TRANSUNION INTERNATIONAL UK LIMITED

TransUnion - Device Risk - TruValidate

TransUnion and TruValidate enable clients to undertake digital verification and risk assessments in real time. Three solutions exist: ‘Risk’ to assess the fraud risk of an email, mobile or device; ‘Trust’ to find associations between identities and emails and/or mobiles; and ‘Authentication’ to link a device to a customer account.

Features

• Emailage is used to deliver Email Risk
• Telesign is used to deliver Mobile Risk
• Iovation (a TransUnion Company) is used to deliver Device Risk
• Iovation (a TransUnion Company) is used to deliver Device Authentication
• 34 million known or suspected email frauds
• 65 million known device frauds
• Find associations between identities and emails/mobiles
• Link a device to a customer account
• Can be built into a TruValidate scorecard
• Deliver raw data for decisioning

Benefits

• Single integration with TruValidate/TransUnion
• Realtime risk assessment of an email, mobile or device
• Email and Mobile Risk can be taken in isolation
• Device Risk and Authentication are not linked to identity check
• Help to avoid impersonation and synthetic ID fraud
• Deliver a friction right customer journey
• Output raw data, score and segment for decisioning
• Complete digital risk assessment in an online world
• Verify emails/mobiles are associated with an identity
• Accelerate your digital transformation projects

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at mark.pestereff@transunion.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

850623407076406

Contact

Mark Pestereff
07773 212093
mark.pestereff@transunion.com

About your service

• Service categories:

  Application Development and Deployment

  Analytics and business intelligence

  • Business Intelligence
  • Advanced and predictive analytics
  • Location and geospatial data management and analytics
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Identity Verification;; Knowledge Based Verification (KBA/KBV);; Bank Account, Debit Card and Credit Card Verification;; Email, Mobile, Device Verification and Risk;; Mobile Ownership Verification and Mobile KYC;; Document Verification and Facial Biometric
• Cloud deployment model: Private cloud
• Service constraints: Please refer to the Service Definition
• System requirements:
  • Web service option requires internet browser
  • API option requires ability of client system to accept APIs
  • Batch option requires files loading on TransUnion Secure FTP

User support

• Email or online ticketing support: Yes
• Support response times: We have a range of SLA's depending on the nature and criticality of the ticket; full details can be agreed as part of any contract.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Sales, Client Management and Client Service Desk support available.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: You will be provided full supporting documentation and have access to our team of experts who will be available to help with the initial integration, setup and scorecard configuration. Training is available at an additional cost.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: Not applicable
• End-of-contract process: The contract ends and access to the service is disabled.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Documentation is emailed to users and user guides are downloadable from the software tool.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: TruValidate enables clients to digitally verify an identity, in real time, using the latest TransUnion credit bureau, electoral roll and public bad debt data. TruValidate is highly flexible, configurable, and modular, enabling clients to meet their identity verification challenges, aligning with their identity risk appetite, helping achieve better KYC. This can be delivered via a web interface to users. Online/Web log in is via individual username and password credentials.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: The latest TruValidate platform has been designed and built with user experience in mind, focusing on simplicity of search function and retrieval and display of complex results. TransUnion’s global product development policy is to achieve at least WCAG 2.2 AA compliance, and we utilise industry-standard accessibility tools such as axe, Wave and Lighthouse to help identity and fix accessibility issues.
• API: Yes
• What users can and can't do using the API: Integrate search capability with client services and software. Carry out the same searches as via the web browser version.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Customers can select which TruValidate modules they wish to take. The scorecard delivering the search results can be customised based upon these modules and the customers appetite for risk.

Scaling

• Independence of resources: Through capacity planning and monitoring of service use, TransUnion have the capacity to cope with increasing demand of users.

Analytics

• Service usage metrics: Yes
• Metrics types: Number of searches used, service availability and response times.
• Reporting types:
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: • Strong logical access control. Access is given based on least privilege and a need to know basis.; • Protective monitoring and event management using Splunk as a SIEM.; • Sourcefire & Palo Alto IDS.; • Checkpoint firewalls.; • Monthly vulnerability scanning programme of work.; • ISO27001 and PCI DSS compliant.
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Degaussing
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: Reports can be saved as PDF documents.
• Data export formats:
  • CSV
  • Other
• Other data export formats: PDF
• Data import formats:
  • CSV
  • Other

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • Other
• Other protection between networks: Web Application Firewall, IP Safe Listing, SSH key Pairs (for automation), complex password policy, Threat Detection Service team
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: Data Loss Prevention, Privileged Access Management, Data Encryption at Rest, SIEM Alerts and Monitoring, Anti-Virus and EDR, Firewalls and VPN's

Availability and resilience

• Guaranteed availability: Our standard availability is 98.5%. We would be happy to discuss any specific availability requirements as appropriate.
• Approach to resilience: We have multiple support staff available and multiple, scalable platforms which support the service.
• Outage reporting: The Client Support Team and/or Client Manager would notify affected clients via email or phone as appropriate.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Username or password
  • Other
• Other user authentication: Each user will have a unique username and password provided along with company name. TransUnion also utilises the control of IP white listing and 24/7 security monitoring.
• Access restrictions in management interfaces and support channels: A policy of least privilege access is applied across the group to ensure employees only have access to what is required - this is regularly reviewed. Any privileged accounts are rigorously checked both prior to granting access, during use and on termination of permissions. Users come under multiple levels of policy regarding accounts and device usage. Networks are highly segmented with monitoring for inter-segment violations. Any sensitive systems are housed in dedicated secure environments.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Username or password
  • Other
• Description of management access authentication: All management accounts must go through TransUnion privileged access management, which limits access based on security groups and only provides the required access. Usernames and Passwords are domain managed and follow the TransUnion Password Policy.

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Cyber Essentials Plus; PCI DSS; SOC2
• Information security policies and processes: TransUnion follows a dedicated Information Security Policy, as well as other processes such as data encryption and key management and secure application development.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: TransUnion defined product development lifecycle, which includes various gates including budget, security and IT infrastructure. All changes are captured within our internal ticketing system.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Internal scans are completed on a regular basis (Daily, Weekly, Monthly depending on the endpoint). All Critical findings must be addressed within 15 days, High 30 days, Medium 60 days and Low 120 days. Any findings that cannot meet these deadlines must have a risk acceptance review and a deadline agreed by the business.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Threat Detection Service, Data Loss Prevention team, Incident Management team - All monitoring 24/7/365
• Incident management type: Supplier-defined controls
• Incident management approach: We follow the following standards and processes for incident management - NIST 800-61 and SANS PICERL
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Proof of concept trial for defined number of users, searches and duration may be available by agreement.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 2%
• Between £1,000,001 and £2,500,000: 5%
• Between £2,500,001 and £5,000,000: 5%
• Over £5,000,001: 8%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Payment Software Company (PSC)
• ISO/IEC 27001 accreditation date: Tuesday 28 May 2024
• What the ISO/IEC 27001 doesn’t cover: The aforementioned organization has a perpetual responsibility to maintain compliance with ISO/IEC 27001:2022 during the period of certification. ; 2. This certificate is subject to the satisfactory completion of annual surveillance audits by Payment Software Company, Inc.; 3. ISO/IEC 27001:2022 compliance audits are not designed to detect or prevent criminal activity or other acts that may result in an information security breach. As such, this certification should not be ; construed as a guarantee or assurance that an organization is unsusceptible to information security breaches.; 4. The information in this document is provided “AS IS”, without warranties of any kind. Payment Software Company, Inc. expressly disclaims any representations and warranties, including, without ; limitation, the implied warranties of merchantability and fitness for a particular purpose. ; 5. This certificate is the property of Payment Software Company, Inc. and is bound by the conditions of contract. The authenticity of this certificate can be validated by contacting Payment Software ; Company, Inc
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Nqa
• ISO 9001 accreditation date: Monday 30 October 2000
• What the ISO 9001 doesn’t cover: This registration is subject to the company maintaining a quality management system, to the above standard, which will be monitored by NQA
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: Payment Software Company
• PCI DSS accreditation date: Wednesday 3 September 2025
• What the PCI DSS doesn’t cover: As per our certificate
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 4eee262c-1869-4f49-a93b-526a37671a3e
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 3c238a5f-4d7f-4d21-b42f-177823f8fcd0
• Other security certifications: Yes
• Any other security certifications: ICO Data Protection Registration

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Ensuring new workers are informed of their right to join a trade union
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Ensuring accessibility to contracting and subcontracting opportunities for disabled business owners and employees
    • Structuring of the supply chain selection process to ensure fairness (e.g. anti-corruption) and encourages participation by a diverse range of businesses, including with regard to new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutual
    • Methods for engaging with different parts of the community (including the education system and charities representing the community) and how communities come together to inform decisions, strategy and projects to leave a positive legacy for future generations
    • Plans for positive actions with community groups.
    • Measures for making facilities used in the delivery of the contract available for community groups, education or training
    • Plans to respond flexibly and adapt approaches to community engagement and initiatives
    • Support for community-led initiatives relevant to the contract. Illustrative examples: improving transport links; reducing loneliness; helping with English language proficiency; and facilitating social mixing among people with different backgrounds
    • Collaborating with anchor institutions and community groups to make facilities available for education, training or community events

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors
    • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Collection of the views and expertise of disabled people and their representative organisations on successfully supporting disabled employees or applicants
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Other measures to provide equality of opportunity for disabled people and those with health conditions into employment, including becoming a Disability Confident employer and inclusion of supported businesses in the contract supply chain
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
    • Understanding of issues relating to entering the contract workforce
    • Creation of outreach activities to create a pipeline of employees for the future contract delivery
    • Content of the outreach activity is designed to suit the target cohort
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at mark.pestereff@transunion.com. Tell them what format you need. It will help if you say what assistive technology you use.