Hootsuite Inc

Hootsuite

Hootsuite is a social media management, engagement, monitoring and listening platform. It enables organisations to collaboratively deliver social media strategies across departments and social networks from one secure, web-based and mobile dashboard. Hootsuite integrates with existing systems, helping organisations to more effectively inform and engage with communities through social media.

Features

• Hootsuite Enterprise
• Hootsuite Listening (powered by Talkwalker)
• Advanced Inbox
• Amplify - Employee Advocacy
• Social Advertising
• Advanced Analytics
• Services - Implementation and Training

Benefits

• Manage social channels (paid and organic) from one place
• Analyse sentiment, intent, and emerging trends from 150m data sources
• Collaborative campaign planning & content approval functionality
• Optimise timing of your content publishing with Hootsuite's recommendations
• Ensure customer satisfaction with rapid responses & high quality content
• Leverage governance capabilities to manage user access
• Create, share & schedule automated analytics reports
• Measure & manage team performance and improve team collaboration
• Reduce operating costs by streamlining processes & avoiding costly channels
• Upskill your teams on social media with Hootsuite's resources

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Gcloud@hootsuite.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

847767734452651

Contact

Nathan Bird
00447737472732
Gcloud@hootsuite.com

About the service

• Service categories:
  • Applications
    • Customer relationship management
      • Marketing campaign management
        • Marketing campaign management
      • Customer service
        • Customer service
      • Contact centre
        • Contact centre
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Hootsuite is a SaaS solution. An internet connection and web browser are required. Like all SaaS platforms, Hootsuite does not have periodic releases of updates or software versions. Rather, our development teams work to improve our platforms on a continual basis. Updates are made on a daily basis – as such it is not practical (or possible) to provide notification of updates. Please note that each platform will be operational and available to Customer 24 hrs/day, 7 days/week at least 99.9% of the time in any calendar months. Please see the following link for more details: https://hootsuite.com/legal/enterprise-service-level-agreement.
• System requirements: NA

User support

• Email or online ticketing support: Yes
• Support response times: -1 business day SLA -web chat & ticket (email) for all customers.; ; Core Hours of Operation - Mon - Fri 9am-5pm UK time.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: EN 301 549
• Phone support: No
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• AI chatbot: Yes
• Web chat support accessibility standard: EN 301 549
• Web chat accessibility testing: Hootsuite continually reviews the accessibility of its services and works with a third party accessibility speacialist to ensure that we are maintaining optimal standards in this areas.Hootsuite provides customer service training to our employees on our accessibility policies and procedures, including services and features that provide accessibility to our customers. We are committed to working towards an inclusive environment that is accessible to all.
• Onsite support: Yes
• Support levels: -1 business day SLA -web chat & ticket (email). ; ; Core Hours of Operation - Mon - Fri 9am-5pm UK time.; ; All customers will benefit from a Customer Success team to ensure ongoing support throughout the duration of our partnership. Your team will act as a dedicated resource to connect you with the right resources to solve any technical issues you may need support with.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: On day 1, requirements are gathered through discovery calls and demos of proposed solutions throughout the sales process, and once aligned, are transferred to the Customer Success team. During onboarding, we begin with a Kickoff call to introduce the solution and to present known goals and strategies. Our Professional Services team has a methodical and phased approach to launch projects, and will be with you from your first day to assist, deploy, train and enable your teams through industry-leading, implementation plans. We begin with Discovery, in which we conduct a thorough needs analysis to confirm best practices for our client's use cases and run through our project plan. We then conduct training, configure users, teams, access permissions and analytics, iterating with our client until sign-off. Hootsuite also provides support through an international team which operates in multiple timezones. Support is via email, phone or online chat. Your Hootsuite team will act as a dedicated resource to connect you with the right resources to solve any technical issues you may need support with.
• Service documentation: Yes
• Documentation formats: Other
• Other documentation formats: PPT
• Documentation accessibility standard: EN 301 549
• End-of-contract data extraction: If you decide not to renew your agreement, social media posts and alaytics reports can be exported by users directly from the Hootsuite platform. Users can export the content calendar (including scheduled drafts) as a PDF or CSV file. Users can export overview reports and custom reports to PDF, PPTX, CSV, and XLSX. Users can export Post Performance reports to PDF, CSV, and XLSX.
• End-of-contract process: If you decide not to renew your agreement your service will be downgraded. It is advised that you download analytics and posts as you will no longer be able to access these once your account is deprovisioned. Your Customer Success Team will guide you through this process.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Hootsuite's mobile app complements the web version of Hootsuite. It helps you stay on top of your social media tasks efficiently, no matter where you are. The Hootsuite mobile app is available for Android and iOS devices and can be downloaded for free from the app store. The minimum OS requirements are Android 5.0 and iOS or iPadOS 15. The Hootsuite mobile app doesn't support complex workflows that take more than a couple minutes. Tasks you must complete in the web version of Hootsuite include creating analytics reports, adding new team members, and managing your Hootsuite organization.
• Service interface: Yes
• Description of service interface: The Hootsuite Enterprise platform enables social media management users to spend less time managing tedious approvals, to answer customer inquiries faster, and to get consumer insights that let you run your business with confidence.
• Accessibility standards: EN 301 549
• Accessibility testing: Hootsuite is committed to making our website's content accessible and user friendly to everyone. If you are having difficulty viewing or navigating the content on this website, or notice any content, feature, or functionality that you believe is not fully accessible to people with disabilities, please contact our Customer Service team and provide a description of the specific feature you feel is not fully accessible or a suggestion for improvement. We take your feedback seriously and will consider it as we evaluate ways to accommodate all of our customers and our overall accessibility policies. Additionally, while we do not control such vendors, we strongly encourage vendors of third-party digital content to provide content that is accessible and user friendly. Hootsuite is committed to providing a respectful, accessible, and inclusive environment for all of our employees and customers in the Province of Ontario. Our goal is to meet the standards outlined in the province’s Accessibility for Ontarians with Disabilities Act (AODA) and to break down barriers to goods, services, and employment opportunities provided by Hootsuite. In order to achieve its goals Hootsuite has developed and implemented a variety of policies and procedures.
• User support accessibility: EN 301 549
• API: No
• Customisation available: Yes
• Description of customisation: The Hootsuite Enterprise platform has several modules available to help users meet their goals and objectives from social media management, customer care, monitoring, social advertising, advanced analytics and social listening. The Hootsuite Enterprise user interface can be configured for each user according to their own personal needs and also by admin users to ensure that all teams members have access to the content, channels and functionalities which they require.

Scaling

• Independence of resources: The services architecture is highly available and redundant as it is fully located in the AWS cloud, distributed across multiple AWS availability zones, and based on the Service Oriented Architecture (SOA) and Microservices architecture. AWS has wide regional and geographical redundancy and high scalability.

Analytics

• Service usage metrics: Yes
• Metrics types: Usage reports can be requested by customers at any time. Usage data is based on click events and other meaningful activities. For Customer Care users, users can view Team Metrics in Analytics to help Enterprise team admins see how their team is doing. Metrics include First Response Time, Handling Time, Resolution Time and more.
• Reporting types:
  • Real-time dashboards
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: Other locations
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Data can be exported by users at any time in PDF, PPT, XLS & CSV formats. With the Advanced Analytics add-on, users can Export CSV files of Advanced Analytics data to a dedicated Secure File Transfer Protocol (SFTP) folder and pull social data in a safe and secure way to utilise it with third-party business intelligence tools.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • PPTX
  • PDF
  • XLSX
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The Platform will have a Service Availability of at least 99.9% of the time in any calendar month (the “Service Availability SLA”), subject to interruptions due to our independent integration partners, including Twitter, Facebook, LinkedIn, YouTube, and other Social Networks and Third-Party Services and other circumstances beyond our control. ; ; Where reasonably possible, we will provide at least 24 hours' advance notice to Customer of scheduled maintenance in excess of 30 minutes. If we do not meet the Service Availability SLA, Customer will be eligible to receive the Service Credits described below. This Service Availability SLA states Customer's sole and exclusive remedy for any failure by us to meet the Service Availability SLA. ; ; This Service Availability SLA states Customer's sole and exclusive remedy for any failure by Hootsuite to meet the Service Availability SLA: -< 99.9% - >= 99.0% - 3 service credits (days of service added to end of contract term) -< 99.0% - >= 95.0% - 7 service credits (days of service added to end of contract term) -< 95.0% - >= 95.0% - 15 service credits (days of service added to end of contract term).
• Approach to resilience: Hootsuite has built-in resiliency provided through its hosting in the AWS cloud across multiple availability zones, and the AWS backup services.
• Outage reporting: Customers are updated on system status and outages through our status webpage, http://status.hootsuite.com/. We also post information on the @hootsuite_help Twitter feed.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
• Other user authentication: All users regardless of being an employee or a customer must authenticate prior to accessing any system. Customer can authenticate natively to the Hootsuite dashboard and use the optional two factor authentication or use the Single Sign On option. Employees with privileged access to the system must use two factor authentication (2FA/MFA) and those with access to the production environment must use additional authentication controls (such as specific AWS access keys, SSH certificates, etc.). Hootsuite supports native login to Hootsuite (which also supports two factor authentication) or it can also support SSO via SAML compatible system from the customer side.
• Access restrictions in management interfaces and support channels: Access to the production environment is possible only from the Hootsuite offices and from the VPN using SSH. For administrators to manage the AWS operational console, they must log in to the production console environment using two factor authentication. The administrator roles are assigned accordingly by the AWS IAM system. Privileged access is logged in all such systems and the Hootsuite Security Operations team has alerting set up to detect abuse.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Security policies reflect the security postures of Hootsuite and set the principles that Hootsuite employees, processes, and systems must adhere to. Security policies are also the major artifacts that we may share with our auditors for compliance purposes and with our customers for winning opportunities. The policies must be reviewed and updated annually to reflect current organizational status and to adhere with compliance requirements. The InfoSec GRC team is responsible for updating the policies at least annually. More information is available via our SOC 2 report (https://www.hootsuite.com/trust-center). Information Security Policy Asset Management Policy Configuration Management Policy Endpoint Policy Information Classification Policy Security Risk Management Policy Human Resource Policy Acceptable Use Policy Access Control Policy Cryptography Policy Physical & Environmental Security Policy Change Management Policy Network Security Policy Logging & Monitoring Policy Supply Chain Risk Management Policy Security Incident Management Policy Business Continuity and Disaster Recovery Policy Operations Backup Policy Password Policy Vulnerability Management Policy Bring Your Own Device (BYOD) Policy Secure Software Development Lifecycle Policy Password Construction Standard CoPilot policy.

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Hootsuite has formal, documented configuration and change management policies. Configurations are managed in code, version controlled, and require peer review and approval before implementation. Baseline configurations are regularly reviewed and updated, and new systems use pre-configured, hardened base images. Change management includes formal request, assessment, approval, deployment, and review steps, with segregation of duties and recorded approvals. Only authorized personnel can deploy changes, and emergency changes are documented and reviewed post-implementation. All processes align with industry standards and are included in SOC2 audits.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Hootsuite has a formal, documented vulnerability management program with regular scans of production infrastructure, laptops, servers, and container repositories. The program includes SAST, SCA, and DAST scans for application code and dependencies. Annual independent penetration tests and a public bug bounty program support continuous improvement. All processes are governed by policy, tracked for compliance, and supported by a dedicated Security Operations team that monitors threat intelligence.; ; Critical vulnerabilities are remediated within 14 days, high- 30 days, medium- 90 days, and low- 180 days. Information about potential threats is gathered from trusted threat intelligence feeds, public sources, and automated tools.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Hootsuite uses a combination of commercial and custom security-monitoring tools to provide comprehensive coverage and visibility over its technology infrastructure. Security logs are monitored 24/7 by both internal teams and a managed security service provider. Potential compromises are identified through real-time alerting, SIEM, and intrusion detection systems. When a potential compromise is detected, incidents are triaged, contained, and remediated according to a documented Security Incident Management Policy and Incident Response Plan. Impacted customers are notified without undue delay, typically within 72 hours. Incident response testing is performed annually to ensure effectiveness.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Post-quantum cryptography secure: No
• Incident management approach: Hootsuite has a formal, documented incident management program with pre-defined processes for common events, including preparation, detection, analysis, containment, eradication, and recovery. Employees are trained to report incidents to the Security team, and incidents can be logged via ticketing systems or directly to 24/7 on-call security personnel. Impacted customers are notified promptly, typically within 72 hours, and incident reports are documented, reviewed, and communicated to affected parties. The incident response plan and procedures are reviewed and tested annually for effectiveness.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: IAS Management Systems Certification Body Accredited
• ISO/IEC 27001 accreditation date: Thursday 18 January 2024
• What the ISO/IEC 27001 doesn’t cover: N/A. The scope covers All information security aspects related to the customer service delivery environment, involved in the entire lifecycle of our cloud platform services.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: Yes
• CSA STAR accreditation date: Tuesday 13 January 2026
• CSA STAR certification level: Level 1: CSA STAR Self-Assessment
• What the CSA STAR doesn’t cover: N/A
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 8a9057cd-a361-43a3-894a-84797638f485
• Cyber essentials plus: No
• Cyber Essentials Alternative: You do not have a current and valid Cyber Essentials Plus certificate, or will not have in place within 12 months of the date of award but have an IASME certified equivalent.
• Other security certifications: Yes
• Any other security certifications:
  • SOC 2 Type II
  • SOC 3

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
  • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Working conditions which promote an inclusive working environment and promote retention and progression
  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Gcloud@hootsuite.com. Tell them what format you need. It will help if you say what assistive technology you use.