Chronosoft

Chronicler

Chronicler is a cloud-based incident and case management platform designed to support real-time operations in venues, events, emergency management, and complex environments. It enables teams to capture, manage, and analyse incidents, coordinate resources, maintain situational awareness, and produce auditable reports to support safety, compliance, and operational decision-making.

Features

• Real-time incident and case management with live operational updates
• Secure, browser-based access with role-based permissions
• Configurable workflows, forms, and fields without custom development
• Centralised dashboards providing situational awareness and operational oversight
• Integrated audit logging supporting compliance and accountability
• Advanced reporting with export to standard formats
• Mobile-friendly interface supporting field and control room users
• Scalable, multi-tenanted architecture supporting a range of organisation sizes
• Secure data encryption in transit and at rest
• Integration-ready via APIs with third-party systems and platforms

Benefits

• Improve operational decision-making with real-time visibility and accurate information
• Reduce response times through streamlined incident capture and coordination
• Enable teams to work collaboratively across locations and devices
• Simplify compliance reporting with consistent, auditable records
• Increase efficiency by replacing manual processes with structured digital workflows
• Support staff during live operations with clear, shared situational awareness
• Scale operations easily across multiple venues, events, and organisations
• Minimise training time through an intuitive, role-based user interface
• Strengthen accountability with transparent activity tracking and audit logs
• Maintain continuity during incidents with reliable, highly available cloud access

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at edward@chronosoft.com.au. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

805103438366088

Contact

Edward Swete Kelly
61419173628
edward@chronosoft.com.au

About the service

• Service categories:
  • Applications
    • Production and operations
      • Service industry and public sector operations
        • Healthcare
        • Education
        • Public Order and Safety
        • Police
        • Defence
        • Social Security Administration
      • Other operations
        • Other operations
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Chronicler is part of the Chronosoft operational suite, alongside Locator, Medstat, and Orchestrator. Together, they extend CAD, control room, workforce, geospatial, and clinical systems by providing integrated incident management, location awareness, patient care reporting, and workflow orchestration through a unified, API-enabled platform.
• Cloud deployment model: Private cloud
• Service constraints: No constraints
• System requirements:
  • Modern web browser such as Google Chrome or Microsoft Edge
  • Stable internet connection for real-time cloud access
  • User device supporting standard HTML5 and JavaScript
  • Valid user account with assigned role-based permissions
  • Screen resolution suitable for dashboard and form-based interfaces
  • Mobile device with modern browser for field access
  • Organisation network permitting secure HTTPS outbound connections
  • No local software installation or specialised hardware required
  • Support for multi-factor authentication where enabled
  • PDF and spreadsheet viewer software for exported reports

User support

• Email or online ticketing support: Yes
• Support response times: We respond to tickets aligned to our customers agreed SLA. There is no impact from out of hours, weekend or holidays.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Chronicler is supported through a tiered support model designed to align with operational criticality.; ; Standard Support is included at no additional cost and provides business-hours assistance, incident logging, software updates, and access to documentation and knowledge resources.; ; Enhanced Support is available as a paid option and includes extended hours, prioritised response times, proactive system monitoring, and escalation management during live operations and events.; ; Event Support is offered for high-risk or time-critical activities, providing dedicated on-call engineers, real-time monitoring, and direct operational support during events.; ; A dedicated technical account manager or cloud support engineer can be assigned under Enhanced or Event Support tiers to provide ongoing service oversight, planning, and optimisation.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Users are supported through a structured onboarding process tailored to their operational needs. This includes initial configuration, data setup, and role-based access aligned to organisational requirements.; ; Getting started is supported by guided online training sessions, a customised knowledge base, and clear user documentation covering day-to-day use and administration. Training can be delivered remotely and tailored for operational, supervisory, and administrative roles.; ; For complex environments or live operations, assisted onboarding and event support can be provided to ensure users are confident prior to go-live. Ongoing support and refresher training are available to accommodate staff turnover and evolving operational requirements.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: At contract end, customers can extract their data in standard, non-proprietary formats. Authorised users can export reports and datasets directly from the interface in formats such as CSV, PDF, and Excel.; ; For full data extraction, Chronosoft provides a structured export of customer data via secure transfer, including incident records, case data, attachments, and audit logs. API access may also be used to retrieve data prior to contract completion.; ; Data extraction is supported by the Chronosoft support team to ensure completeness and integrity. Following confirmation of successful data handover, customer data is securely retained or deleted in accordance with contractual terms and applicable data protection legislation.
• End-of-contract process: At the end of the contract, customers retain full ownership of their data. The contract price includes standard data export capabilities, allowing authorised users to extract reports and datasets directly from the system in common formats.; ; Upon request, Chronosoft will support a full data extraction and handover using secure transfer methods. This includes operational records, attachments, and audit logs. Reasonable assistance for data extraction and transition is included as part of the offboarding process.; ; Additional services, such as bespoke data transformation, extended data retention beyond the contract period, or active migration support into a third-party system, may incur additional costs and would be agreed in advance.; ; Following confirmation that data extraction has been completed, system access is disabled and customer data is securely retained or deleted in accordance with contractual terms, regulatory obligations, and applicable data protection legislation.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Yes. Chronicler is fully browser-based and responsive across desktop, tablet, and mobile devices. The mobile experience is optimised for field use, focusing on rapid data entry, incident updates, and situational awareness. Desktop access provides broader dashboards, advanced reporting, and configuration tools suited to control rooms and administrative users. Core functionality and data remain consistent across all devices.
• Service interface: Yes
• Description of service interface: Yes. Chronicler provides a secure, browser-based user interface accessible via standard web browsers. The interface supports role-based access, configurable dashboards, and responsive layouts for desktop and mobile use. It also exposes documented APIs to support integration with external systems and services.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Chronicler is designed to meet WCAG 2.2 AA accessibility standards. Accessibility is considered throughout design and development, including colour contrast, keyboard navigation, focus management, form labelling, and screen reader compatibility.; ; Interface testing includes internal accessibility reviews, use of automated accessibility testing tools, and practical testing with common assistive technologies such as screen readers and keyboard-only navigation. Feedback from users operating in high-pressure, operational environments is incorporated to improve clarity, usability, and accessibility. Accessibility improvements are reviewed continuously as part of ongoing product development and release cycles.
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: Yes. Chronicler provides a secure, documented REST API to support integration with external systems.; ; Using the API, users can create, read, and update operational data such as incidents, cases, tasks, locations, and related records. The API supports data ingestion from third-party systems, synchronisation of operational updates, and extraction of data for reporting and analytics. Authentication and access are controlled through secure tokens and role-based permissions aligned with the user interface.; ; Service setup through the API focuses on operational data exchange rather than core platform provisioning. Configuration of system structure, security roles, and permissions is managed through the user interface to maintain governance and reduce misconfiguration risk.; ; Changes made through the API are subject to validation rules, audit logging, and permission controls. Limitations include restricted access to administrative configuration, user management, and security settings, which are intentionally managed via the interface rather than the API.
• API documentation: Yes
• API documentation formats:
  • PDF
  • Other
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Yes. Chronicler is highly configurable and can be customised without custom development.; ; Authorised system administrators can customise workflows, forms, fields, validation rules, dashboards, reports, and user permissions to align with organisational processes. System structure can be configured to reflect organisational hierarchies such as organisations, venues, facilities, and teams.; ; Customisation is performed through the secure web interface using role-based access controls. Changes take effect immediately and are recorded in audit logs to maintain governance and traceability.; ; Operational users can personalise views, filters, and dashboards within the permissions assigned to their role. Administrative configuration, security settings, and core system controls are restricted to authorised administrators to ensure system integrity and compliance.

Scaling

• Independence of resources: Chronicler operates on a multi-tenanted, cloud-based architecture with logical separation of customer data and workloads. Resources scale automatically to meet demand, ensuring performance is maintained during peak usage.; ; The platform uses load balancing, capacity monitoring, and performance thresholds to prevent individual tenants from impacting others. Continuous monitoring and proactive scaling ensure consistent availability and response times, even during concurrent events or high-demand operational periods.

Analytics

• Service usage metrics: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: In-house
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Degaussing
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Users can export their data directly from the Chronicler interface using built-in reporting and export tools. Authorised users can filter, query, and export operational data and audit logs in standard formats for analysis or record-keeping.; ; Data can also be extracted programmatically using the Chronicler API for automated or bulk exports. For larger or complete dataset exports, Chronosoft provides secure, supported data extraction via agreed transfer methods to ensure accuracy and data integrity.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Chronicler is delivered under a formal Service Level Agreement guaranteeing 99.999 percent availability, excluding agreed planned maintenance. Availability is measured on a monthly basis and is designed to support mission-critical, live operational environments.; ; The platform is hosted on resilient, multi-availability-zone cloud infrastructure with continuous monitoring, automated failover, and proactive incident response. Planned maintenance is scheduled outside critical operational periods wherever possible and is communicated in advance.; ; If availability falls below the guaranteed level, service credits are applied in accordance with the SLA. Credits are calculated as a percentage of the monthly service fee and can be offset against future invoices. The specific credit structure and thresholds are clearly defined in the SLA provided as part of the contract.; ; This approach ensures transparency, accountability, and financial protection for customers while maintaining a strong operational focus on reliability and performance.
• Approach to resilience: Chronicler is designed for resilience to support mission-critical, real-time operations. The service is hosted on highly available cloud infrastructure distributed across multiple availability zones, reducing the risk of single points of failure.; ; The platform uses automated failover, load balancing, and health monitoring to detect and recover from component or service failures without user impact. Infrastructure scales dynamically to manage sudden increases in demand, such as concurrent major incidents or large-scale events.; ; Data is protected through regular automated backups, point-in-time recovery, and tested disaster recovery processes with defined recovery time and recovery point objectives. Security controls, continuous monitoring, and alerting are in place to rapidly identify and respond to operational or security incidents.; ; Resilience is reviewed and improved as part of ongoing operations, testing, and platform updates. Detailed datacentre architecture and disaster recovery arrangements are available on request.
• Outage reporting: Chronicler reports service outages and service degradation through direct email alerts to nominated customer contacts. Notifications are issued promptly when an incident is identified and include status updates, impact assessment, and estimated resolution time where available.; ; Outages are detected through continuous platform monitoring and alerting systems. Follow-up communications are provided as the incident progresses and upon resolution, including a summary of the issue and corrective actions taken.; ; Where required, outage information can also be communicated through agreed support channels and incorporated into post-incident reporting aligned with the Service Level Agreement.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is restricted using role-based access control and least-privilege principles. Administrative interfaces are accessible only to authorised users with defined roles, protected by strong authentication and multi-factor authentication where enabled.; ; Support access is limited to nominated customer contacts and verified Chronosoft personnel. Identity verification is required before any support action is taken. All administrative and support activities are logged and auditable. Access rights are reviewed regularly and revoked promptly when no longer required to maintain security and governance.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Chronosoft follows a structured information security framework aligned with ISO 27001 principles and industry best practice. Information security policies cover access control, data protection, incident management, change management, vulnerability management, and business continuity.; ; Security governance is led by senior management, with clear accountability for information security across development, operations, and support teams. Policies are documented, reviewed regularly, and updated to address emerging risks, regulatory changes, and operational lessons learned.; ; Access to systems and data is governed through role-based access controls, least-privilege principles, and multi-factor authentication where enabled. All access and configuration changes are logged and auditable. Data is encrypted in transit and at rest, and secure coding practices are applied throughout the development lifecycle.; ; Operational security processes include continuous monitoring, vulnerability scanning, penetration testing as required, and formal incident response procedures. Security incidents are recorded, investigated, and managed through defined escalation and reporting pathways, with customer notification aligned to contractual and regulatory obligations.; ; Compliance with policies is enforced through technical controls, regular internal reviews, staff training, and onboarding requirements. Third-party services are assessed for security posture and risk. Customers can raise security concerns through established support channels, and remediation activities are tracked and reported in line with agreed processes.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Chronicler follows controlled configuration and change management aligned to ISO 27001 and ITIL principles. All components, including code, infrastructure, and configuration items, are version-controlled and tracked through their lifecycle. Changes are raised as formal records with scope, risk, approvals, test evidence, and rollback plans. Each change is assessed for operational and security impact, including access control, data handling, availability, and compliance. Security-sensitive changes receive additional review and validation. Releases are tested in non-production environments, peer reviewed, and deployed using repeatable processes with monitoring and logging. Emergency changes follow an expedited workflow with post-implementation review and documented outcomes.
• Vulnerability management type: Undisclosed
• Vulnerability management approach: Chronicler uses a structured vulnerability management process aligned with ISO 27001 and OWASP guidance. Threats are identified via continuous monitoring, automated scanning, dependency checks, and penetration testing as required. Intelligence sources include vendor advisories, cloud provider notifications, industry alerts, and responsible disclosure. Vulnerabilities are assessed by severity, impact, and exploitability, then prioritised. Critical issues are remediated urgently, with fixes tested in non-production before controlled deployment. Customers are notified of significant issues and remediation actions in line with contractual and regulatory obligations.
• Protective monitoring type: Undisclosed
• Protective monitoring approach: Chronicler uses continuous protective monitoring to identify potential compromises. System logs, access events, and application activity are monitored in real time using automated alerts and security tooling. Anomalous behaviour, unauthorised access attempts, and performance deviations trigger investigation.; ; When a potential compromise is detected, predefined incident response procedures are followed, including containment, investigation, remediation, and recovery. Security incidents are prioritised by severity, with critical incidents responded to immediately. Customers are notified in line with contractual and regulatory requirements. Monitoring, response effectiveness, and detection rules are reviewed regularly to improve ongoing security posture.
• Incident management type: Undisclosed
• Post-quantum cryptography secure: Yes
• Incident management approach: Chronicler uses structured incident management processes with predefined workflows for common operational and security events. Users report incidents directly through the web or mobile interface using configurable forms, or via integrated systems where enabled. Incidents are categorised, prioritised, and tracked in real time with clear ownership and escalation paths.; ; Incident reports are generated automatically from captured data and audit logs, supporting operational review, compliance, and post-incident analysis. Reports can be viewed in-system or exported in standard formats. Processes are configurable to align with organisational procedures and regulatory requirements.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 1%
• Between £250,000 and £500,000: 1%
• Between £500,001 and £1,000,000: 1%
• Between £1,000,001 and £2,500,000: 1%
• Between £2,500,001 and £5,000,000: 1%
• Over £5,000,001: 1%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: Southpac Certifications Pty Ltd
• ISO/IEC 27001 accreditation date: Thursday 20 February 2025
• What the ISO/IEC 27001 doesn’t cover: All parts of service are covered by ISO27001
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 71de62d5-18e7-49cd-ad84-5078f41467a7
• Cyber essentials plus: Yes
• Cyber Essentials Plus Certificate Number: 5f88c525-1d3e-4528-83a9-bef85f902d4d
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • Ensuring new workers are informed of their right to join a trade union
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at edward@chronosoft.com.au. Tell them what format you need. It will help if you say what assistive technology you use.