Skip to main content

Beta Help us improve the Digital Marketplace - send your feedback

Bramble Hub Limited

Bramble Hub Bluestar Software - Confidential Reporting / Integrity Link

The Confidential Reporting application or Integrity Link as it is also known, is used by law enforcement personnel to submit anonymous feedback to their organisation. The tool ensures that personnel can disclose problems relating to standards of conduct, operational failings, and risks without any fear of recrimination or repercussions.

Features

  • Secure, container-led application
  • Independent application
  • Easy to use interface
  • Smart communications set-up
  • Variable delays in messaging exchanges
  • Masking of the originating IP address
  • Management charts and reports

Benefits

  • Ensures the secure transmission of data
  • Runs independently of Corvus to preserve the user’s anonymity
  • Enables personnel to attach supplementary information to support their case
  • Containers provide a channel between the user and the ACU
  • Preserve the anonymity of the force personnel
  • Protects the user’s identity and retains confidentiality
  • Can be exported to provide additional insights to senior personnel

Pricing

£15,000 to £40,000 a licence a year

  • Free trial available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at contact@bramblehub.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

8 0 7 4 8 1 7 0 5 3 1 5 0 8 6

Contact

Bramble Hub Limited Geoff Couling
Telephone: +44 (0) 2077350030
Email: contact@bramblehub.co.uk

Service scope

Software add-on or extension
Yes, but can also be used as a standalone service
What software services is the service an extension to
Integrity Link is a standalone service, but it can also be used in conjunction with the other Corvus modules.
Cloud deployment model
Hybrid cloud
Service constraints
N/A
System requirements
  • Appropriate browser for use with the application
  • Antivirus integration supports ClamAV, Eset and Kaspersky

User support

Email or online ticketing support
Email or online ticketing
Support response times
We respond from one hour to 28 days depending on the priority of the question which is covered in our Service Level Agreements (SLAs).
User can manage status and priority of support tickets
Yes
Online ticketing support accessibility
WCAG 2.1 AA or EN 301 549
Phone support
Yes
Phone support availability
24 hours, 7 days a week
Web chat support
No
Onsite support
Onsite support
Support levels
Support is offered at two levels - standard office hours and extended 24 x 7 (available at additional cost). Typically, customers operate a first line support function with Bluestar delivering a second line capability. Customers can opt for Bluestar to carry out first line support but this is subject to an additional charge. All customers are assigned a technical lead and support manager.
Support available to third parties
Yes

Onboarding and offboarding

Getting started
Initial handover to the customer's representatives is typical. User manual is provided as part of the product, accessible to all users. Service is designed to be as easy to use as possible, with tool tips and pointers in order to help new users. Formal training courses are provided at additional cost.
Service documentation
Yes
Documentation formats
  • HTML
  • ODF
  • PDF
End-of-contract data extraction
The service is designed to be a secure, anonymous platform. There is no way to extract data or to identify who it is associated with.
End-of-contract process
The service is decommissioned after an agreed period. This activity removes all customer data and related information.

Using the service

Web browser interface
Yes
Supported browsers
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
Application to install
No
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
The system provides access to assets via an industry standard browser. The nature of the service means that it is therefore less applicable to mobile devices. However, any device providing a suitable browser technology can utilise the service. The recipient would have to determine whether the type of device was appropriate for the content to be downloaded / accessed.
Service interface
No
User support accessibility
WCAG 2.1 AA or EN 301 549
API
No
Customisation available
No

Scaling

Independence of resources
Application scales horizontally with the addition of more nodes. Load balancing fronts the services to distribute load between all servers. Transportable tokens are used to allow users to move between servers without interruption

Analytics

Service usage metrics
Yes
Metrics types
We do provide service usage metrics in terms of the number of submissions and the transactions on a week by week, or month by month basis. However, the data is not broken down any further, as this would compromise the integrity of the platform and the users’ identities.
Reporting types
  • Regular reports
  • Reports on request

Resellers

Supplier type
Not a reseller

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
Yes
Datacentre security standards
Supplier-defined controls
Penetration testing frequency
At least once a year
Penetration testing approach
‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest
Encryption of all physical media
Data sanitisation process
Yes
Data sanitisation type
Explicit overwriting of storage before reallocation
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
N/A
Data export formats
Other
Other data export formats
Due to confidential natire there is no data extract available
Data import formats
Other
Other data import formats
No data import is appropriate

Data-in-transit protection

Data protection between buyer and supplier networks
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
Other protection within supplier network
Data transferred over a shielded private network. All data is marked with an appropriate security indicator governing access control. Certain data types can also utilise a proprietary obfuscation method.

Availability and resilience

Guaranteed availability
Service levels are discussed on a per customer basis. As a general guide, Bluestar offers 99.95% availability for the main service.
Approach to resilience
The system is deployed using a distributed service architecture, that is to say the system has built-in redundancy by locating the same service capability across multiple physical machines. This is combined with load balancing so that a particular service location operates effectively. Using these (patented) techniques, we have no single point of failure within the system itself and therefore achieves extremely high levels of availability as standard.
Outage reporting
Bluestar deploys its own Corona monitoring application. This is used to implement monitors and metrics linked to the main service. Monitoring checks a range and variety of conditions such as capacity, network access, performance of individual processes etc. Alerts are immediately visible on screen and sent via email (and SMS) to administrators and (optionally) customer representatives.

Identity and authentication

User authentication needed
Yes
User authentication
  • 2-factor authentication
  • Username or password
  • Other
Other user authentication
To authenticate users there are two parts to the service. One part is the use of a shared password. The second part requires a username and a password. 2FA is an option but it’s not required.
Access restrictions in management interfaces and support channels
N/A
Access restriction testing frequency
At least every 6 months
Management access authentication
  • 2-factor authentication
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users contact the support team to get audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
At least 12 months

Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
Citation ISO Certification
ISO/IEC 27001 accreditation date
16/10/2023
What the ISO/IEC 27001 doesn’t cover
N/A
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Cyber essentials
Yes
Cyber essentials plus
Yes
Other security certifications
Yes
Any other security certifications
ITHC CHECK as per CESG guidelines

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
ISO/IEC 27001
Information security policies and processes
We are accredited and have aligned our processes and procedures to ISO27001, ISO9001 and ISO 20000.
Bluestar Software complies with the following governance standards: Cyber Essentials, Cyber Essentials Plus, ISO 270001:2013, ISO 20000-1:2018 and ISO 9001:2015.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Typically the change management process is agreed with customers to suit their preferred model. In all cases, customer representatives authorise work to be carried out and will be asked to participate in the acceptance testing on a suitable test platform.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Bluestar considers all aspects of vulnerability including the physical location and access controls. Software configurations utilise an automated patching process (run daily as a minimum) to ensure that any potential threats are mitigated as quickly as possible. At the outset, all builds are established with a 'known' and approved benchmark which is independently verified.
Protective monitoring type
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach
Bluestar adopts compliance with recognised standards covered by agreements with our hosting providers.
Incident management type
Supplier-defined controls
Incident management approach
Incident management is a built-in element of our Support-Link and automatic monitoring systems and is defined within our business process management workflow. Any incidents (including security) reported, or identified, are passed on to our support team and if sufficiently serious in nature, are immediately notified to Bluestar's dedicated Support Manager. The Support Manager will escalate to the Senior Management Team (Director level), if the incident is either deemed sufficiently serious, or there are specific customer circumstances , or if the SLA is compromised.

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks
No

Social Value

Social Value

Social Value

Fighting climate change

Fighting climate change

Bluestar Software’s G-Cloud 14 applications and services provision will enable our customers to
realise a direct benefit in reducing their carbon footprint in the fight against climate change.
Bluestar applications digitise our customers’ services, significantly reducing the need to create and
share printed materials and our online collaboration tools reduce the requirement to physically
travel to meetings using public and private transport.

Pricing

Price
£15,000 to £40,000 a licence a year
Discount for educational organisations
No
Free trial available
Yes
Description of free trial
Customer commits to providing a formal assessment of the system at the end of the trial period.
Trial period will be agreed on a case by case basis.
That functionality may be limited given the constraints of the trial.

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at contact@bramblehub.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.