Arch

Looply

Looply connects SAP and other enterprise systems to Microsoft Teams, delivering actionable approvals, notifications and data collection through interactive cards. Users review business information and respond in Teams, while decisions update the source system. This managed cloud service supports faster, more transparent business processes without replacing existing SAP controls.

Features

• SAP ECC and S/4HANA integration with Microsoft Teams
• Interactive Teams Adaptive Cards for approvals and data collection
• Automated notifications, alerts and business process updates
• Approval decisions and comments returned to source systems
• Supports SAP purchasing, HR, finance, MDG and GRC scenarios
• Configurable business process orchestration with low-code Workflow Studio
• Visual Adaptive Card design with AI-assisted templates
• Notifications Centre for tracking pending and completed actions
• Secure integration with Microsoft Entra ID
• Managed, dedicated or customer-owned AWS cloud deployment options

Benefits

• Accelerates approvals without requiring users to open SAP
• Reduces delays caused by unread email notifications
• Gives decision-makers relevant data and supporting documents
• Improves visibility of outstanding actions and process status
• Preserves SAP authorisations, business controls and audit records
• Reduces manual chasing across departments and teams
• Supports existing SAP processes without extensive redesign
• Simplifies access for occasional and non-SAP users
• Enables incremental adoption across multiple business processes
• Supports SAP clean-core principles during S/4HANA transformation

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at archaccounts@arch.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

887018148278737

Contact

Henry Blythe
+447968616464
archaccounts@arch.co.uk

About the service

• Service categories:
  • Applications
    • Collaborative
      • Team collaboration
        • Team collaboration
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes
• What software services is the service an extension to: SAP, Coupa and Microsoft Teams. We expect more services to be added in 2026 and beyond.
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: Please refer to the Arch-global.com website for the currently supported systems.
• System requirements:
  • Looply runs on AWS
  • Microsoft Teams

User support

• Email or online ticketing support: Yes
• Support response times: Depending on the severity of the incident but within 2 hours for Priority 1 tickets.; We don't offer weekend support.; Users can manage status and priority of support tickets.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: No
• Support levels: We provide product and & consulting support via our website during UK business hours. Software product support is provided as part of the subscription cost. Clients can additionally contract with us for telephone and remote application consulting support via a call-off arrangement. We provide an account manager and technical support manager to our customers.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We offer a full service to enable on-boarding which users can customise to reflect their own needs and resource availability.; ; This includes onsite training, online training, and user documentation from the Looply support site.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: The documentation is available on the Looply Academy to support screen readers and other accessibility capabilities.
• End-of-contract data extraction: Only transient data is held on Looply and no data is held solely there. So at contract end there is no data to extract.; ; Client data is deleted after the end of the contract.
• End-of-contract process: As end of contract needs differ, as do client capabilities, we work with clients to end their use of Looply efficiently. We make a reasonable charge for any consulting work required at contract end based on the scale of work we are asked to perform.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The service is delivered in MS Teams to the user so functionality differences are those of Microsoft, if any.
• Service interface: Yes
• Description of service interface: Looply has a dashboard for administrators to use.
• Accessibility standards: None or don’t know
• Description of accessibility: Looply is a web application. ; ; Access to the dashboard is controlled by role definition.
• Accessibility testing: None.
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: Users use the Looply API to integrate their target line-of-business system and MS Teams.
• API documentation: Yes
• API documentation formats:
  • HTML
  • Other
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Users can build their own Adaptive Cards, business workflows and additional communication channels like SMS and email.; ; We provide user guides, technical documentation and FAQs on the support site.

Scaling

• Independence of resources: Looply is built on AWS serverless architecture that responds dynamically and without limit to varying demands.

Analytics

• Service usage metrics: Yes
• Metrics types: Looply includes a comprehensive metering service and dashboard to analyse use.
• Reporting types:
  • Real-time dashboards
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: User data is provided on request via the Looply website.
• Data export formats: Other
• Other data export formats: JSON
• Data import formats: Other

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: As per our Ts and Cs we will make commercially reasonable endeavours to make Looply available 24 hours a day, seven days a week, except for:; planned maintenance carried out during the agreed maintenance windows, unscheduled maintenance performed outside UK normal business hours, provided that we have used reasonable endeavours to give the customer at least six notice in advance; and any emergency maintenance as required, provided we provide prompt notice of any emergency maintenance to the Customer.; Enhanced support services may be available under separate agreement with us.; We will negotiate refunds and SLCs with customers as required.
• Approach to resilience: This information is available on request.
• Outage reporting: Email alerts

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is restricted through role-based access control (RBAC) mechanisms. Only authorized personnel have access to these interfaces based on their specific roles and responsibilities within the organization. This ensures that only individuals with the appropriate permissions can perform administrative tasks or access sensitive information.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: No
• Security governance approach: 1. A risk-informed approach; assessing threats and potential impacts to prioritize our security efforts.; 2. Defined roles and responsibilities for decision-making, risk management, and incident response for transparency and effective oversight.; 3. Cyber security governance is aligned with our goals for Looply. We recognize that managing cyber risk impacts various aspects of our business, including strategy, development, and customer experience.; 4. We regularly review and monitor our cyber security efforts and review risk assessments, incident response plans, and security performance.; 5. We ensure that everyone in the company understands cyber risks and their implications via regular training and awareness programs.
• Information security policies and processes: These policies and the reporting structure are set out in our document:; ; " Arch : Information Security Policy & Security Standards Handbook"; ; Section 10; ; This document is available on request.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Yes, Looply follows a robust change control policy and procedure to manage changes to its AWS-hosted SAAS application. This includes:; Formalized change request process through AWS services, such as AWS CloudFormation or AWS CodePipeline, ensuring documentation, impact assessment, and version control.; Classification of changes into standard changes, implemented through automated pipelines, and emergency changes, which undergo expedited review and approval by designated authorities.; Segregation of duties between personnel authorizing changes, typically product owners or project managers, and personnel implementing changes, often developers or DevOps engineers, ensuring accountability and oversight.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We conduct regular VAPT exercises to identify security weaknesses and vulnerabilities in applications. This includes both automated scanning and manual testing by skilled penetration testers.; We deploy patches within 2 working days; We derive information on potential threats from activity on the service, and suppliers (AWS and MS) alerts and notification service.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: We exploit AWS protective monitoring tools for incident response.; On discovering a compromise we trigger our incident response procedure, which sets out action based on the level of exposure.; From 3 working hours for the highest priority incidents to 5 working days for the lowest.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Post-quantum cryptography secure: No
• Incident management approach: We do not have pre-defined processes for common events.; Users make reports via our website.; We distribute reports by email.

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Included:; 1 system integration and 10 users; Not included; Implementation services, if required.; Time limitation: 2 months.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 5%
• Between £250,000 and £500,000: 7%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 15%
• Between £2,500,001 and £5,000,000: 25%
• Over £5,000,001: 35%

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 1dd26f33-230b-4e9a-881e-1f16477137d5
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Plans to engage the contract workforce in deciding the most important workplace issues to address
  • Ensuring new workers are informed of their right to join a trade union
  • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
  • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Activities to cascade good practice on fair working conditions throughout the supply chain
  • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at archaccounts@arch.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.