M3 HOUSING LIMITED

M3Central

M3Central is a cloud-based repairs diagnostics and reporting service for social housing providers. Tenants report repairs online through a simple interface. Staff diagnose issues, allocate Schedule of Rates codes, and specify works. The web-based system is device-agnostic and supports on-site diagnosis.

Features

• Dual staff and tenant-facing interfaces
• Fully web-based, device-agnostic access
• Guided repair reporting with photo uploads
• Staff diagnostics with Schedule of Rates allocation
• Configurable user profiles and permissions
• Customisable content and workflows
• Centrally hosted and managed
• Optimised for on-site use across mobile devices
• Reporting with multiple export formats
• Multi-language interface support

Benefits

• Improves accuracy of repair diagnosis
• Enables tenants to report repairs quickly
• Reduces incorrect repair orders
• Supports on-site diagnosis and decision-making
• Improves first-time fix rates
• Simplifies repair reporting for tenants
• Reduces staff training requirements
• Speeds up repairs processing
• Tailors workflows to organisational needs
• Removes software maintenance burden

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@m3h.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

774674705655959

Contact

Ben Virgo
020 8274 4000
sales@m3h.co.uk

About your service

• Service categories:

  Applications

  Enterprise resource management

  • Asset life-cycle management
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: M3Central has no unusual constraints that buyers need to be aware of. It is a fully web-based, hosted SaaS solution and does not require specific hardware or local installation. Planned maintenance is managed centrally by the supplier and communicated to customers in advance to minimise disruption. Users require a modern, supported web browser and a stable internet connection to access the service. Support is provided remotely in line with agreed support arrangements and service levels.
• System requirements:
  • Modern web browser with WebAssembly support
  • Runs on any OS capable of running a current browser
  • No client installation or special hardware required
  • Requires HTTPS network access to the application and APIs

User support

• Email or online ticketing support: Yes
• Support response times: M3Central operates a standard support service level agreement of 48 hours for responding to questions, with most queries typically answered within 24 hours. Support is provided during standard business hours on weekdays only. There is no routine support service available at weekends or on public holidays.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: M3Central has not yet undertaken formal web chat testing with assistive technology users. However, accessibility is considered during design and development, and the service is delivered through standard web technologies compatible with common assistive tools. Accessibility improvements are reviewed as part of ongoing product development and in response to customer feedback.
• Onsite support: Yes
• Support levels: M3Central provides primarily remote support during standard business hours, in line with agreed service levels. On-site support is also available where required and is delivered by experienced industry consultants. On-site services can include user and administrator training, implementation consultancy, and general product support. The cost of on-site support varies depending on scope, duration, and delivery method, and may be reduced where services are delivered remotely or included as part of the initial purchase. A dedicated technical account manager or cloud support engineer can be provided by agreement.
• Support available to third parties: Yes
• AI chatbot: No

Onboarding and offboarding

• Getting started: Following purchase, users are supported throughout implementation to ensure M3Central is configured to meet organisational requirements. Support includes assistance with initial setup and configuration. Users can access either on-site or remote training, depending on their needs. Comprehensive user documentation is also provided, covering both day-to-day use of the service and administrative configuration.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: When a contract ends, users retain access to the M3Central control panel until the licence expiry date, allowing them to extract their repair report data. Data can be exported in standard formats. Where required, additional data extracts can be provided on request to support transition to another system. Access is removed after the licence period ends, in line with agreed data retention and security policies.
• End-of-contract process: At the end of the contract, access to M3Central continues until the agreed licence expiry date. During this period, users can export their data and complete any transition activities. After expiry, system access is removed in line with contractual terms and data retention policies. Data can be securely deleted or retained in accordance with agreed requirements.; ; The contract price includes use of the hosted M3Central service, routine maintenance, software updates, and standard remote support. Additional costs may apply for optional services such as on-site support, bespoke consultancy, or extended training, where these are requested separately.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The mobile and desktop versions of M3Central provide the same core functionality, with differences limited to layout and presentation. The interface automatically adapts to the screen size being used. On smaller mobile screens, certain visual elements are reorganised for usability; for example, repair areas that may appear overlaid on images on desktop are instead presented as a condensed list alongside the image. This ensures the service remains usable and clear across all devices without reducing functionality.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: The M3Central interface is primarily graphical, allowing users to navigate through visual repair images to identify issues and drill down to the appropriate M3NHF Schedule of Rates code. In addition to image-based navigation, users can search for repairs using text-based search, providing flexibility for different working preferences. The interface is designed to be intuitive and efficient, supporting both guided diagnosis and direct lookup of repair items.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: We use tools such as WebAIM to test the service ourselves. We have worked with clients to improve areas highlighted by their testing and/or users.
• API: Yes
• What users can and can't do using the API: The M3Central API currently supports secure retrieval of tenant-submitted photos and videos associated with repair reports. The API does not support initial service setup, configuration changes, workflow management, or creation or modification of repair records. All setup and configuration activities are completed through the standard web interface. API functionality is intentionally limited at this stage and may be expanded in future releases.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Users can customise M3Central through an administrative control panel. Configurable elements include interface structure, repair pathways, images, guidance content, advice text, and organisation-specific rules and workflows. Customisation is performed through configuration settings rather than code changes, allowing updates to be made quickly and safely.; ; Customisation is carried out by authorised administrative users. Access to the control panel can be controlled, ensuring only approved users can make changes.

Scaling

• Independence of resources: M3Central is hosted on a centrally managed cloud infrastructure designed to support multiple customers concurrently. The service is provisioned with sufficient capacity to handle peak demand across all users without degradation of performance. Resources are monitored and managed to ensure one customer’s usage does not negatively impact others, maintaining consistent service availability and responsiveness.

Analytics

• Service usage metrics: Yes
• Metrics types: M3Central provides service metrics through detailed reporting and data exports. Users can view and export data for individual repair requests, including associated details and outcomes. The system also provides summary metrics, such as the most frequently reported repairs by repair type, enabling organisations to analyse trends, monitor demand, and support service planning.
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest: Physical access control, complying with another standard
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Users can export data from M3Central in several ways. Data can be delivered automatically as reports are generated, including via email, XML over HTTPS, or JSON through the browser. Users can also manually download data and reports directly from the control panel. In addition, scheduled reports can be configured to be emailed to users on a weekly or monthly basis.
• Data export formats: Other
• Other data export formats:
  • Excel (XLS)
  • API (JSON)
  • API (XML)
• Data import formats: Other
• Other data import formats:
  • Excel (XLSX)
  • Excel (XLS)

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: M3Central is provided on a best-endeavours availability basis, supported by resilient, centrally managed cloud infrastructure. Planned maintenance is scheduled in advance and communicated to customers to minimise disruption. While no specific uptime percentage is guaranteed, service availability is actively monitored and managed. Where availability issues occur, they are handled in line with the agreed support arrangements. Any service credits or refunds relating to availability are applied in accordance with the contractual terms agreed with the customer, rather than automatic financial penalties.
• Approach to resilience: M3Central is designed to be resilient and is hosted on secure cloud infrastructure provided by an accredited hosting partner using Microsoft Azure. The hosting environment supports high availability, subject to planned maintenance, and includes geo-redundant backups to protect against regional outages. This ensures continuity of service even if a single datacentre or cloud region is unavailable.; ; Resilience is further supported by robust backup and recovery arrangements. Data is protected through regular backups and replication, enabling systems and data to be restored quickly in the event of a failure. Physical and logical security controls are in place to protect infrastructure, including restricted access, monitored environments, and encrypted storage.; ; Business continuity is supported by documented recovery procedures and tested processes. Detailed information on datacentre architecture, backup schedules, and disaster recovery arrangements is available to buyers on request.
• Outage reporting: M3Central reports service outages and service-impacting issues through email alerts. Customers are notified when an outage occurs and are kept informed of progress and resolution updates.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Admin access is behind MFA 2 factor authentication.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: INFORMATION SECURITY POLICY; - To protect the information assets that handles, stores, exchanges, processes and has access to, and to ensure the ongoing maintenance of their confidentiality, integrity/availability.; - To ensure controls are implemented that provide protection for information assets and are proportionate to their value and the threats to which they are exposed.; - To ensure the organisation complies with all relevant legal, customer and other third-party requirements relating to information security.; - To continually improve the organisation’s Information Security Management System and its ability to withstand threats.; ; Responsibilities; - It is the responsibility of the MD to ensure that this policy is implemented and that any resources required are made available.; - It is the responsibility of the Strategic Partnerships & Operations Director to monitor the effectiveness of this policy and report the results at management reviews.; - It is the responsibility of the Technical Director to create and maintain an Asset and Risk Assessment Register and to ensure all assets that need to be covered by this policy are identified.; - responsibility of all employees and subcontractors and employees and subcontractors of information security critical suppliers, to adhere to this policy and report to the Technical Director
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: M3Central uses a controlled configuration and change management approach to manage updates throughout the service lifecycle. Core service components, configurations, and releases are version controlled and tracked from development through testing, deployment, and live operation. Configuration changes are managed through defined administrative controls, ensuring changes are logged and traceable.; ; All changes are assessed before release to identify potential impacts on security, performance, and availability. Changes are deployed in a managed manner, with maintenance communicated in advance where relevant, and rollback procedures available if required.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: M3Central operates a structured vulnerability management process. Software defects and potential vulnerabilities are logged in a central tracking system and assessed based on security impact, business risk, and operational reliability. Issues are prioritised accordingly. Critical security patches are deployed as soon as practicable, while non-critical updates are included within scheduled release cycles. Information on potential threats is obtained from security monitoring tools, supplier notifications, and industry security advisory services. Infrastructure updates are applied in line with an established patch management policy.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: M3Central uses protective monitoring provided by its cloud platform and hosting partners, including log analysis and automated activity alerts, to identify potential compromises such as unusual access patterns or system behaviour. When an alert is triggered, it is investigated in line with the incident management procedure, with appropriate actions taken to contain and remediate any issue. Incidents are acknowledged within one business day and a substantive response is provided within two business days, in accordance with the agreed support service levels.
• Incident management type: Supplier-defined controls
• Incident management approach: M3Central operates a defined incident management process with pre-defined procedures for common events, including security incidents and service disruptions. Users report incidents through established support channels, where they are logged, assessed, and prioritised. Incidents are investigated and managed in line with documented procedures to minimise impact and prevent recurrence. Users are kept informed as appropriate, and incident reports can be provided outlining the issue, impact, and actions taken. Response times align with agreed support service levels.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: M3Central offers free trial access on request, typically for up to one month with full functionality for evaluation. In addition, demo versions are available on the website, allowing users to explore key features before requesting a trial or purchasing a licence.
• Link to free trial: https://www.m3h.co.uk/try/m3central

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 5%
• Between £250,000 and £500,000: 7.5%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 12.5%
• Between £2,500,001 and £5,000,000: 15%
• Over £5,000,001: 20%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: UKAS Management Systems
• ISO/IEC 27001 accreditation date: Thursday 6 November 2025
• What the ISO/IEC 27001 doesn’t cover: .
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: UKAS Management Systems
• ISO 9001 accreditation date: Thursday 6 November 2025
• What the ISO 9001 doesn’t cover: .
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
    • Understanding of issues relating to entering the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@m3h.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.