SXP.ai

SXP.ai Governed AI Automation Platform & Conversational Assistant for Higher Education

Governed AI automation platform built exclusively for universities. Scoped micro-agents automate student, staff and applicant processes end-to-end inside campus systems such as TOPdesk, SIS, VLE and CRM. Includes a conversational assistant for students and applicants in campusM, myday and Canvas; staff invoke workflows from Copilot or NebulaOne via MCP/A2A.

Features

• Governed AI workflows automating university business processes end-to-end
• TOPdesk service desk automation: reads, responds, resolves, escalates tickets
• Student and applicant assistant deployable in campusM, myday, Canvas
• Staff invoke workflows from Microsoft Copilot, NebulaOne via MCP/A2A
• Integrates with SIS, VLE, CRM, timetabling and case management
• Scoped micro-agents cannot act outside their defined boundaries
• Pre-built agents for retention, wellbeing, applicant support and Q&A
• Proactive retention and wellbeing support using calendar and engagement data
• Multi-model: Amazon Bedrock, Claude, OpenAI or institution-provided models
• ISO 27001/27701, Cyber Essentials certified; GDPR, EU AI Act compliant

Benefits

• Automate service desk tickets end-to-end, recovering significant staff time
• Cut enquiry response times from days to seconds
• Extend existing Copilot investment with automation that resolves work
• Reach students and applicants where they are: campusM, myday, Canvas
• Identify at-risk students early and intervene at scale
• Support student wellbeing 24/7 with escalation to human services
• Full audit trail and human escalation for every automated action
• Go live in weeks using pre-built higher education agents
• Avoid model lock-in; change LLMs as the landscape evolves
• Scale university services without increasing staffing levels

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hugh.griffiths@sxp.ai. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

801153195713928

Contact

Hugh Griffiths
07976727590
hugh.griffiths@sxp.ai

About the service

• Service categories:
  • Applications
    • Content workflow and management
      • Persuasive content management
        • Digital Adoption Platform
      • Enterprise portals and digital workspaces
        • Multi-Audience Portals
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: This is a standalone software service but it can be integrated with other software services at a university such as VLE's, student record systems, and CRM's.
• Cloud deployment model: Public cloud
• Service constraints: The solution is fully customisable and we do not have scheduled maintenance windows that affect availability.
• System requirements: The end user will require a modern web browser

User support

• Email or online ticketing support: Yes
• Support response times: SXP.ai provides email-based support through an online ticketing process, with telephone and video support available where required. Initial response times are prioritised by severity and apply during standard business hours.; ; Target response times are as follows: S1 (Total Service Loss) within 30 minutes; S2 (Major Service Degradation) within 1 hour; S3 (Minor Service Issue) within 8 business hours; and S4 (Individual User Incident or general enquiry) within 2 business days.; ; Support requests received outside business hours or at weekends are logged and responded to on the next working day. Critical service issues will be responded to outside business hours.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Support is provided through a dedicated Customer Success Manager who acts as the primary point of contact for each customer. Standard support is delivered during business hours via email, with online meetings provided as required. Monthly client success meetings are held online to review service performance, usage, and planned activity.; ; All standard support is included within the subscription cost, with no additional charges for the defined support levels. Service issues are logged via email to the support desk and prioritised according to severity. Target resolution times are as follows: S1 (Total Service Loss) within 8 hours; S2 (Major Service Degradation) within 16 hours; S3 (Minor Service Issue) within 72 hours; and S4 (Individual User Incident) within 5 business days.; ; The Customer Success Manager provides ongoing service management, coordination, and escalation. Specialist engineering resources are engaged internally where required to resolve technical issues.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: SXP.ai supports customers through a structured onboarding process led by a dedicated Customer Success Manager. Getting started includes online onboarding sessions and deployment guidance. No training is required for end-users, as the assistant is designed to be intuitive and self-service. End-users can provide feedback directly within the assistant, which is reviewed and responded to by SXP.ai. This approach enables rapid adoption with minimal effort for both customers and users.
• Service documentation: Yes
• Documentation formats: PDF
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: At the conclusion of a contract, we provide customers a database dump of all customer data in a wide range of formats.
• End-of-contract process: At the end of the contract, SXP.ai supports a smooth service exit at no additional cost. This includes providing a data extract on request, securely deleting customer data from the service environment, and supporting transition activities.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The user-facing AI Assistant is designed to operate consistently across both mobile and desktop devices, providing the same core functionality regardless of screen size. The Reporting/Dashboard interface, used by authorised university staff, is accessed via a web browser and is optimised for desktop use only.
• Service interface: Yes
• Description of service interface: The service provides a conversational AI assistant interface for end users, accessible through web, mobile, and embedded deployments. Authorised staff are provided with a web-based reporting interface, optimised for desktop use, which provides usage, engagement, and performance insights.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Accessibility testing includes validating the service interface using assistive technologies and accessibility tools to confirm compliance with WCAG 2.2 AA. Testing covers keyboard-only navigation, screen reader compatibility, semantic HTML structure, appropriate ARIA usage for dynamic elements, colour contrast, focus indicators, descriptive link text, and clear form labels. The interface also supports light, dark, and system appearance modes to improve usability for users with visual or sensory needs.
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: The service provides a read-only API that allows institutions to retrieve and display contextual assistant content within their own systems, such as VLEs, portals, or mobile applications. The API supports proactive engagement by enabling the launching system to surface relevant messages that encourage users to interact with the AI Assistant and get proactive support.; ; Using the API, institutions can retrieve assistant-ready content, display contextual messages based on predefined events - such as a student missing a class, and launch the assistant with a predefined configuration. API access is enabled using a tenant-specific configuration identifier and API credentials, with returned content rendered directly in the host system.; ; The API is ready-only and cannot make any changes.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: The service is fully configurable to meet the diverse needs of higher education institutions. The service can be customised to align with institutional branding, content, and operational requirements. Customisation includes which use cases the assistant supports, such as wellbeing, Q&A, or service automation; which content sources are used, including websites, documents, systems, and knowledge bases; and where the assistant is deployed, such as VLEs, portals, mobile apps, or websites.

Scaling

• Independence of resources: The service is delivered on a scalable, multi-tenant cloud architecture hosted on AWS. Resources are logically isolated by tenant, with usage controls and capacity management in place to prevent one customer’s demand impacting others. The platform uses elastic scaling and monitored resource thresholds to maintain consistent performance during peak usage. This approach ensures reliable service availability and performance regardless of fluctuations in demand from individual users or institutions.

Analytics

• Service usage metrics: Yes
• Metrics types: The service provides analytics and reporting on assistant usage and engagement. Metrics include the volume of questions and conversations, categorisation of topics, sentiment indicators, resolution outcomes, user selections, and identification of trends and peak usage periods. Custom KPIs can be defined per micro-agent to measure outcomes aligned to specific use cases, such as wellbeing engagement or service demand reduction.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: All data can be exported. It can be exported to a flat file format or delimiter such as csv.; Custom data exports can also be requested through our technical team.
• Data export formats:
  • CSV
  • Other
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • PDF
  • DOC
  • HTML
  • API

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The service is provided with a guaranteed availability of 99% uptime, excluding scheduled maintenance notified in advance. If the guaranteed availability level is not met, the customer is eligible for subscription credits. Subscription credits are calculated proportionally based on the percentage of time the service level was not achieved and are applied by way of an extension to the subscription term, providing additional access to the service at no extra cost.
• Approach to resilience: Our Service is hosted on AWS, further information is available on request.
• Outage reporting: Our service promptly notifies customers of any outages via email, ensuring timely and transparent communication during service interruptions.

Identity and authentication

• User authentication needed: No
• Access restrictions in management interfaces and support channels: Access to management interfaces is restricted to authorised SXP.ai staff using role-based access controls and authenticated user accounts, following least-privilege principles. Access is reviewed regularly and managed through joiner, mover, and leaver processes. Support is provided through controlled channels including email, phone, and video conferencing using Microsoft services such as Outlook and Teams. Each customer has a dedicated Customer Success Manager as the primary point of contact. Internal access to customer information and environments is limited to approved personnel and logged in line with information security policies.
• Access restriction testing frequency: At least once a year
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users receive audit information on a regular basis
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Information security is managed through an ISO 27001-certified Information Security Management System (ISMS), with privacy controls integrated through ISO 27701. These frameworks define policies and processes covering risk management, access control, incident management, and data protection. Compliance with GDPR and the EU AI Act is embedded within these processes, including controls supporting high-risk EU Act AI classifications. Security governance is overseen by senior management, with defined reporting responsibilities. Policies are enforced through documented procedures, staff training, access controls, and regular internal and external audits.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: All configuration and change management activities are governed by ISO 27001-aligned controls. Changes are logged, reviewed, security-assessed, and approved through a formal change management process. All changes are tested in segregated development and staging environments before deployment to production. Security impact is assessed for changes involving personal data, including completion of Data Protection Impact Assessments where required.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Vulnerability management is implemented through a combination of AWS-managed infrastructure controls and supplier-managed application controls. AWS continuously monitors and patches underlying infrastructure. Application-level vulnerabilities are managed through regular dependency reviews, security updates, OWASP Top 10 testing, penetration testing by CREST-accredited third parties, and prompt remediation of identified risks in line with severity.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Protective monitoring is implemented using AWS-native security services and application-level monitoring. AWS CloudTrail and CloudWatch provide centralised logging, monitoring, and alerting across all environments, with logs protected from tampering. AWS Shield provides automated DDoS protection. The application layer monitors for anomalous or suspicious activity and generates alerts for investigation.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: Incident management is governed by ISO 27001-aligned incident response procedures. Security events and incidents are logged, assessed, and escalated to senior management, including the CEO. Incidents are investigated to determine impact and root cause, with corrective actions implemented to prevent recurrence. Customers are notified of relevant incidents in accordance with contractual and regulatory requirements.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Limited period access to wellbeing and Q&A micro-agents using customer content.
• Link to free trial: Environment provisioned per customer.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 15%
• Between £2,500,001 and £5,000,000: 15%
• Over £5,000,001: 20%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: Alcumus ISOQAR
• ISO/IEC 27001 accreditation date: Tuesday 25 February 2025
• What the ISO/IEC 27001 doesn’t cover: Our ISO/IEC 27001:2022 certification covers the Information Security Management System (ISMS) for the delivery and operation of our services. The following areas are not covered, as documented and justified in our Statement of Applicability.; ; Certain physical security controls (Annex A.7) are not applicable because the organisation operates on a remote, home-working basis and does not maintain offices, secure facilities, or on-premise infrastructure. These include physical security perimeters, entry controls, physical monitoring, secure areas, and cabling security. Where physical infrastructure is required, this is provided by Amazon Web Services (AWS), which is responsible for physical and environmental security within its ISO-certified data centres.; ; Certain secure development controls (Annex A.8) are not applicable because software development activities are outsourced to third-party suppliers. Secure development responsibilities are managed through contractual obligations, supplier assurance, and third-party risk management rather than internal implementation.; ; All exclusions are risk-assessed, formally documented, and do not increase residual information security risk. All other applicable Annex A controls are implemented and operating effectively within the scope of certification.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: You do not have a current and valid Cyber Essentials Plus certificate, or will not have in place within 12 months of the date of award but have an IASME certified equivalent.
• Other security certifications: Yes
• Any other security certifications: ISO/IEC 27701:2019

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • Plans to engage the contract workforce in deciding the most important workplace issues to address
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

  Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

  • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
  • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
  • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
  • Methods for engaging with different parts of the community (including the education system and charities representing the community) and how communities come together to inform decisions, strategy and projects to leave a positive legacy for future generations
  • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)
  • Collaborating with anchor institutions and community groups to make facilities available for education, training or community events
• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
  • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
  • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)
  • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Working conditions which promote an inclusive working environment and promote retention and progression
  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
  • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

  • Understanding of the issues affecting the development of new skills by target cohort
  • Understanding of issues relating to entering the contract workforce
• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
  • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hugh.griffiths@sxp.ai. Tell them what format you need. It will help if you say what assistive technology you use.