding webinars to learn about best practices and get the latest information about the Zoom platform).
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: If information or data in your Zoom account needs to be maintained for any reason, including legal preservation obligations, arrangements will be made to download and preserve the data is needed. Resources and support articles for downloading and saving that data are provided on the Zoom support site.
• End-of-contract process: Upon termination of the customer's contract, Zoom will deactivate all user IDs associated to that billing account and delete any saved recordings.; Zoom has a data retention standard that details how data is deleted when a customer terminates service (i.e., purged on day 31). Furthermore, our Data Protection Standard states how Zoom must sanitise media. Zoom has a process for records retention to ensure that Personal Information is retained for no longer than necessary to fulfill the obligations or meet legal retention requirements."
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
  • ChromeOS
  • Other
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Desktop service is best for in-depth management, multitasking, complex presentations, and a full-featured experience. ; The mobile app can't edit sent messages, star conversations, or manage blocked accounts and the chat interface can be less intuitive than the desktop service; The mobile service is better when on the move, making quick calls, and maintaining a professional presence remotely. ; Use desktop service for focused work, multitasking, hosting meetings, or when you need full control and screen space.; Use mobile service when away from your desk, needing quick communication, or for simple call management.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Zoom offers consolidated administration through the Zoom web portal, allowing account administrators to efficiently manage a geographically distributed organization from a single interface. End users can also access their setting via the same portal, which administrators can configure with granular controls. Customers often choose Zoom for the simplicity and intuitiveness of the Zoom web portal, enabling IT teams to quickly adopt automated workflows and integrate seamlessly with existing systems.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Zoom conducts accessibility testing for new features through an in-house team of dedicated accessibility professionals.
• API: Yes
• What users can and can't do using the API: The Zoom API is the primary means for developers to access a collection of resources from Zoom. Apps can read and write to the resources and mirror some of the most popular features available in Zoom Web Portal such as creating a new meeting, creating, adding and removing users, viewing reports and dashboards on various usage, and so on using the Zoom API. Depending on your app’s use case, you can choose from our various APIs and implement the features accordingly. All APIs under the Zoom API are based on REST architecture and are accessed via HTTPS at specified URLs. The base URL for all requests is https://api.zoom.us/v2/. The complete URL varies depending on the endpoint of the resource being accessed. For instance, you can list all users on an account via a GET request to this URL: https://api.zoom.us/v2/users/. Within our API reference pages, you can send test requests and view responses. You can also view the code for the request in various languages such as Python, Node, Java and more. With each release, we add additional APIs and enhancements to meet the needs of our customers.
• API documentation: Yes
• API documentation formats: Other
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Zoom offers a number of opportunities to customise the service. Zoom’s App Marketplace brings together integrations, apps, and bots built by Zoom, third-party developers, and oftentimes our own customers, making it easy for Zoom users to extend the power of Zoom for any business need. The Zoom App Marketplace hosts over 2,500 apps and integrations for our solutions. In addition, Zoom’s APIs allow for a robust extension of the core Zoom product and apps can read and write to the resources and mirror some of the most popular features available in the Zoom Web Portal such as creating, adding and removing users, viewing reports and dashboards on various usage, and so on. Experienced developers can choose to leverage Zoom’s SDKs to incorporate the Zoom experience into their own application. Lastly, role-based access control enables the creation of custom user roles that have a set of permissions that allows access only to the pages a user needs to view or edit.

Scaling

• Independence of resources: Zoom’s unique architecture allows us to quickly and easily scale to meet demand. We maintain excess capacity in all aspects of our infrastructure to accommodate growing business, healthcare, and education needs and to meet peak usage requirements. Our proven infrastructure supports billions of meeting minutes a month and our architecture is built to handle growing levels of activity, as our unified communications platform is architected from the ground up to address the most technologically difficult aspect of communications: video. Our modern cloud architecture gives our platform its trademark reliability, quality, and scalability.

Analytics

• Service usage metrics: Yes
• Metrics types: The Zoom Dashboard allows administrators on the account to view information ranging from overall usage to live data relating to Zoom solutions. This data can be used to analyse issues that may have occurred as well better understand how users are interacting with the Zoom platform within your organisation.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Zoom Phone

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Physical access control, complying with SSAE-18 / ISAE 3402
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Reports and recordings can be exported via the Zoom web portal as required.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • MP4
  • MP3
  • M4A
  • VTT
  • JSON
• Data import formats:
  • CSV
  • Other
• Other data import formats: SAML

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • Legacy SSL and TLS (under version 1.2)
  • Other
• Other protection between networks: Zoom’s infrastructure for real-time video, audio, and data runs on dedicated servers within SSAE 16 and SOC 2 compliant data centers. Zoom sessions are temporary, operating similarly to mobile conversations over public networks. Data in transit between Zoom clients and data centers is secured using Secure Real-time Transport Protocol for media and TLS 1.2 with 256-bit AES-GCM encryption. Data at rest within Zoom’s data centers is protected with 256-bit AES-GCM encryption, ensuring end-to-end security, confidentiality, and integrity across all communications and stored content.
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
  • Other
• Other protection within supplier network: Zoom follows OWASP standards to maintain robust internal security processes.

Availability and resilience

• Guaranteed availability: SLAs are addressed in Zoom's Master Services Agreement (MSA) and may include 99.9% uptime, excluding excused downtime (maintenance).
• Approach to resilience: Zoom web services leverage AWS high availability infrastructure with multi-region configuration operating in Active/Standby mode. For realtime communications, Zoom leverages multiple Tier 1 data centers running in Active/Active mode.
• Outage reporting: Zoom posts any general incident announcement and other announcements including scheduled maintenance, outages, updates, through our status page at status.zoom.us. For incidents affecting a specific customer, Zoom will notify the account owner and administrator(s) through email or as specified in fully executed agreement.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Management interfaces are accessed via user name and password derived from integration via SSO or user name and password stored in a salted hash. Interfaces are accessed based upon role based access control (RBAC).
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: Between 6 months and 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: Between 6 months and 12 months
• How long system logs are stored for: Between 6 months and 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Cyber Essentials, Cyber Essentials Plus, SOC2 Type 2, GDPR, TRUSTe Certified Privacy
• Information security policies and processes: Zoom's security policies are derived from ISO 27001 framework.
• Software Security Code of Practice: No

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Change triggers for unique processes and controls are: Code, Database, Infrastructure, Data.; Weekly meetings held to request changes that need to be performed during maintenance windows. Change requests are presented, validated, and scheduled. Changes are approved by the Change Manager. Implementation in production should not be by the same individual who developed the change. When staffing levels do not permit this separation, management oversight and approval of the change and testing process ensure appropriate processes are followed. Dev and test environments are physically and logically segregated from production. No customer data is used in testing.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Zoom has a formal Vulnerability Management Plan in place. Zoom performs monthly vulnerability and web application scanning using an external party (Qualys). Scan reports are reviewed by our Security and technical teams and discussed with the engineering and development teams. Validated findings are tracked in our JIRA system throughout remediation.; Zoom has a monthly patch cadence. Zoom will patch all applications, workstations, and servers (virtual or physical) with all current operating system, database, and application patches deployed in our computing environment according to a schedule predicated on the criticality of the patch. Maintenance/patching typically will have no service downtime.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: We have monthly vulnerability and web application scans. Findings are reviewed and validated by our technical and engineering team. Vulnerability rated on severity level and tracked using our JIRA system. Vulnerability fixes are release from our engineering team and follow our formal change management process for deployment to production. Zoom also has DDoS monitoring and Managed service in place. Affected traffic are diverted and filtered through a scrubbing centre.; Zoom responds to incidents as defined within our SOC2 report available on the Zoom Trust Center at https://www.zoom.com/en/trust
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Zoom communicates the incident response policy to internal and external users and instructs users to contact their supervisor and the information security representative if they become aware of a possible security breach. When a potential security incident is detected, a defined incident management process is initiated by authorised personnel. Incidents are tracked through the tracking application, which includes the corrective actions implemented in accordance with the defined policies and procedures.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Zoom provides a free Basic license that includes some of the features and functionalities of paid user licenses with a 40-minute meeting limitation, and basic, limited functionality. For further information please see the following link:; https://zoom.us/pricing
• Link to free trial: https://zoom.us/signup

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 1%
• Between £250,000 and £500,000: 2%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 15%
• Over £5,000,001: 20%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: BSI Assurance UK Limited
• ISO 9001 accreditation date: Tuesday 18 June 2024
• What the ISO 9001 doesn’t cover: All sites and all companies wihtin the Exchange Communications Group are covered
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 05098da5-a6ac-4900-ac4d-6306162a0ffa
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 3aaf213c-8639-49c4-becc-903367fa4919
• Other security certifications: Yes
• Any other security certifications: ICO registration - ZB081986

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Plans for engaging a diverse range of businesses in engagement activities prior to appointing subcontractors (including activities prior to award of the main contract and during the contract term)
    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)
    • Plans for positive actions with community groups.

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Introducing transparency to pay and reward processes
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bids@exchangecommunications.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.