ALPHATEC SOFTWARE LIMITED

Timebox - Cloud Hosted, Time Recording and Expenses Management

Alphatec Software's Timebox is an award winning time recording and expenses SaaS solution, that will help you manage time spent and expense costs in dealing with directorates, clients, shared services, departments, cases, projects and activities. This helps with staff productivity, staff well-being and resource efficiency.

Features

• Analyse time spent on individual clients, cases and services
• Analyse time spent with shared services, departments or business sectors
• Understand the true cost of dealing with claims/cases
• Ensure you are maximising efficiencies from staff
• Understand true cost and profit of the services provided
• Input, Calculate and Monitor Expenses
• Record time and expenses remotely, using smartphone or tablet devices
• Record training, sickness and holidays
• Provide accurate detail of work completed
• Real-time reporting

Benefits

• Supports agile/home working and hot desking
• Improve process, productivity and performance and work on any device
• Real-time visibility and reporting on all time and expense costs
• Monitor departmental and project level budgeting and variance
• Resource planning and individual cost control
• Detailed explanation of work carried out to client and department
• Timebox is configurable to your organisations structure and terminology
• Timebox is continually enhanced to meet your needs
• Understand the true profit/contribution of your Department
• Leading edge reporting capabilities

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@alphatec.net. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

780784210313724

Contact

Simon Davies
01327 342 299
sales@alphatec.net

About your service

• Service categories:

  Applications

  Production and operations

  • Other operations
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: No
• System requirements:
  • Users must have access to a web browser
  • Users should have access to a PDF viewer
  • Users should have access to a Excel viewer

User support

• Email or online ticketing support: Yes
• Support response times: Acknowledgement will be within the hour and resolution is typically within one hour of acknowledgment. Standard support is only available during UK office hours Monday to Friday
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: We provide a single level of support for all users. Support is included in the subscription cost. Each account is allocated a primary account manager and primary support contact. SLA 1-Critical Problems causing hosted downtime Initial response within 15 minutes of notification of error for 95% of errors, initial response within 30 minutes for remainder of errors Fix strategy communicated within 4 working hours of notification of error Solution or work-around within 0.5 working days for 90% of errors SLA 2-Problems causing hosted downtime or severe service degradation Initial response within 15 minutes of notification of error for 95% of errors, initial response within 30 minutes for remainder of errors Fix strategy communicated within 4 working hours of notification of error Solution or work-around within 1 working day for 90% of errors SLA 3-Non-Critical Problems Initial response within 4 working hours of notification of error for 95% of errors Fix strategy communicated within 1 working day of notification of error Solution or work-around within 2 working days for 90% of errors SLA 4-Minor Problems Initial response within 1 working day of notification of error for 95% of errors Solution or work-around within 4 working days for 90% of errors
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Alphatec use our expertise in dealing with hundreds of organisations to help guide new accounts through the process of configuring and setting up their account in order to gain maximum benefit.; ; As part of the implementation process. we provide onsite training or online training depending on the organisations preference.; ; There is also user documentation available as well.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: The standard Timebox reports allow users to extract their information if they wish. If the users want the information in a specific format to ease with migration to a new platform, we are happy to provide the consultancy to facilitate this.
• End-of-contract process: At the end of the contract the user is required to give notice of wishing to end the contract. At that point in time we will start discussions with them to agree a date when they want us to supply their information to allow them to have a seamless transition. We will then discuss the informational needs and will supply them with their information on the day they want it delivered and once they confirmed receipt of the information, we will revoke their access to the account. If they would like us to, we will hold their data on the system for up to 30 days, so as to allow them to ensure they have everything they need for moving forward and we will then confirm with them that we are going to delete their information from Timebox permanently. The information will then be deleted. At all stages we will work with the client to help ensure the move is as simple and easy for them as possible
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The mobile and desktop services are identical and the system user interface is fully responsive so that the screen rendering takes account of the size and form factor of the mobile device being used.; ; Mobile: Timebox runs on:; iPhone; Android Smart Phones – E.G. Samsung; Windows Phones; Windows Tablets; iPad; Android Tablets; Running modern supported versions of the appropriate Windows, Android and iOS Operating systems.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: The Service interface provides a simple, easy to use interface and user dashboard to allow you to track staff time, costs, expenses and income in relation to all services, projects and activities carried out - whether in relation to a client, case or claim.; ; As well as this, individual users can use their dashboard, to track time spent on clients, services and activities over a given period.; ; The system provides a fully responsive web interface to the service, a management and user dashboard service interface and a mobile specific service interface for the entering of time and expenses.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: The system was developed with the Kendo UI control suite which supports WCAG 2.2AA and AAA
• API: Yes
• What users can and can't do using the API: The current API is limited to the inclusion of clients and income
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • PDF
  • Other
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Admin users can add their own activities in the system set-up area of Timebox. They can also add their own services, clients, departments, users and expense types.; Alongside these facilities, they can also set up "tags", to associate clients or departments together to monitor time, expense and income costs.; There is also a specific project area, to allow users to track budgeted project costs against actual costs based on time costs.; ; The words client and department have been used in the description above but Timebox even allows you to define the naming of the organisational structure - e.g. this could just as easily be directorate and section or service and department if Timebox is implemented in a small part of the organisation.

Scaling

• Independence of resources: Resource utilisation is monitored and flexed to ensure the system operates quickly and smoothly for all users.

Analytics

• Service usage metrics: Yes
• Metrics types: Users can themselves report on the various metrics including time spent with clients, on cases, on projects and on an individual user by user basis as well.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Other
• Other data at rest protection approach: In addition to the above, the databases are all encrypted with TDE and even within the databases, secure data such as password credentials are further encrypted.
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Users can export their data in a number of ways including Excel, PDF and CSV (simplified excel)
• Data export formats:
  • CSV
  • Other
• Other data export formats: PDF
• Data import formats:
  • CSV
  • Other
• Other data import formats: Excel: import only available as part of new account setup

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • Other
• Other protection between networks: We also implement a number of additional security measures to ensure security of both the system, the communication and the users data. e.g. we implement secret key authentication on all pages to protect users from cross site scripting. All data is encrypted over HTTPS.
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The applications are monitored 24 hours a day, 365 days a year, with 24 hour support at network, developer and DBA level.; ; We guarantee 99.9% up time. We do not provide refunds.
• Approach to resilience: This information is available on request
• Outage reporting: Through our web site, e-mail alerts and X.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Public key authentication (including by TLS client certificate)
  • Username or password
  • Other
• Other user authentication: Username, Password and a unique Account ID known only to the users of the account
• Access restrictions in management interfaces and support channels: Access to management modules is secured and access to the individual modules, can be defined by a system admin user on a user by user basis.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Our Information Security policies and processes are all ISO 27001 certified. As well as the above, all releases are subject to security assessments based on the following criteria:; a) New or Major Application Release – will be subject to a full assessment prior to approval of the change control documentation and/or release into the live environment.; b) Third Party components – will be subject to full assessment after which it will be bound to policy requirements.; c) Point Releases – will be subject to an appropriate assessment level based on the risk of the changes in the application functionality and/or architecture.; d) Patch Releases – will be subject to an appropriate assessment level based on the risk of the changes to the application functionality and/or architecture.; e) Emergency Releases – An emergency release will be allowed to forgo security assessments and carry the assumed risk until such time that a proper assessment can be carried out. Emergency releases will be designated as such by a Director or appropriate manager who has been delegated this authority.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: All change management is managed through our change management system Jira and Confluence.; ; All source changes are managed through source control.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We have external and internal vulnerability scans. These are run twice a week and any critical or high issues found are resolved as they arise, medium are planned for deployment or patching along with the frequent upgrade deployment. The system also runs immediate zero day threat analysis and reporting for any new or emerging threats. Service packs and patches are applied once their impact on applications and users has been assessed and tested. The information for the issues, service packs and patches comes from the internal and external vulnerability scans that run twice a week.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We have threat detection and DDoS protection within the datacentre and also have the application configured to provide logging and automatic notification of both errors and unauthorised behaviours.; We also implement both IDS & DLP.
• Incident management type: Supplier-defined controls
• Incident management approach: Users can report incidents by e-mail or by telephone to our support team. We have documented processes in place for common events (e.g. user access etc).; All support incidents are logged in Jira our incident management system and tracked through the SCRUM broads.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 3%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: CDL Group
• ISO/IEC 27001 accreditation date: Tuesday 25 March 2025
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 4fc39cdc-1a79-4e99-b6f1-a5ead96c65f9
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Plans for engaging a diverse range of businesses in engagement activities prior to appointing subcontractors (including activities prior to award of the main contract and during the contract term)
    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
    • Collaborating with anchor institutions and community groups to make facilities available for education, training or community events

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
    • Understanding of issues relating to entering the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@alphatec.net. Tell them what format you need. It will help if you say what assistive technology you use.