VELOCITI SOLUTIONS LIMITED

RailSmart

RailSmart offers digital solutions for rail freight, passenger operators and supply chain. It aids management of incidents, operational safety, compliance, competency, risk and more. Users can securely distribute documents and create rosters, whilst data insights and analytics help your business to reduce incidents and improve safety, efficiency and performance.

Features

• Proactive competency management
• Create validated rosters and manage fatigue and risk
• Distribute documents and confirm receipt with acknowledgement
• Build and distribute forms
• View journey performance and capture reasons for delay
• Create and submit train consists straight to TOPS
• Create incidents and defects, and assign actions
• Comprehensive reporting
• Mobile friendly network map with accessibility information and alternative routes
• Communicate incident information via social media

Benefits

• Maintain safe working practises and reduce incident rates
• Effective resource planning and optimisation
• Communicate key information with confidence
• Securely capture data
• View train running performance to optimise journey
• Improve performance, accuracy, traceability and quality of train consists
• Effective incident management
• Optimise business using data insights
• Keep passengers informed with disruption and station information
• Create, manage and share timetable data

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@omnibus.uk.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

881830556951836

Contact

Josh Mellor
+44 1527 556940
tenders@omnibus.uk.com

About your service

• Service categories:

  Applications

  Production and operations

  • Other operations
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Routine server maintenance is performed in a regular window on Tuesday evenings after 10pm, with any software deployments requiring downtime performed by prior arrangement before 9am on a weekday morning. Mobile applications are supported on current versions of iOS/Android and 2 previous versions. Due to the wide range of Android devices available we maintain known reference devices which can be added to on request.
• System requirements:
  • Mobile applications: iOS or Android
  • Web application: Recent supported web browser
  • Supported on current and previous 2 operating systems releases

User support

• Email or online ticketing support: Yes
• Support response times: Standard Support provides office hours support in line with agreed SLAs for any issues raised according to the following SLA: P1: Critical - Response within 1 business hour, Resolution Plan within 2 business hours. P2: High - Response within 1 business day , Resolution Plan within 2 business days. P3: Medium - Response within 2 business days, Resolution Plan within 5 business days. P4: Low - Response within 3 business days. Extended Support Hours (evening and weekends) for P1 and P2 incidents available at extra cost.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Support is provided in house by Software Support Analysts technically trained in our applications and knowledgeable about your business sector.; ; Standard Support levels do not include evening, bank holiday or weekend cover. Extended support hours can be contracted at a premium for P1 and P2 severity incidents in line with standard response times.; ; We offer a 2nd Line Service as standard with the expectation that the customer provides 1st line triaging and support for their users. 1st Line Support can be offered by Velociti at extra cost.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Velociti have a robust, tried and tested onboarding process that has been continually improved using lessons learnt from previous implementation projects. ; ; The process consists of five main stages. In the first Analysis and Planning stage the project plan is agreed, teams identified and project governance is outlined. We begin aligning the software to current business processes and undertake data mapping exercises. ; ; During the Software Set Up stage we provision a specific instance of the software and undertake the necessary data configuration and import. ; ; In the third stage we undertake internal and client testing. This involves a collaborative pilot where feedback is gained from a small group of end users. ; ; In the fourth stage we will work with the client to devise an engagement and training strategy that caters to the specific needs of the business. This an include face to face training, distance learning or a blended approach. ; ; During the final stage, the software is rolled out across the business. We will work with the client every step of the way to ensure the transition is as smooth as possible. We pre-define communication strategies and collaboration for the early life support period.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: On contract end, by request, a database export of all company data within the system can be provided
• End-of-contract process: Upon contract end, all client data is hard deleted within 6 months.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Project Manager, Account Manager, Support Portal for Self-Serve

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
  • Safari
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: For the products which have companion apps (EDS, IM and SafeTrack), these are aimed at end users, allowing them to access and input data such as submitting assessments, recording incidents and defects and reading documents. While the web versions generally also include these features, they also have admin tools such as user management, reporting and more.
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: Our products give clear visibility of data ranging from employee competencies, to incidents and defects, route maps and rosters. Data tables provide overviews which can be filtered and sorted, while reporting dashboards available in the majority of our products give business insights. The web apps make managing this data easy, allowing creation, editing and deletion. Where we have companion mobile apps, users can easily access the data they require on the move, uploading consists, delay reasons, assessments and more.
• Accessibility standards: None or don’t know
• Description of accessibility: Our products vary in accessibility, and is something which we are continuously improving. Overall, they partially support 10.2.7 Info and Relationships, 10.2.8 Meaningful Sequence, 10.2.10 Use of colour 10.2.14 Images of Text, 10.2.9 10.2.13 Resize Text, Three Flashes or below threshold and 10.2.21 Document Titled, 10.2.37 Parsing, 10.2.28 Name, Role and Value, 10.2.5 Headings and Labels, 10.2.23 Link purpose, 10.2.33 Error Identification, 10.2.34.; ; In general our products do not support 10.2.15 Keyboard, 10.2.16 Keyboard Trap, 10.2.26 Focus visible, 10.2.27 Language of Page.; ; Remaining criteria do not apply to the content or structure of our products.
• Accessibility testing: Internal accessibility testing
• API: Yes
• What users can and can't do using the API: Users can request access to the RailSmart API which currently provides data from EDS. Once this is set up by us on behalf of the user, they can then access and update a wide range of EDS data, from assessments and users to competencies etc.
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Buys can request customisations to meet their specific business requirements on a product by product basis at an extra cost. ; ; Requirements are agreed following a discovery workshop and delivered via a robust project methodology.

Scaling

• Independence of resources: We ensure independence of resources through separation, capacity management, and monitoring to prevent one customer’s demand from impacting others.

Analytics

• Service usage metrics: Yes
• Metrics types: Within our applications, reporting dashboards give insights into behaviours and trends within the system which can be used to measure operational business goals and provide insights into behaviour, as well as allowing easy monitoring of compliance with relevant policies. Monthly service reports can be provided detailing service desk engagement statistics, along with additional user behaviour information taken from a suite of Analytics services integrated into our platforms. Custom reports are available on request through the service desk on an ad hoc or regular basis.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Users request data access through their internal designated RailSmart admin who raises a ticket with our support team. The exported data is then provided by our a support team in an encrypted, password protected zip file.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The Target availability for this application is 99.5%, excluding agreed maintenance periods. For the avoidance of doubt the calculation of Availability will be: (Number of days in period) x 24 – (Cumulative hours down time for such period) / Number of days in period. There is a sliding scale of License Fee reductions applicable to the period starting at 10% should availability drop below 99.5%, 20% below 97%, and 25% should availability drop below 95%.
• Approach to resilience: Full details of service resiliency are available on request. As a basic principle all our solutions are hosted using high performance enterprise cloud solutions backed by service availability guarantees, ensuring the underlying infrastructure SLAs exceed the service SLAs. All services are provisioned with automatic backups to enable restore from total loss to be made in a timely fashion, and critical components are deployed in a resilient fashion where possible. Extensive system monitoring is in place to alert engineers in the event of any problems being identified.
• Outage reporting: Service Outages are reported by email alerts and follow up phone calls where the applications in question are critical to the business of the customer. Certain applications with dependency on third party systems additionally contain alert banners within the system to notify of any degraded service provision as a result of external factors.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to the system is controlled by user accounts with role based permissions. Access to certain user data can be further restricted based on the organisational hierarchy. Access to our support ticketing system is limited to a pre-defined list of users, who access the service username and password. These user accounts are created as the service moves from Early Life Support (ELU) to Business as Usual (BAU).
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: As part of our ISO27001 certification, Velociti implemented an Information Security Management System which consists of a number of controls including policies and processes to control our information security risks. Our in house, cross departmental compliance team own the ISMS and are responsible for designing and implementing appropriate policies and procedures. All staff are trained on these when they join the organisation, with direct line managers responsible for ensuring they are followed. Any staff found not following these policies or procedures are dealt with inline with our disciplinary procedure. In order to verify our policies are followed, internal audits are conducted monthly by an individual who is independent of the compliance team and is appropriately trained.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: All work undertaken on our products follows our Secure Development Lifecycle Policy. This ensures security is considered from initial conception and then validated prior to deployment to a production environment. Steps we take to assess potential security impacts include threat models on the infrastructure and vulnerability scanning. Prior to deployment to a production environment, our applications are subject to a thorough functional testing process to ensure there are no critical defects that may impair our end users.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Information about potential threats is sourced through subscriptions to vendor and industry notification services, and these are assessed for risk based on potential impact and likelihood. Where the risk is high we will take immediate steps to mitigate the risk and deploy a patch as soon as practical. For all risks which do not exceed the threshold patches will be deployed on a monthly basis within a predefined maintenance window.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We employ passive monitoring on our servers, monitoring items such as: Disk, CPU and Memory usage. Should these certain level above our standard threshold, alerts are triggered to key personnel who can immediately investigate. At Velociti we employee a major incident and data breach process that staff are aware of, which is to be followed in the event of an incident. These processes also include the client communication process, ensuring impacted clients are notified as soon as possible.
• Incident management type: Supplier-defined controls
• Incident management approach: 2 distinct incident management processes; 1 for major incidents (classified as outages to the system or any defect in production categorised as 'Critical) and a second specifically to handle data breaches. Defects are initially identified via our support or IT teams and my come from a client or internally. Once it has been triaged and established as a Critical issue (a P1), the issue is escalated to director level and appropriate resource is assigned to investigate and resolve the issue. Once resolved, incident reports are provided to clients in written form.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Assessment Bureau
• ISO/IEC 27001 accreditation date: Tuesday 28 October 2025
• What the ISO/IEC 27001 doesn’t cover: The certification does not cover customer infrastructure or environments, third-party platforms beyond our control, or services that fall outside the scope of our ISO/IEC 27001 certification; however, all such areas are managed through documented risk assessment, supplier management, and contractual controls.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: British Assessment Bureau
• ISO 9001 accreditation date: Tuesday 28 October 2025
• What the ISO 9001 doesn’t cover: The ISO 9001 certification does not extend to customer-controlled environments, third-party services outside our direct control, or services outside the defined scope of our quality management system.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: You do not have a current and valid Cyber Essentials Plus certificate, or will not have in place within 12 months of the date of award but have an IASME certified equivalent.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
    • Understanding of issues relating to entering the contract workforce
    • Creation of outreach activities to create a pipeline of employees for the future contract delivery

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@omnibus.uk.com. Tell them what format you need. It will help if you say what assistive technology you use.