Skip to main content

Beta Help us improve the Digital Marketplace - send your feedback

Policy in Practice

Multi Agency Safeguarding Tracker (MAST)

MAST is an online tool that joins up datasets to help safeguarding professionals make more informed safeguarding decisions. Automated and secure daily data feeds from multiple partner organisations operate under a single data governance framework to show how a customer has interacted across multiple services.

Features

  • Securely share data across safeguarding partners under one governance framework
  • Automate matching of individuals and locations across partners
  • Analyse interaction records by person, place, time. Download facility
  • Automated daily flows of data processed into the MAST database
  • Execute searches and access interaction records over 12 months.
  • Set alert criteria to receive automatic notification when interactions escalate
  • Single sign-on managed by an administrator within the partner organisation
  • Access on mobile/desktop browser via licence agreement per partner
  • Create comprehensive audit trails
  • Assess safeguarding requirements via rapid data sharing

Benefits

  • Quickly and simply provides a wide-view of safeguarding partner actions
  • Get a broader understanding of vulnerability using more information sources
  • Enable early identification of where early intervention may be required
  • Enable contact with other services to inform safeguarding decisions
  • Equip social workers to do faster lateral checks across agencies
  • Proactively flags households with multiple service contacts
  • Identify households that are placing high demands on services
  • Audit trail evidencing who accessed files and for what purpose
  • Receive up-to-date insights via automated daily data feeds

Pricing

£239 to £150,000 a licence a year

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@policyinpractice.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

8 7 5 8 6 4 5 9 4 4 3 6 7 0 4

Contact

Policy in Practice Deven Ghelani
Telephone: 0330 088 9242
Email: hello@policyinpractice.co.uk

Service scope

Software add-on or extension
No
Cloud deployment model
Private cloud
Service constraints
N/a
System requirements
  • Browser
  • Internet access

User support

Email or online ticketing support
Email or online ticketing
Support response times
Response times are typically within the hour
User can manage status and priority of support tickets
No
Phone support
Yes
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
No
Onsite support
Yes, at extra cost
Support levels
Service includes a half day of on-site/online training.
Additional time can be purchased.
Support available to third parties
Yes

Onboarding and offboarding

Getting started
Onsite training, online training, or user documentation
Service documentation
Yes
Documentation formats
  • HTML
  • PDF
End-of-contract data extraction
Our standard data retention terms are from the beginning of the contract to the termination and one year after. You can amend your data retention terms to delete all of your records within six months after contract termination at no charge.

Any alternative data retention policies need to be agreed with your account manager and will incur a management overhead that will need to be costed.
End-of-contract process
The service is delivered and there are no additional costs.

The buyer need only provide 45 days written notice if provided as an ongoing service.

Using the service

Web browser interface
Yes
Supported browsers
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
Application to install
No
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
Responsive design
Service interface
Yes
User support accessibility
WCAG 2.1 AA or EN 301 549
Description of service interface
Web-based user interface and SSO
Accessibility standards
WCAG 2.1 AA or EN 301 549
Accessibility testing
We run automated light house testing and had an independent accessibility assessor review all sites.
API
No
Customisation available
No

Scaling

Independence of resources
We use AWS lambda, cloudfront and ELBs to ensure maximum uptime with near limitless scalability.

Analytics

Service usage metrics
Yes
Metrics types
Management information and usage reports available within the product.
Reporting types
Reports on request

Resellers

Supplier type
Not a reseller

Staff security

Staff security clearance
Other security clearance
Government security clearance
None

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
No
Datacentre security standards
Managed by a third party
Penetration testing frequency
At least once a year
Penetration testing approach
‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
Protecting data at rest
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
Data sanitisation process
Yes
Data sanitisation type
Deleted data can’t be directly accessed
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
You cannot export data on this service
Data export formats
Other
Other data export formats
N/a
Data import formats
  • CSV
  • Other
Other data import formats
JSON

Data-in-transit protection

Data protection between buyer and supplier networks
TLS (version 1.2 or above)
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability
Where you are unable to use or receive the Services for a period of time in excess of 24 hours, we will, upon receipt of notice from you claiming the same, repay to you an amount equal to 50% of the Fees you have paid for such 24 hour period (calculated pro-rata). In order for this clause to take effect, you must notify us of such claim no later than 10 business days following the end of the applicable outage. Failure to provide notification by such date shall invalidate such claim and shall absolve us from any liability under this section to pay any such amounts. Those amounts stated within this section 8.1 shall be your sole remedy in respect of the Services being unavailable for any reason and, upon payment of such amounts or your waiving the right to receive such amounts by failing to make the relevant notification, we shall have no further liability.
Approach to resilience
Available on request.
Outage reporting
Email alerts

Identity and authentication

User authentication needed
Yes
User authentication
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
Access restrictions in management interfaces and support channels
Role Based Access Control
Access restriction testing frequency
At least every 6 months
Management access authentication
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
You control when users can access audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
At least 12 months

Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
QMS
ISO/IEC 27001 accreditation date
28/07/2021
What the ISO/IEC 27001 doesn’t cover
N/a
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Cyber essentials
Yes
Cyber essentials plus
Yes
Other security certifications
No

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
ISO/IEC 27001
Information security policies and processes
Document and available upon request as PDF / word document.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Processes are regularly updated by our CTO and Director of Operations, with external support/input on a regular basis.

We operate industry-standard continuous integration and deployment approaches aligned to the Accelerate/State of DevOps research and recommendations. We use infrastructure as code managed in source control.

At the networking infrastructure level, we rely on AWS for change management processes.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Processes are regularly updated by our CTO and head of operations, with external support / input on a regular basis.

We make use of github dependabot alerts. Regular automated deployments ensures updates and security patches are incorporated as a matter of course. We actively develop our software and ensure that vulnerabilities are patched via the dependency management system.

At the networking infrastructure level, we rely on AWS for security patching.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
Processes are updated by our CTO and Head of operations with external input on a regular (at least annual) basis.

At the networking infrastructure level, we rely on AWS for protective monitoring processes and use AWS GuardDuty to monitor for suspicious behaviour. We additionally employ a SaaS monitoring solution at the application level.
Incident management type
Supplier-defined controls
Incident management approach
Processes are updated by our CTO and Head of operations with external input on a regular (at least annual) basis.

At the networking infrastructure level, we rely on AWS for incident management processes.

We have a documented internal management and incident response process.

Secure development

Approach to secure software development best practice
Conforms to a recognised standard, but self-assessed

Public sector networks

Connection to public sector networks
No

Social Value

Social Value

Social Value

  • Covid-19 recovery
  • Tackling economic inequality
  • Wellbeing

Covid-19 recovery

By using MAST organisations can improve the physical and mental health of people affected by COVID-19 and by streamlining and improving the social care system can reduce the demand on health and care services.

In some organisations, new ways of working are required post-COVID-19. We deliver an innovative and streamlined new way of working for local authorities and advice organisations to provide a simple and consistent approach to supporting vulnerable residents.

The calculator can improve the health and wellbeing of residents by improving their financial strength and providing them with support that they did not know was available to them. Improving their health and wellbeing can often lower the demand on health and care services.

Tackling economic inequality

MAST is an innovative technology that delivers lower costs and increases the quality of social car services for the most vulnerable. The system modernises methods and service delivery and increase productivity.

Wellbeing

he use of the MAST platform supports health and wellbeing of vulnerable residents by collaborating with local safeguarding partners to identify and engage with those that may need further support from social care.

The collaboration between local authorities, health, public health, police and fire supports strong, integrated communities.

Pricing

Price
£239 to £150,000 a licence a year
Discount for educational organisations
No
Free trial available
No

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@policyinpractice.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.