XBP EUROPE LIMITED

Intelligent Document Processing (IDP)

XBP Europe’s Intelligent Document Processing (IDP) is an AI-powered solution that automates the intake, classification, and extraction of data from complex structured and unstructured documents. Leveraging Agentic AI and Human-in-the-Loop validation, it converts paper or digital files into accurate, searchable, and actionable business intelligence.

Features

• Ingests documents from scanners, emails, and cloud storage.
• Automatically sorts documents by type using context-aware AI
• Captures structured and unstructured data using machine learning.
• Expert review ensures 99% accuracy for complex cases.
• Live dashboards track processing status and performance metrics.
• Employs advanced encryption to protect data against future threats.
• Autonomous agents manage multi-step workflows and decision-making.
• Seamlessly connects with ERP, CRM, and EHR platforms.
• Processes documents in over 120 different languages.
• Supports remote access via encrypted, cloud-native architecture.

Benefits

• Eliminate manual data entry to focus on high-value work
• Process documents in real-time to speed up business outcomes.
• Achieve 99% accuracy through AI and human-in-the-loop review.
• Handle high document volumes without increasing administrative headcount.
• Cut expenses by minimizing manual labor and error rework.
• Maintain automated audit trails to simplify governance and audits.
• Convert unstructured documents into actionable business intelligence data.
• Connect clean data directly into ERP and CRM platforms.
• Digitally transform paper-based operations for a hybrid workplace.
• Deliver faster responses to customers through streamlined document handling.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at daren.williams@xbpeurope.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

796823514274649

Contact

Daren Williams
07960191798
daren.williams@xbpeurope.com

About your service

• Service categories:

  Application Development and Deployment

  Data management

  Data integration and intelligence

  • Data Ingestion and Transformation Software
  • Metadata Management Software
  • Data Archiving and Information LifD-Cycle Management
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: XBP Europe’s IDP integrates seamlessly with your ecosystem via n’ventr, a low-code layer. It extends:; ; ERP Platforms: Salesforce, Microsoft Dynamics, Oracle, and SAP.; ; Finance/Accounting: QuickBooks, SAGE, and Freshworks.; ; Healthcare Systems: NextGen, MediTech, and various EHR/EMR platforms.; ; Storage: Amazon S3 and Google Cloud Storage.
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
• Service constraints: XBP Europe’s Intelligent Document Processing (IDP) is designed for high availability, though buyers should note the following operational constraints:; ; Planned Maintenance: To ensure platform security and performance, scheduled maintenance typically occurs during low-utilization windows (e.g., weekends or overnight). Users are notified in advance via the service dashboard.; ; Hardware Requirements: While IDP is cloud-native and accessible via standard web browsers, high-performance physical document scanning requires compatibility with XBP-approved high-speed scanners to achieve the 240 ppm (pages per minute) throughput.; ; Implementation Complexity: Deployment timelines vary based on organizational infrastructure and the complexity of unstructured data types.
• System requirements:
  • Latest versions of Chrome, Edge, Safari, or Firefox
  • Minimum 10 Mbps for stable cloud-based document uploads
  • Network security: TLS 1.2 or higher for secure data transmission.
  • Authorized access tokens for n'ventr low-code integration layer
  • TWAIN-compliant drivers for physical document scanner integration.
  • Multi-factor authentication enabled for all secure portal access.
  • Compatible with standard VMware or Hyper-V environments.
  • Adequate local caching for offline document scanning operations.
  • Enterprise-grade anti-virus and endpoint protection on local machines.
  • Windows 10/11 or modern Linux for scanning workstations.

User support

• Email or online ticketing support: Yes
• Support response times: XBP Europe provides tiered response times based on incident severity, ensuring 24/7/365 coverage for business-critical issues.; ; Priority 1 (Critical): Immediate response and continuous 24/7 effort until resolution, including weekends and public holidays.; ; Priority 2 (High): Targeted response within 4 business hours.; ; Standard Queries: Responses follow standard business hours (09:00–17:30, Monday–Friday).; ; While business-as-usual support is Monday–Friday, our Global SOC and Incident Management teams operate around the clock to address outages or security anomalies regardless of the day.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: XBP Europe conducts rigorous accessibility testing to ensure our web chat support is inclusive and compliant with WCAG 2.2 Level AA standards.; ; Testing Methodology; Our testing process combines automated audits with functional testing performed by native users of assistive technologies. We focus on the four POUR principles (Perceivable, Operable, Understandable, Robust) to ensure the chat interface is usable for all.; ; Assistive Technology Coverage; We specifically test the web chat interface with:; ; Screen Readers: Verification using NVDA and JAWS to ensure all interactive elements, like message input and "send" buttons, have descriptive ARIA labels.; ; Keyboard-Only Navigation: Manual checks to confirm all chat functions are reachable via the Tab key, ensuring visible focus indicators and a logical navigation order.; ; Speech Recognition: Testing with software like Dragon NaturallySpeaking to ensure voice commands can trigger chat actions.; ; Visual Adjustments: Verifying that the chat remains functional when using high-contrast themes or screen magnification up to 400%.
• Onsite support: Yes, at extra cost
• Support levels: XBP Europe provides tiered support for Intelligent Document Processing (IDP), ensuring high availability and technical expertise across all stages of implementation and operation.; ; Support Levels & Roles; Standard Support: Includes 24/7/365 proactive monitoring and automated ticketing via TIMO for all users.; ; Dedicated Expertise: We provide a Technical Account Manager (TAM) or Cloud Support Engineer for complex deployments. These specialists act as a single point of contact for technical strategy, integration assistance, and performance optimization.; ; Priority Response: Support is tiered by severity:; ; Priority 1 (Critical): Immediate response with 24/7 technical effort.; ; Priority 2 (High): Targeted response within 4 business hours.; ; Pricing; The cost of support is typically integrated into the subscription model, though enhanced levels like a dedicated TAM may incur an additional fee based on the scale and complexity of the contract.
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: XBP Europe provides a structured onboarding and "getting started" program to ensure seamless adoption of the Intelligent Document Processing (IDP) service.; ; Onboarding & Training Support; Guided Implementation: We offer dedicated consultancy and deployment services to assist with the initial setup, from defining extraction schemas to configuring the n'ventr integration layer.; ; Online Training: Users have access to the Lynx Learning Management System (LMS), which provides interactive, web-based training modules that can be accessed anytime. This includes gamified learning paths to upskill staff on the Web Workplace and validation tools.; ; Onsite Training: For complex, high-volume deployments or specialized facility management, we can provide onsite training and knowledge transfer sessions for your operational teams.; ; User Documentation: Comprehensive digital documentation, including user manuals, API guides (Swagger), and best-practice workflows, is available via the ServiceFirst portal.; ; Change Management: We provide strategic advice on change management to ensure organizational readiness and smooth digital transformation.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: XBP Europe ensures a secure and structured data extraction and offboarding process to maintain business continuity and compliance.; ; Extraction Process; Structured Data Export: Users can extract all processed metadata and transaction logs via the Open APIs or the Web Workplace export tools in common formats such as JSON, XML, or CSV.; ; Document Retrieval: Original and processed document images (e.g., PDFs, TIFFs) are returned through secure file transfer protocols (SFTP) or encrypted physical media, depending on the volume.; ; Data Portability: Our adherence to open standards and use of non-proprietary data formats ensures that information remains portable and can be easily ingested into a successor system or internal archive.; ; Security and Deletion; Secure Disposal: Once the buyer confirms the successful receipt and verification of their data, XBP initiates a secure data deletion protocol. All buyer-specific data is purged from our production and backup systems in accordance with ISO 27001 and GDPR "right to be forgotten" standards.; ; Audit Trail: A final certificate of destruction/extraction is provided for compliance auditing.
• End-of-contract process: At the end of a contract, XBP Europe facilitates a structured and secure exit and transition process to ensure data integrity and business continuity.; ; End-of-Contract Process; Data Return: All buyer-owned data, including original document images (PDF, TIFF) and extracted metadata (JSON, XML, CSV), is returned via secure protocols like SFTP or encrypted physical media.; ; Transition Support: We provide a dedicated Transition Manager to coordinate the handover of operational knowledge, system configurations, and data schemas to your internal teams or a successor supplier.; ; Secure Disposal: Following verified data receipt, XBP executes a certified data erasure protocol, purging all buyer-specific information from production and backup systems in accordance with ISO 27001 standards.; ; Pricing & Costs; Included in Price: Standard data extraction (up to a defined volume).; ; Access to the ServiceFirst portal for final administrative tasks.; ; Baseline decommission activities.; ; Additional Costs: ; Enhanced Transition Support: Extended consultancy or onsite support beyond standard offboarding hours.; ; Custom Data Transformation: Reformatting data into bespoke proprietary formats required by a new vendor.; ; Extended Retention: Storing data beyond the contract end date for litigation or compliance purposes.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: While the core AI engine remains identical, the Desktop version is optimized for high-volume administrative tasks, featuring multi-window layouts for complex "Human-in-the-Loop" data validation and detailed configuration settings.; ; The Mobile service focuses on accessibility and agility. It prioritizes omnichannel capture, allowing users to snap and upload document photos directly via smartphone cameras with auto-optimization. The mobile UI is streamlined, highlighting real-time status dashboards and quick-action approvals rather than deep-level system administration. Both versions utilize the same cloud-native backend, ensuring data consistency and security across all devices through a unified web-based architecture.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: The IDP interface features a browser-based Web Workplace designed for seamless document management. It provides a centralized dashboard for real-time tracking of ingestion, classification, and extraction metrics. A specialized Human-in-the-Loop (HITL) portal allows users to validate and correct AI-extracted data through side-by-side document views. For technical users, the N’ventr low-code layer offers a drag-and-drop interface to configure workflows and business rules without complex coding. Additionally, the ServiceFirst portal acts as the primary support interface for incident tracking, ensuring full operational visibility and control across the entire document lifecycle.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: XBP Europe conducts comprehensive interface testing to ensure the Intelligent Document Processing (IDP) platform meets WCAG 2.2 Level AA standards, facilitating an inclusive environment for all users.; ; Testing Methodology; Our testing lifecycle combines automated audits with moderated user testing involving individuals who rely on assistive technologies. This dual approach ensures that the "Human-in-the-Loop" validation screens and dashboards are not just compliant, but genuinely usable.; ; Assistive Technology Coverage; Screen Readers: We perform functional testing using NVDA, JAWS, and VoiceOver. This ensures that complex document layouts and data extraction fields are correctly announced with appropriate ARIA labels and roles.; ; Keyboard Navigation: Manual walkthroughs verify that all interface elements, including drag-and-drop features and validation buttons, are fully operable via keyboard, maintaining a logical focus order.; ; Magnification & Contrast: Interfaces are tested at up to 400% zoom and with high-contrast stylesheets to support users with low vision.; ; Speech-to-Text: We validate compatibility with tools like Dragon NaturallySpeaking to ensure hands-free data entry and navigation within the Web Workplace.
• API: Yes
• What users can and can't do using the API: XBP Europe’s IDP platform utilizes an API-first architecture primarily managed through the n’ventr low-code orchestration layer, allowing for deep integration into enterprise ecosystems.; ; Capabilities and Setup; Service Setup: Users can programmatically initiate the service by configuring ingestion endpoints (e.g., connecting an Amazon S3 bucket or an email server) and defining extraction schemas via RESTful calls.; ; Operational Actions: You can automate the submission of documents (structured or unstructured), trigger real-time classification, and retrieve validated data in formats like JSON or XML for downstream systems like Salesforce or SAP.; ; Making Changes: Users can update business rules, modify data routing paths, and adjust confidence score thresholds for Human-in-the-Loop escalation through API updates.; ; Limitations; Configuration Scope: While data flow is highly flexible, core AI model retraining and fundamental architectural changes typically require the management console or technical support rather than direct API calls.; ; Rate Limiting: To maintain high availability, API calls are subject to standard rate limits based on your subscription tier to prevent service degradation during bulk processing.; ; Security Constraints: Changes to security protocols, such as modifying Multi-Factor Authentication (MFA) or encryption keys, often require administrative overrides via the secure GUI for audit and compliance reasons.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: XBP Europe’s Intelligent Document Processing (IDP) is a highly configurable and modular platform designed to be tailored to the specific document types, business rules, and integration needs of each buyer.; ; What can be customised; Workflows & Logic: Using the n’ventr low-code orchestration layer, buyers can design custom document routing paths, automated approval loops, and complex business rules.; ; Extraction Schemas: Users define specific metadata fields (e.g., invoice numbers, legal clauses, or patient IDs) for the AI to capture.; ; User Interface: The Web Workplace dashboard is customisable, allowing for personalized layouts, custom icons, and task groupings.; ; AI Training: The system establishes a baseline and uses machine learning to tune itself over time based on the buyer's unique datasets.; ; How and who can customise; How: Customisations are made through drag-and-drop interfaces, NLP-based configuration tools, and the n’ventr low-code platform, minimizing the need for complex IT projects.; ; Who: Authorised administrative users from the buyer’s team can manage daily workflow adjustments. For deep architectural changes or initial setup, XBP Europe’s technical specialists provide guided configuration as part of the onboarding service.

Scaling

• Independence of resources: XBP Europe guarantees resource independence through a multi-tenant, cloud-native architecture that employs strict logical isolation and auto-scaling groups.; ; To prevent the "noisy neighbor" effect, we use:; ; Resource Quotas: Hard limits on CPU, memory, and storage per tenant to ensure one user cannot monopolize system capacity.; ; Dynamic Scaling: Infrastructure automatically expands across availability zones to handle demand spikes without impacting existing users.; ; Throttling & Rate Limiting: API-level controls ensure fair access and maintain consistent latency.; ; Dedicated Compute Tiers: For high-volume clients, we offer dedicated clusters for absolute performance isolation.

Analytics

• Service usage metrics: Yes
• Metrics types: XBP Europe provides real-time, granular service metrics through its Web Workplace dashboards and ServiceFirst portal. Key metrics include:; ; Ingestion Statistics: Total document volumes, source distribution, and processing status.; ; AI Performance: Extraction accuracy rates, confidence scores per field, and Straight-Through Processing (STP) rates.; ; Operational Efficiency: Turnaround times (TAT) for each stage and identification of processing bottlenecks.; ; Human-in-the-Loop (HITL): User productivity metrics and verification error rates.; ; Auditability: Comprehensive logs detailing every action for compliance and security monitoring.; ; Customizable visualizations allow managers to track KPIs, set threshold alerts, and export data for stakeholder reporting.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: Users can export their data through several automated and manual methods designed for seamless integration and portability:; ; API-Based Export: Use Open APIs to programmatically extract structured metadata and transaction logs in real-time.; ; Web Workplace Tools: Authorized users can manually generate and download reports directly from the dashboard in formats such as JSON, XML, or CSV.; ; Secure File Transfer: For bulk document images (PDF, TIFF), data is delivered via SFTP or encrypted media to ensure security during transit.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • JSON
  • XML
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • PDF
  • TIFF
  • JPEG
  • PNG

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: XBP Europe guarantees high availability for its Intelligent Document Processing (IDP) platform, typically offering a 99.9% uptime SLA (Service Level Agreement), excluding scheduled maintenance windows.; ; Availability and Performance; Service Hours: The platform is designed for 24/7/365 availability. Our cloud-native architecture utilizes multiple Availability Zones (AZs) to ensure that if one data center experiences an issue, traffic is automatically rerouted to maintain service continuity.; ; Maintenance: Scheduled maintenance is typically conducted during low-usage windows (e.g., weekends), with users notified at least 48 hours in advance.; ; Service Credits and Refunds; If the guaranteed availability levels are not met within a calendar month, XBP Europe provides Service Credits rather than direct cash refunds. These credits are applied to the next billing cycle as a percentage of the monthly service fee:; ; <99.9% Uptime: A credit of 5% of the monthly fee.; ; <99.0% Uptime: A credit of 10% of the monthly fee.; ; <95.0% Uptime: A credit of 25% of the monthly fee.; ; Users must request credits through our ServiceFirst portal within 30 days of the incident. These credits represent the buyer’s sole remedy for availability breaches.
• Approach to resilience: XBP Europe utilizes a "resilience by design" approach, leveraging cloud-native architecture to ensure continuous service for the public sector.; ; Infrastructure Resilience; Our platform is hosted in Tier 3+ data centres (e.g., AWS or Azure UK regions) that provide N+1 redundancy for power, cooling, and network connectivity. The setup is distributed across multiple, physically isolated Availability Zones (AZs). If one zone fails, traffic automatically fails over to a healthy zone, ensuring zero or near-zero downtime.; ; Application Resilience; Auto-scaling: The service dynamically adjusts compute resources based on real-time document volume, preventing performance degradation during demand spikes.; ; Microservices Architecture: By decoupling components (ingestion, extraction, export), a failure in one module does not bring down the entire system.; ; Data Redundancy: Databases use synchronous replication across zones, ensuring no data loss occurs during a localized infrastructure failure.; ; Disaster Recovery; We maintain a robust Disaster Recovery (DR) plan with defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)—typically under 4 hours and 1 hour, respectively. Backups are encrypted at rest and stored in geographically separate regions to protect against catastrophic events.
• Outage reporting: XBP Europe provides transparent, multi-channel outage reporting to ensure buyers are informed of service status and restoration progress in real-time.; ; Reporting Channels; Public/Private Dashboard: We maintain a dedicated Service Status Dashboard accessible via our ServiceFirst portal. This provides a real-time "traffic light" view of core system components, including ingestion engines, AI extraction services, and API availability.; ; Email and SMS Alerts: Administrators can subscribe to automated notifications. In the event of a service degradation or outage, we push immediate alerts detailing the nature of the incident and the expected time to resolution (ETR).; ; API Integration: Status information is available via a Health Check API. This allows your internal IT monitoring tools to programmatically query our system status and trigger your own internal protocols.; ; Incident Management; Our 24/7 Security Operations Centre (SOC) monitors the platform continuously. Once an outage is detected:; ; Initial Alert: Issued within 15–30 minutes of detection.; ; Progress Updates: Provided at regular intervals (e.g., every 60 minutes) until the service is restored.; ; Post-Incident Report (PIR): A formal document detailing the root cause and preventative measures taken is provided within 5 business days for any major incident.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: XBP Europe enforces "least privilege" access to management interfaces and support channels, ensuring high security for the platform.; ; Access Restrictions; Management Interfaces: Access is limited to vetted engineers, requiring MFA and restricted to dedicated VPNs or fixed IP addresses.; ; Support Channels: Our ServiceFirst team uses a tiered model. Only 3rd-line engineers have backend access, which is strictly audit-logged.; ; Just-in-Time Access: For emergency troubleshooting, we utilize privileged access management (PAM) to grant temporary, time-bound credentials that expire automatically after use.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Beyond ISO/IEC 27001, our governance framework complies with:; ; Cyber Essentials Plus: Government-backed technical verification.; ; TR-Resiscan (Very High): Secure digitization and PII protection.; ; NF461: Digital archiving integrity.; ; NCSC Cloud Security Principles: Full alignment with G-Cloud standards
• Information security policies and processes: XBP Europe maintains a rigorous Information Security Management System (ISMS) certified to ISO/IEC 27001, ensuring a standardized approach to protecting public sector data.; ; Policies and Frameworks; Our security posture is governed by a comprehensive suite of policies based on the NIST Cybersecurity Framework (CSF). These include:; ; Access Control & IAM: Least-privilege access and multi-factor authentication.; ; Data Protection: Mandatory encryption for data-at-rest (AES-256) and in-transit (TLS 1.2+).; ; Incident Response: Standardized playbooks for detection, containment, and recovery.; ; Vulnerability Management: Regular automated scanning and annual third-party penetration testing.; ; Reporting Structure and Accountability; Governance follows a "tone at the top" model:; ; Board-Level Oversight: The Chief Technology Officer (CTO) and CISO oversee all security functions and provide periodic reports to the Board’s Audit Committee.; ; Operational Security: Our 24/7 Global Security Operations Centre (SOC) monitors the environment in real-time.; ; Compliance Verification: Policy adherence is ensured through:; ; Internal Audits: Regular reviews of control effectiveness.; ; Third-Party Assessments: Annual audits for ISO 27001 and Cyber Essentials Plus.; ; Mandatory Training: Annual security awareness programs for all staff to ensure a "security-first" culture
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: XBP Europe follows a formal Configuration and Change Management (CCM) process integrated into our ISO 27001-certified ISMS.; ; Component Tracking: All service components—including software versions, cloud infrastructure (AWS/Azure), and hardware assets—are tracked through their entire lifecycle via a centralized Configuration Management Database (CMDB).; ; Security Impact Assessment: Every proposed change undergoes a mandatory Security Impact Analysis (SIA). Changes are categorized by risk, reviewed by our Change Advisory Board (CAB), and must pass automated security scans and peer reviews in a staging environment before deployment to production.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: XBP Europe employs a proactive vulnerability management lifecycle aligned with ISO 27001 and Cyber Essentials Plus.; ; Threat Assessment: We use automated tools (e.g., Tenable, Qualys) for continuous internal and external scanning. Threats are prioritized using the CVSS v3.1 scoring system.; ; Patch Deployment: Critical patches are typically deployed within 24–48 hours. Non-critical updates follow a risk-based schedule during monthly maintenance windows.; ; Intelligence Sources: We monitor real-time feeds from the NCSC, NIST National Vulnerability Database (NVD), cloud provider security bulletins (AWS/Azure), and specialized threat intelligence partners.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: XBP Europe operates a 24/7 Security Operations Centre (SOC) that utilizes SIEM (Security Information and Event Management) and EDR tools to monitor logs across all platform layers.; ; Identification: We use automated behavioral analytics and signature-based detection to identify anomalies, such as unauthorized access attempts or lateral movement.; ; Response: Upon detection, we trigger a standardized Incident Response Plan. This includes containment (isolating affected components), forensic analysis, and eradication.; ; Speed: We prioritize incidents by severity; Critical threats receive an initial response and start of containment within 15–30 minutes.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: XBP Europe follows a formal Incident Response Plan integrated with our 24/7 SOC.; ; Pre-defined Processes: We utilize "playbooks" for common events like DDoS, malware, or unauthorized access to ensure rapid, consistent containment and recovery.; ; Reporting: Users report incidents via the ServiceFirst portal, a 24/7 emergency telephone line, or by emailing our dedicated Service Desk.; ; Reporting & Transparency: For major incidents, we provide a Post-Incident Report (PIR) within 5 business days, detailing the root cause, impact, and long-term preventative actions taken.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BSI
• ISO/IEC 27001 accreditation date: Wednesday 8 May 2024
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: BSI
• ISO 9001 accreditation date: Wednesday 20 November 2024
• What the ISO 9001 doesn’t cover: N/A
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 3ba37840-a85c-401e-87e8-9fa41ba642f2
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Ensuring new workers are informed of their right to join a trade union
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain
    • How the supplier will work with NGOs, trade unions or other businesses to address modern slavery risk
    • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering
    • Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Plans for engaging a diverse range of businesses in engagement activities prior to appointing subcontractors (including activities prior to award of the main contract and during the contract term)
    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
    • Advertising of supply chain opportunities openly and to ensure they are accessible to a diverse range of businesses, including advertising all subcontracting opportunities on Contracts Finder
    • Ensuring accessibility to contracting and subcontracting opportunities for disabled business owners and employees
    • Structuring of the supply chain selection process to ensure fairness (e.g. anti-corruption) and encourages participation by a diverse range of businesses, including with regard to new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutual
    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
    • Methods for engaging with different parts of the community (including the education system and charities representing the community) and how communities come together to inform decisions, strategy and projects to leave a positive legacy for future generations
    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)
    • Plans for positive actions with community groups.
    • Measures for making facilities used in the delivery of the contract available for community groups, education or training
    • Measures to engage users and communities and build relationships to increase community integration build trust and influence how the contract is delivered
    • Plans to respond flexibly and adapt approaches to community engagement and initiatives
    • Support for community-led initiatives relevant to the contract. Illustrative examples: improving transport links; reducing loneliness; helping with English language proficiency; and facilitating social mixing among people with different backgrounds
    • Collaborating with anchor institutions and community groups to make facilities available for education, training or community events

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors
    • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Collection of the views and expertise of disabled people and their representative organisations on successfully supporting disabled employees or applicants
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Introducing transparency to pay and reward processes
    • Offering a range of quality opportunities with routes of progression if appropriate, e.g. T Level industry placements, students supported into higher level apprenticeships.
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Other measures to provide equality of opportunity for disabled people and those with health conditions into employment, including becoming a Disability Confident employer and inclusion of supported businesses in the contract supply chain
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
    • Other measures to offer development opportunities for the target cohort(s) in the contract workforce
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
    • Understanding of issues relating to entering the contract workforce
    • Creation of outreach activities to create a pipeline of employees for the future contract delivery
    • Content of the outreach activity is designed to suit the target cohort
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at daren.williams@xbpeurope.com. Tell them what format you need. It will help if you say what assistive technology you use.