ALLPAY LIMITED

Prepaid Cards

allpay provides a Mastercard-branded prepaid card for one-off disbursements of funds or for on-going reloadable payment schemes. Cards can be enabled for chip and pin payments, e-commerce transactions and regular payments e.g. direct debits and standing orders.

Features

• Cloud-based web Portals for Organisation and Cardholder
• Cards issued on Mastercard® Scheme
• Point of Sale, E-Commerce and ATM Functionality
• Sortcode and Account Number and access to BACS/FP
• Online and Telephone Banking Solution for the Cardholder
• Ability to set-up Direct Debits and Standing Orders
• Flexibility to block Merchant Category Codes (MCC)
• Self-service Reporting Suite
• Real-time loading of Cards, individually and in bulk

Benefits

• Real-time visibility of spend to enable monitoring
• Real-time Load and Redemptions
• Both Self-service and Exception Reporting
• 24/7 Automated Phone Line and Online Portal for balances
• In-house Call Centre for Customer queries
• Multiple activation/PIN retrieval solutions
• No Credit facility for the Cardholder
• Load/Recoup funds and block Cards instantly
• Secondary Cards for Carers/Guardians supporting Service Users
• Ability to absorb Transaction Fees or assign to Cardholder

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@allpay.net. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

755426843796457

Contact

Robert Cutler
+441432807543
tenders@allpay.net

About your service

• Service categories:

  Applications

  Enterprise resource management

  Financial

  • Financial and Accounting Applications
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: System outage for the online systems due to maintenance will not exceed 12 hours annually and will not exceed 8 hours for any single outage. Maintenance will only occur during scheduled off-peak hours: 23:00 – 05:00. Clients will be made aware of any planned work prior to commencement.
• System requirements:
  • The solution is compatible with IE9 and above
  • The solution is compatible with Chrome 24 and above
  • The solution is compatible with Safari 9, Firefox 18
  • The solution is compatible with Opera 15 and above
  • The solution is browser based with only internet access required

User support

• Email or online ticketing support: Yes
• Support response times: UK in-house Customer Service Contact Centre (CSCC) team is available between 08:00 and 18:00 Monday to Friday, 08:00-12:00 Saturday for both client and payer queries.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: -
• Onsite support: No
• Support levels: Outside the Customer Service Contact Centre hours 08:00-18:00 Monday to Friday and ; ; allpay ensures an engineer is on call 24/7 for incidents. This is alongside our ISO-9001 incident management procedure.; ; allpay provides a dedicated Account Manager for day to day queries including Performance Management, Contract queries and any Technical Issues encountered
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: Allpay will appoint a dedicated implementation contact to oversee the full implementation process – with weekly calls scheduled between them, the organisation's dedicated account manager and stakeholders at the Organisation.; ; allpay will liaise with the organisation to capture all of the organisation's scheme requirements e.g. Merchant Category Code blocking, spend limits etc.; ; allpay will provide onsite training for clients, upon a date agreed between both parties. We provide a mix of practical exercises to build familiarisation with the prepaid card service, platform and procedures. This includes instructional videos for both clients' staff and service users, user guides and handbooks for client users and quick-start reference sheets.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Allpay will work with clients to ensure a smooth exit once the contact ends. Any client data will be returned in the format requested either via SFTP or securely via allpay's management portals.
• End-of-contract process: Allpay's contract price covers the setting up of the service as agreed. If the contract has run its intended or extended term or for any other agreed reason we would return client data (as detailed in the previous question). We would offer (subject to the exact requirement) any assistance we can to allow a smooth exit and transfer to any new supplier.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Optimised for mobile.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Allpay’s web-based portal is compatible with IE9 and above, Chrome 24 and above, Safari 9, Firefox 18 and above, Opera 15 and above.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Allpay’s web-based portal is compatible with IE9 and above, Chrome 24 and above, Safari 9, Firefox 18 and above, Opera 15 and above.
• API: Yes
• What users can and can't do using the API: APIs are available to cover all of allpay’s prepaid service functionality. allpay can provide technical documentation to support the integration.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Allpay's Prepaid Service is web-based and can be branded with the organisation's logo to promote familiarity with users logging into their online banking service.; ; Cards can also be customised.

Scaling

• Independence of resources: Allpay uses a number of utilisation tools to monitor its networks and associated equipment to ensure that all of its clients receive service in accordance with the agreed Service Levels expected. An automated reporting and monitoring process is in place for all platforms, with alert messaging provided to key business stakeholders at certain capacity thresholds. As the service components and client applications can be run on multiple servers and separate services, the architecture is inherently scalable. As such, the solution can easily grow onto multiple servers across data centres making the system horizontally scalable.

Analytics

• Service usage metrics: Yes
• Metrics types: A standard suite of reports is available and can be scheduled for delivery to the organisation, covering user management, transaction breakdowns across different networks, transaction history and volume and value of payments processed at each network. allpay can also work with organisations to create bespoke reports with the option to have them scheduled.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Staff screening not performed
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Reports can be exported in CSV, Excel or PDF from within the Organisation Portal. Reports show real-time transaction data covering user management, successful and unsuccessful transactions, available balances and the status of individual cards.; ; Transfer of data between organisations and allpay uses 256-bit Advanced Encryption Standard (AES) over Transport Layer Security (TLS) 1.2, creating a secure link between the organisation’s internet browsers and allpay’s web servers, ensuring all data transmitted between the two remains secure.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • PDF
  • XLS
• Data import formats:
  • CSV
  • Other
• Other data import formats: XLS

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Allpay conforms to a 99% availability of the platform, which is available 24/7/365. allpay would liaise with the organisation over mutually agreed Key Performance Indicators to ensure measures were in place should performance fall below the agreed SLAs and KPIs.
• Approach to resilience: Allpay has a fully documented, audited and regularly tested Business Continuity and Disaster Recovery plans, in place for this service; the exact details are available on request.; ; To ensure continuity of service in the event of a disaster and/or service-affecting incident, allpay has a comprehensive Business Continuity Plan, which is regularly tested without prior notice. The Business Continuity Plan details arrangements in the event of service affecting incidents including, but not limited to damage to or unavailability of premises and/or equipment, IT failures, anti-virus management and protection, malware attacks, pandemics, staffing levels and natural disasters. allpay’s processor, Carta Worldwide (CWW), has a similar Business Continuity plan.; ; allpay’s plan, based on ISO22301, clearly identifies Business Continuity procedures during the response to, and recovery from, a disruptive event. Responses to minor incidents or events may utilise elements of this plan.; ; The plan applies to all personnel who operate and manage critical business units, departments and services. All stakeholders would be kept fully informed at all times during any system failure so that contingency plans can be considered before any degradation of service.
• Outage reporting: Organisations will be notified in advance of any scheduled maintenance. Scheduled maintenance is communicated out to the organisation's nominated super users, who are sent the scheduled maintenance period by email. Additionally, allpay has a public-facing service status page detailing the availability of all its services at all times.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to allpay's management portals is authenticated via username and password. User accounts are configured with varying level of access available. The nominated super user at the organisation can create user accounts with configurable permissions. Roles can also be created to approve user actions e.g. transactions above specified value thresholds. Data is segregated in the system by unique client codes, ensuring each client only has access to their and their customers' data. Passwords must be a minimum of eight characters, alpha-numeric.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Allpay has a fully documented and audited Security Information Policy and ISO 27001 accreditation. allpay's Head of Compliance has overall responsibility for ensuring that the policy is followed - he reports to allpay's board of directors on any related matters. A copy of the policy can be provided on request.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Allpay uses a Software Development Life Cycle (SDLC) for Software Development – a series of steps that provides a model for the development and lifecycle management of an application/software. Further to this, allpay has technical implementation plans and a change control board to verify changes prior to release into production. allpay uses an Agile development methodology and conforms to OWASP (Open Web Application Security Project). Developers also have training in secure coding techniques. allpay internally code reviews all major applications and revisions against such criteria as the OWASP top 10. Practices also comply with ISO 27001 and Cyber Essentials Plus.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Allpay performs monthly internal and external vulnerability scans as required by PCI. Internal auditors review systems as required and in conjunction with the allpay audit plan devised to maintain compliance with ISO 27001 & PCI standards. IT Operations have implemented various tools to monitor the health of the network, e.g. Ops Manager, Apps Manager, Tripwire, SIEM, IPS/IDS, Sophos Suite etc. Checks are made for patches and updates daily, once alerted to a new patch, IT Support will download and review the new patch within four hours of its knowledge of release.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Vulnerability scans are run against the network infrastructure for devices on a scheduled periodic basis and reports are generated on the vulnerabilities identified across the assets in each network zone. In response to any identified compromise, allpay has a fully documented and audited Information Security Response Plan that covers all reports of information security weaknesses or events relating to any of the organisation’s information assets. This is available on request. allpay has in place SLAs for incident response management, detailing fix times, response times and interval updates for critical and high impact incidents. These are available on request.
• Incident management type: Supplier-defined controls
• Incident management approach: Allpay has pre-defined processes in place for incident management. This is inline with ISO 27001. allpay’s Information Security Policy Handbook provides a framework for the management of information security to minimise risk (this is available on request). The high-level procedure for responding to any security incident is as follows: • Advise Head of Compliance • Commence investigations • Submit Security Incident form • Identify and implement resolution • Produce report • Update documentation • Advise management. Incident reports are available to clients through allpay's Customer Service Contact Centre.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 1%
• Between £500,001 and £1,000,000: 2%
• Between £1,000,001 and £2,500,000: 3%
• Between £2,500,001 and £5,000,000: 4%
• Over £5,000,001: 5%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: SOCOTEC Certification UK Ltd
• ISO/IEC 27001 accreditation date: Sunday 9 June 2024
• What the ISO/IEC 27001 doesn’t cover: -
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: SOCOTEC Certification UK Ltd
• ISO 9001 accreditation date: Friday 1 August 2025
• What the ISO 9001 doesn’t cover: -
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: PCI Security Standards Council
• PCI DSS accreditation date: Tuesday 26 August 2025
• What the PCI DSS doesn’t cover: -
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: C9a78e26-57ae-4efa-bfc3-8c9429e688a0
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 09fabd03-958a-443d-9b93-728a9565e5f6
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors
    • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Offering a range of quality opportunities with routes of progression if appropriate, e.g. T Level industry placements, students supported into higher level apprenticeships.
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Other measures to provide equality of opportunity for disabled people and those with health conditions into employment, including becoming a Disability Confident employer and inclusion of supported businesses in the contract supply chain

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@allpay.net. Tell them what format you need. It will help if you say what assistive technology you use.