Xn Leisure Management Systems
Xn Leisure supply best-in-class leisure management software to streamline operations, providing exceptional customer journeys for bookings, ticketing, courses, membership sales and self-service. Our solutions simplify business oversight and day-to-day management, with tools to track services, transactions, inventory, and generate reports and KPI's for effective data-driven decision making and cost reductions.
Features
- Intuitive EPOS solutions with concierge front of house functions
- Brandable online self-service registration, Membership, Booking, Ticketing and Courses
- Chip and Pin, online, paperless BACS and Recurring Card payments
- Comprehensive bookings management for courts, spaces, classes, resources and staff
- Course management including handheld registers and online portal
- Fast track and kiosk self-service including payments
- Open API and superb integration capabilities
- Event ticketing, management, online, mobile bookings and payments
- KPI, business intelligence, audit and analytics reporting including datahub integration
- Access control, turnstiles, doors – biometric, RFID, magnetic, QR options
Benefits
- Complete self-service for customers reduces member and booking administration
- Kiosk self-service reduces staffing costs, increases throughput
- Innovative front of house solutions improves customer satisfaction & throughput
- Simple wizard based web membership and prospecting
- Accept any payments cash, contactless, recurring card and BACS payments
- Fast bookings interface speed up processing and throughput
- Secure access control by facial recognition, thumbprint, smartcard, QR, Barcode
- Course reception, teacher and home portals digitally link to customers
- Modern ticketing platform, grows your business & reduces operating costs
- Web based KPI’s, management reports, dashboards - effective data-driven decisions
Pricing
£125 a licence a month
Service documents
Request an accessible format
Framework
G-Cloud 14
Service ID
9 0 5 3 6 5 2 5 0 5 8 1 6 2 0
Contact
XN LEISURE SYSTEMS LIMITED
XN LEISURE SYSTEMS LIMITED
Telephone: 0345 512 0004
Email: tenders@xnleisure.com
Service scope
- Software add-on or extension
- No
- Cloud deployment model
-
- Public cloud
- Private cloud
- Community cloud
- Hybrid cloud
- Service constraints
- The solution is a Microsoft Azure and a Microsoft OS based solution although all web components are operating system agnostic and will work on any recognised browser. Although a cloud platform Xn need to sign off all connected hardware to ensure compatible via a technical sign off meeting via Microsoft Teams or onsite meeting.
- System requirements
-
- Min OS Windows 10 / Recommended Windows11 (64 bit)
- Microsoft Remote Desktop Web Access used for EPOS access
- All hardware items on site must be IP based
- Min Browser(Version), Firefox(27), Chrome(30), Explorer(11), Edge(any), Opera(17), Safari(7)
- A VPN is required for integration with IP based devices
- Web Cams USB device redirection required on all workstations
- Min Dedicated 50Mbps SDSL lines required
- Maximum latency result of 200ms per workstation
- 128kbits download & upload for each customer facing PC
- Prerequisites document provided by Xn for hosting platform sign off
User support
- Email or online ticketing support
- Email or online ticketing
- Support response times
- Xn provide a single software and hardware support service from 7.00am until 22.00pm 7 days a week, 364 days a year. Standard SLA's - Priority 1 tickets and calls are responded to within an hour (with a 4 Hours target fix), Priority 2's have a 4 hour response (and an 8 Hours target fix), P3's include any general or non-urgent question will be responded to within one working day with any minor software or cosmetic issues that are not stopping the operation will be provided in future software releases using the Product Enhancement Request Tickets process.
- User can manage status and priority of support tickets
- Yes
- Online ticketing support accessibility
- WCAG 2.1 AAA
- Phone support
- Yes
- Phone support availability
- 9 to 5 (UK time), 7 days a week
- Web chat support
- No
- Onsite support
- Yes, at extra cost
- Support levels
- Xn provide a single software and hardware support service from 7.00am until 22.00pm 7 days a week, 364 days a year. P1 tickets are progressed throughout the day P2 & P3 calls are progressed 8.00am until 18.00pm. Support tickets and phone calls are accepted, email based tickets are not supported. Our Microsoft Azure platform is supported and monitored 24 hours per day. Customer web support portal allows customer issue tracking and management including customer portal 24 hours a day. Support included in the service price. On site engineer support is charged at standard day rates. Technical account management is carried out by the Account Manager and staff via regular review meetings on site or via virtual meetings.
- Support available to third parties
- Yes
Onboarding and offboarding
- Getting started
- Xn use a refined Prince2 methodology to deliver projects. Technical Consultants confirm prerequisites prior to the implementation, mitigating risk of unfinished installation or project delays. Once the Azure product is set up the Technical Consultant will hand over to both the Xn and client Project Managers. Once the base installation is complete the training can take place which is delivered by the Xn Project Managers providing continuity and a single point of contact. Core training and system set up takes place onsite at a preferred classroom environment. Projects use a blended approach with both onsite and online training as we appreciate this offers the best learning experience for delegates. Xn initially train a build team; who in turn disseminate training to operational staff. Alternatively, Xn can provide workshop training to the operational staff if required. A full library of documentation including syllabuses, interfaces and technology documents are provided as part of the service. The support and technical departments offer advice, knowledge bases, product Wikis and training manuals for all areas, as part of our partnership approach. Xn can cooperate and provide training videos that can include both the software training and operational procedures and changes.
- Service documentation
- Yes
- Documentation formats
-
- ODF
- End-of-contract data extraction
- Xn will provide full database set to the client in the format and media preferred and secure delivery method required by each client.
- End-of-contract process
- Full off boarding is included within the contract and a contract end meeting will be held to agree final arrangements for end of closure taking into account any changes that may have occurred during the contracted period.
Using the service
- Web browser interface
- Yes
- Supported browsers
-
- Internet Explorer 11
- Microsoft Edge
- Firefox
- Chrome
- Safari
- Opera
- Application to install
- Yes
- Compatible operating systems
- Windows
- Designed for use on mobile devices
- Yes
- Differences between the mobile and desktop service
- Leisure Hub is a fully responsive online solution designed to ensure the web pages render perfectly on any device, window or screen from minimum to maximum display size to ensure usability and satisfaction for both desktop, tablet or smartphone. It is completely hardware and OS agnostic. In addition, the Leisure Hub can be integrated into 3rd party apps via superb API capabilities.
- Service interface
- Yes
- User support accessibility
- WCAG 2.1 AAA
- Description of service interface
- Online customer facing web sites and web components are fully brandable and customisable web pages. On site EPOS and Management service UI are provided via Remote Desktop Web Access, enabling users to access RemoteApp and Desktop Connection through the Start menu on a Windows PC or through a Web browser.
- Accessibility standards
- WCAG 2.1 A
- Accessibility testing
- Xn have and will continue to test against any assistive technology products or systems that support and assist individuals with disabilities, restricted mobility or other impairments to perform functions that might otherwise be difficult or impossible in accordance with our customer user group requirements.
- API
- Yes
- What users can and can't do using the API
-
Xn Leisure have interfaces with many third parties including corporate systems, gym equipment providers, financial system providers, payment providers, reporting providers, membership apps and much more. Xn has a truly well-established system with an open ecosystem of raft of tried and tested 3rd party applications and secure robust APIs. APIs that can be made available to any third party for integration with any partner you may choose. The IPR for the API would reside with Xn as we are the developer and software suppliers conducting the work.
Xn Leisure provide APIs for third party data access. These are TLS encrypted web services. The web services require authentication and are locked down to the relevant third-party IP. The web services use a layered approach. They connect through a firewall to corresponding internal web services that connect to the database required. Xn Leisure can provide a sub domain and certificate for *.xncloud if required, or you can use their own sub domain and certificate for the solution. - API documentation
- Yes
- API documentation formats
-
- Open API (also known as Swagger)
- API sandbox or test environment
- Yes
- Customisation available
- Yes
- Description of customisation
-
The APIs are configured with username, password, and encryption key. The APIs will only accept valid xml functions and validate all data that is being processed. The APIs return logged information back to the third party which details if data has been processed or rejected, and if rejected the reason.
Our software uses the latest OAuth technology and infrastructure which deals with API access and integrations with 3rd parties. This ensures the greatest security of the API data and management of only allowing trusted third parties to have access.
We allow the use of google analytics which can be enabled or disabled through configuration. We also make use of Application Insights which is native to Azure. Both require no additional components.
Xn Leisure online solutions provide a range of APIs offering functionality such as bookings, timetables, memberships, analytics, configuration, transactions, and utilities.
APIs typically use the Richardson API Maturity model (GET, PUT, DELETE and POST) and include Swagger documentation, code samples and 'Try It Out' sections. Access to the Swagger section requires 2 factor authentication and can be provided to third parties at the request of each Client.
Scaling
- Independence of resources
- Separate Azure instances or shared SAAS platform can be provided to ensure minimum degradation with increased use. Resources are increased as and when required with proactive Real-Time monitoring providing visibility of performance, availability, optimising physical / virtualised servers, databases, applications, and networks. Xn ensure the solution is fast and efficient during the peak periods, especially when more customers take-up online self-service. Latency is the key when it comes to on-site end-user experience. Regardless of available bandwidth, a user will notice a degradation of performance when latency is as low as 100ms and therefore we ensure each project has high availability.
Analytics
- Service usage metrics
- Yes
- Metrics types
- Clients have access to all tickets raised on the Support Hub. Reports are available upon request include: Resolution SLA/ Sum of tickets raised/ Sum of tickets closed/ First contact resolution percentage/ Average ticket age/ First Level Resolution SLA based on ticket Severity/ Average Ticket Age for all closed/ Product percentages for all tickets/ Functionality percentages per product/ First-contact Resolution %/ First Level Resolution %/ Technician utilisation/ Mean time to resolve/ Fix time limits for ‘priority areas’/ Average wait time for queries (not faults)/ Customer Satisfaction is via NPS sent to key contacts twice per year.
- Reporting types
-
- Regular reports
- Reports on request
Resellers
- Supplier type
- Not a reseller
Staff security
- Staff security clearance
- Other security clearance
- Government security clearance
- None
Asset protection
- Knowledge of data storage and processing locations
- Yes
- Data storage and processing locations
- United Kingdom
- User control over data storage and processing locations
- No
- Datacentre security standards
- Managed by a third party
- Penetration testing frequency
- At least once a year
- Penetration testing approach
- Another external penetration testing organisation
- Protecting data at rest
- Other
- Other data at rest protection approach
- ES 256-bit encryption is used to encrypt the backup data at rest
- Data sanitisation process
- Yes
- Data sanitisation type
-
- Explicit overwriting of storage before reallocation
- Deleted data can’t be directly accessed
- Equipment disposal approach
- A third-party destruction service
Data importing and exporting
- Data export approach
-
On a day to day basis data can be exported via the standard export reporting and business intelligence KPI tools provided by Xn. In addition, large data exports can use a variety of methods to export data from, the SQL Server and Azure SQL Database. These methods include Transact-SQL statements, command-line tools, and wizards.
You can also export data in a variety of data formats. These formats include flat files, Excel, major relational databases, and various cloud services. - Data export formats
-
- CSV
- ODF
- Data import formats
-
- CSV
- ODF
Data-in-transit protection
- Data protection between buyer and supplier networks
-
- Private network or public sector network
- TLS (version 1.2 or above)
- IPsec or TLS VPN gateway
- Data protection within supplier network
-
- TLS (version 1.2 or above)
- IPsec or TLS VPN gateway
Availability and resilience
- Guaranteed availability
- Xn Leisure guarantee 99.95% network uptime exclusive of Scheduled Service Downtime and we will provide advance written notice of any such service downtime using all commercially reasonable efforts to perform the downtime during off-peak hours. Customers are eligible for service credits equal to five percent of the of the monthly amount of the Hosted Services Subscription fee for each three hundred (300) consecutive minutes of service downtime. No downtime credits are due for Scheduled Service Downtime.
- Approach to resilience
-
The entire system is hosted in the Microsoft Azure cloud platform, within the UK South region. As part of our disaster recovery model, we replicate the solution across several data centres within the UK South region, but never into another region or country. Azure DNS records are replicated to provide a 99.95% uptime SLA. The Azure solution encrypts data at rest without the risk or cost of a custom key management solution. Additionally, organizations have various options to closely manage encryption or encryption keys. All data, assets storing and processing is protected across the physical location of and high levels of Data centre security.
All customer data at rest in the Xn Leisure product is encrypted using AES 256-bit encryption
Customers can be confident that all data is erased when resources are moved or re-provisioned, or when requested to be erased and the storage media which has held your data is sanitised or securely destroyed at the end of its life. Physical resilience and availability including the ability to recover from outages, meet each business needs is an essential element of the platform as we provide resilience processes that protects data from ransomware attacks. - Outage reporting
-
The Microsoft Azure Monitor provides comprehensive monitoring solution for collecting, analysing, and responding to monitoring data from your cloud environment. Azure Monitor maximizes availability and performance of the applications and services and proactively monitors how applications are performing and allows both manual and programmatic response to system events. Azure Monitor collects and aggregates the data from every layer and component of the system in a common data platform for consumption by a common set of tools that can correlate, analyses, visualizes, and respond to the data and provide integration to other Microsoft and non-Microsoft tools.
email alerts
Identity and authentication
- User authentication needed
- Yes
- User authentication
-
- 2-factor authentication
- Public key authentication (including by TLS client certificate)
- Identity federation with existing provider (for example Google Apps)
- Dedicated link (for example VPN)
- Username or password
- Access restrictions in management interfaces and support channels
- The system provides unique user login and password protection with access to functions controlled by individual or group templates. System administrators have full control of system access. Areas where data security is needed can be excluded for the purposes of data protection. System administrators can log users off the system as required. They can also manage functionality, site, groups and regional accessibility. Access to management interfaces is via separate secure URL’s. Remote diagnostics and support are carried out via secure Azure Bastion or via secured VPN for on premises support.
- Access restriction testing frequency
- At least every 6 months
- Management access authentication
-
- 2-factor authentication
- Public key authentication (including by TLS client certificate)
- Dedicated link (for example VPN)
- Username or password
Audit information for users
- Access to user activity audit information
- Users have access to real-time audit information
- How long user audit data is stored for
- User-defined
- Access to supplier activity audit information
- Users have access to real-time audit information
- How long supplier audit data is stored for
- User-defined
- How long system logs are stored for
- User-defined
Standards and certifications
- ISO/IEC 27001 certification
- Yes
- Who accredited the ISO/IEC 27001
- Alcumus ISOQAR
- ISO/IEC 27001 accreditation date
- 27/09/2023
- What the ISO/IEC 27001 doesn’t cover
- The scope of Registration covers the provision and support of the Azure Cloud Computing in accordance with the Statement of Applicability v10.0. via our partners Cloud Direct.
- ISO 28000:2007 certification
- No
- CSA STAR certification
- No
- PCI certification
- Yes
- Who accredited the PCI DSS certification
- Various and self certification
- PCI DSS accreditation date
- Various
- What the PCI DSS doesn’t cover
- Xn Leisure applications hold and process no card details and our solution transfers the chargeable value of the transaction to the Chip and Pin Pad and online payment values are transferred to a secure portal with the credit card service provider, no data other than success or fail and authority ref are passed back. The interface uses a combination of B2B web service calls and browser redirects to allow data and control of the browser to be passed from the client application to the Payment Provider and back again. The actual Chip and Pin pad devices carry the PCI compliance. The devices are P2PE and registered on the PCI website and customers can search for the actual units deployed. Because the traffic is Point to Point Encrypted, they do not bring the wider network into compliance. Xn may also provide integrations to each customers prefered payment solutions and therefore compliance is assured via each customers own system, Xn works with and conforms with the requirements laid down by each customer / integration. Full PCI certification, documentation and attestations can be provided according to solutions implemented.
- Cyber essentials
- Yes
- Cyber essentials plus
- No
- Other security certifications
- Yes
- Any other security certifications
-
- ISO 20000-1 (Cloud Direct & Microsoft)
- ISO 27001 (Cloud Direct & Microsoft)
- ISO 9001 (Cloud Direct & Microsoft)
- UK Cyber Essentials (Cloud Direct) and Cyber Essentials Plus (Microsoft)
Security governance
- Named board-level person responsible for service security
- Yes
- Security governance certified
- Yes
- Security governance standards
- ISO/IEC 27001
- Information security policies and processes
- Xn Leisure have overarching fully documented information security processes and policies. Our Cloud service solutions is fully ISO27001 certified via our Cloud partner Cloud Direct. An ISO9001 Quality Management System provide documented guidance and instruction. All Xn personnel are made aware of the requirements of this policy and undertake training relevant to job roles and follow the rules, policies and regulations appropriate to the operation and management of information technology resources. All our personnel must manage customer information in line with the directives presented within this policy and supporting documents. Any breaches of information security, actual or suspected are reported, investigated, lessons learned, and the root cause recorded. This is recorded within a Quality Report within the QMS and completed by a line manager or member of the Senior Management Team. Detailed records of Xn Leisure personnel who have completed their Data Protection training and a record of a test undertaken every two years will be held by Human Resources.
Operational security
- Configuration and change management standard
- Supplier-defined controls
- Configuration and change management approach
- We operate a fully managed change control board, with a dedicated change manager and key personnel. Weekly CC meetings are attended by senior operational staff, and we use emergency RFS if required. For any change, we can attend Client CAB. We have RFC templates for standard Azure changes, and a library of others if required. Change control happens every week to reviewing previous and upcoming changes. With a no doubt mindset, every concern or question is validated. We use multiple staff for every change, so there is no SPOF, and every change is reviewed and reported once completed.
- Vulnerability management type
- Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
- Vulnerability management approach
- We use Microsoft’s Defender for Cloud. Microsoft Defender for Endpoint and Microsoft Defender for Cloud takes place in the background, doesn't involve any changes at the endpoint level. A Hybrid approach offers flexible options, utilizing a consistent vulnerability scanner across various use cases. MDVM scanner identifies vulnerable software and provides the corresponding file path and/or registry key as evidence. The scanner detects applications installed on virtual machines and establishes a correlation between the software and its associated known vulnerabilities. Defender for Servers P2 have premium capabilities of Microsoft Defender Vulnerability Management including Certificate Assessment, Baseline Assessment, Block vulnerable applications etc.
- Protective monitoring type
- Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
- Protective monitoring approach
- Systems Monitoring service utilises leading monitoring systems to provide continuous updated information. Key metrics information will be collated displaying historical trending for Service Delivery reports such as capacity planning. Monitoring runs across platforms to help detect early warnings of potential issues across the wider network. Deeper insight, continually look for innovations, keeps you one step ahead. Key features: 24x7x365 alerts with escalation, Real time performance alerts, trending & root cause analysis. Key metrics and information is collated for historical trending for Service Delivery reports. Alerts are configured to trigger based upon standard definition templates or agreed with customer in writing.
- Incident management type
- Supplier-defined controls
- Incident management approach
- Well-defined event management process achieve early detection and automation of routine activities. Web Service Desk tools has workflows aligned and support core ITIL processes, integrating, asset / event management systems and a single point of contact for incidents. It enables the team to co-ordinate the work of restoring systems as ASAP and within SLAs. The Service Desk determines the nature of incidents and assign appropriately skilled engineers. A named Incident Owner is logged on The IMS and Progress reports issued. Once resolved the Incident Owner provides a written account of what happened and its resolution and confirms closure with client.
Secure development
- Approach to secure software development best practice
- Conforms to a recognised standard, but self-assessed
Public sector networks
- Connection to public sector networks
- No
Social Value
- Social Value
-
Social Value
- Fighting climate change
- Covid-19 recovery
- Tackling economic inequality
- Equal opportunity
- Wellbeing
Fighting climate change
Xn Leisure implement new environmental initiatives following guidance from our parent company's Sustainability Board. Our Senior Leadership Team integrate sustainability into the services and offering to our clients and employees by considering our obligations to secure the well-being of future generations in how we support and participate in the environment in which we operate. Current and previous initiatives include:
• Partnering with Carbon Footprint Ltd to assess our annual carbon and GHG impact across all our businesses.
• Working with Carbon Footprint Ltd to move from being Carbon Assessed to Carbon Reduced and then Carbon Neutral, which was achieved in November 2023.
• We partnered with a leasing provider to introduce an Electric Vehicle scheme under HMRC’s Salary sacrifice scheme, the Government’s ongoing commitment to incentivising employers to provide EV cars to employees.
• Attended a ‘Tree Planting / Carbon Offsetting’ event where we planted 200 x Hazel saplings.
• Promoted the WWF carbon calculator for broader education of our employee base.
• Full audits of miles travelled by both car and air to understand our impact further.Covid-19 recovery
Xn Leisure prides itself on working hard and helping both our customer base and local communities to manage and recover from the impact of COVID-19. Activities that can be delivered as part of the contract
• Opportunities to create employment, re-training and other return to work opportunities for those left unemployed by COVID-19, particularly new opportunities in high growth sectors.
• Supporting people and communities to manage and recover from the impacts of COVID-19, including those worst affected or who are shielding.
• Support organisations and businesses to manage and recover from the impacts of COVID-19, including where new ways of working are needed to deliver services for instance delivering legislative, security updates and changes to software to meet customer priorities that fundamentally changed in an instant with the requirement for online, virtual, and distanced interactions being a priority) that have a highest priorities.
• Support physical and mental health of people affected by COVID-19, including reducing the demand on health and care services. All senior staff at Xn have attended and passed Adult Mental Health for Adults courses and actively help manage and identify early warning signs of mental health issues at work.
• Help improve workplace conditions that support the COVID-19 recovery effort Including helping meet effective social distancing, remote working, remote meetings and sustainable travel solutions including the use of EV and public transport where possible.Tackling economic inequality
100% of staff on contract are paid above the London rate per hour Real Living wage as specified by Living Wage foundation as we are a tech company wishing to employ highly skilled and valued staff who staff with us for a long time, thus retaining knowledge and skills as much as possible.Equal opportunity
Xn Equal Opportunities and Dignity at Work Policy manages career opportunities for all people including those who are disadvantaged or disabled. The selection process is carried out consistently for all applications. Short-listing, interviewing, and selecting candidates are clearly informed by a selection criteria and of the need for their consistent application. Person specifications and job descriptions are limited to requirements necessary for the effective performance of the job. All applicants are interviewed by at least two interviewers and all questions asked to relate to the requirements of the job. The selection of new employees will be based on the job requirements and the individual’s suitability and ability to do, or to train for, the job. For disabled job applicants, the Company make reasonable adjustments to work provisions, criteria, and practices or to physical features of work premises or to provide auxiliary aids or services in order to ensure that any persons with a disability are not placed at a disadvantage in comparison with persons who do not have a disability. If it is necessary to assess whether personal circumstances will affect the performance of the job, this will be discussed objectively, without detailed questions based on assumptions about any of the protected characteristics. The Company adjust standard working practices/ requirements to overcome disadvantages caused by disability. Xn provide regular and refresher interactive online Equality & Diversity learning module which is available to staff at any time. Line Managers also complete the separate Managing Diversity module online. Training is supported by online resources regarding the Equality Act to promote a fairer, more tolerant and more diverse working environment. There is a test at the end of each module with a pass mark of 80%.Once successfully passed and completed staff download their certificate and upload these into their personal records.Wellbeing
Wellbeing is at the heart of our solutions provision with the system designed to provide greater self-service access and the highest levels of onsite customer service so that your customers visits are both enjoyable, rewarding and fulfils their aims to get fitter and healthier. Solutions include:
• Integrations with several wellness and health and fitness Apps and wearables including Technogym, EGym, SwimTag and Trainingym apps
• Integrations with the Health ReferAll system for Scheme Administrators to manage their particular programme/s. Dedicated portal for the submission and tracking of health referrals, Member App Referrals and Self-Referral Requests API –to receive referrals from customer websites (self-referrals) and via third party software providers such as QMS Health Checks Focus.
• Social Value Calculator - the tool to monetise your activity. Using evidence based academic research, undertaken by SIRC (Sheffield Hallam University) and funded by DCMS and Sport England, SVC gives operators the ability to accurately measure and value the impacts of sports and physical activity they offer. Operational data and sector wide benchmarking are provided using the operator’s current data and sector-wide benchmarks, gives insight to an operator’s savings in four key areas; Healthcare, Education, Wellbeing and Crime to deliver your value to the community.
• Geo Impacts solution integration – intelligent and targeted way to acquire and retain customers via business intelligence to provide data driven customer retention and acquisition solutions for a facility operator across all programmes, helping generate savings against marketing budgets. Using your current data and sector-wide benchmarks the module informs activity programme planning and subsequent targeted marketing campaigns, all aligned with the local profile catchment of your facility.
Pricing
- Price
- £125 a licence a month
- Discount for educational organisations
- No
- Free trial available
- No