APLX LTD

Capture

Capture is a SaaS solution designed for continuous AP spend protection, cashflow improvement, and statement reconciliation. Duplicate, spikes and sequencing modules prevent duplicate payments, overpayments and payments to the wrong supplier. Supplier master data cleansing and integrity reports highlight fraud risks. The statement module fully automates supplier reconciliations

Features

• Scans millions of transactions in seconds for real-time AP control
• Flags potential duplicate invoices ahead of payment
• Flags additional invoice anomalies including spikes, sequencing errors, and tax
• Fraud detection and data cleansing with 30+ integrity checks
• Vendor master data quality checks & risk management
• Flags supplier statement exceptions/anomalies and provides reconciliation workflow
• Flags open items on statements (missing invoices or credits)
• Automates outreach to suppliers for statement collection and reconciliation
• Interactive dashboards, customisable advanced reporting & analytics
• Checks/reports can be leveraged for retrospective AP audit recovery

Benefits

• Prevention of duplicate invoices before payment
• Prevents all types of overpayments, invoice payment errors, spikes/sequencing issues
• Provides detailed spend analysis, cashflow, and working capital insight
• Visibility and protection across multiple systems/ERPs
• Automates the collection and reconciliation of supplier statements
• Provides immediate cost savings and return on investment
• Drives Accounts Payable process improvement, reducing future errors
• Protects cashflow & organisational reputation
• Increases AP ledger accuracy
• Reduces audit and recovery fees

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at matthew.hill@auditpartnership.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

908941296387951

Contact

Matthew Hill
01135430506
matthew.hill@auditpartnership.com

About the service

• Service categories:
  • Applications
    • Enterprise resource management
      • Financial
        • Accounts Payable Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: No service constraints and 99.9% uptime
• System requirements:
  • Access to the internet
  • Any navigation browser

User support

• Email or online ticketing support: Yes
• Support response times: Initial responses within 30 minutes Monday-Friday. Service desk open 8:30 to 17:30 (UK time), Monday to Friday. SLAs in place for level of ticket raised.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 A
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes
• Support levels: IT Freshdesk is included within the software. This is our IT ticket support system, managed from 08:30 until 17:30 Monday to Friday, providing responses within 30 minutes during these times. Support is also available via a dedicated email address and phone number.; ; Each client will have a dedicated technical account manager and support from each of our IT managers (Infrastructure Manager, Data Manager and Application Manager).; ; Ongoing support and training are included in the software fee, so no extra cost is involved.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Onboarding begins with a collaborative session with your AP team and finance management to assess key requirements and configuration needs. This includes defining user roles and reporting formats, and agreeing on frequency of data uploads and report generation.; ; Following initial assessments, our IT team will assist the client with data transfers and set-up process. Data requirements are limited to: historical AP data file(s), vendor master file, and regular uploads at pre-agreed intervals to provide most recent AP postings and any changes to the vendor master file. For supplier statement reconciliation, we usually require the setup and connection to a dedicated email address (e.g. statements@yourorganisation.com). ; ; For data transfers, our team will provide secure guidelines and ensure compliance with your internal policies. Each time data is uploaded, Capture's algorithms automatically run to produce the exception reports for your AP team to review. ; ; Once data is received and the software is configured, training is delivered online or in person through interactive sessions. Detailed user manual documentations are also provided. ; ; Help & support remains available throughout the contract length. ; ; The goal is minimal disruption, so you can start benefiting from Capture’s insights, error prevention, statement reconciliation, and recovery capabilities quickly, without heavy resource demands.
• Service documentation: Yes
• Documentation formats: PDF
• Documentation accessibility standard: WCAG 2.2 A
• End-of-contract data extraction: Users have the ability to export data from the platform into Excel at any stage and end-of-contract data can also be provided by our support team.
• End-of-contract process: Renewal options will be discussed with the designated client contact as the contract is approaching expiry. Should the contract not be renewed, the client will have the option to extract data until the final day of contract, alternatively, the accounts manager/support team can assist with any data extraction requirements. After the end the of contract, data will be deleted and sanitised following ISO-compliant process and industry standards.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• Description of service interface: Web-designed interface with standard navigation options and direct access to areas including:; - duplicate payment reports; - tax analysis; - spikes; - sequencing; - overpayments; - supplier integrity; - task summary; - invoice viewer; - reports; - supplier statement reconciliation; - help & support; - notifications; - settings.
• Accessibility standards: WCAG 2.2 A
• Accessibility testing: We conducted multiple interface testing exercises to ensure accessibility and functionality for users of assistive technology. We tested usage of the platform with screen readers to ensure content, navigation, and interactive elements were correctly announced and usable without visual cues. We also tested the interface with screen magnification up to 400% to confirm that layouts remained readable, functional, and free from horizontal scrolling or content loss. In addition, the application was tested using keyboard-only navigation to verify that all functionality was accessible without a mouse. These tests helped identify and address accessibility barriers, supporting an inclusive and user-friendly experience.
• User support accessibility: WCAG 2.2 A
• API: No
• Customisation available: Yes
• Description of customisation: Capture is designed to adapt completely to your AP error prevention and control needs. Customisation is available for almost every aspect of the software, from the features and workflows to the user interface, dashboards, and reporting formats. ; ; The AP data is presented in the software in a way that completely reflects what your team are used to seeing in the existing AP systems, with the flexibility to change visual settings to prioritise/de-prioritise data, sort, filter, and create customised reports. ; ; Users can customise settings directly through an intuitive configuration page, allowing adjustments to data views, permissions, and reporting outputs without technical complexity. ; ; For deeper customisation (e.g. bespoke features or integrations), our account managers and development team work closely with clients to implement tailored solutions.; ; Some levels of customisation are user-based and some are only available to administrators and key stakeholders within your organisation, ensuring control remains with those responsible for compliance and efficiency.

Scaling

• Independence of resources: Capture runs on Microsoft Azure, which helps keep the platform fast and reliable even when high volumes of users are active at the same time. Azure’s cloud infrastructure uses load balancing to spread traffic evenly and prevent slowdowns. It also supports auto-scaling, so extra resources kick in during busy periods. ; ; Each client’s data is kept separate through a multi-tenant setup, meaning one company’s activity won’t affect another’s. Azure provides high availability, redundancy, and strong security standards. All of this ensures Capture stays responsive and stable, no matter how much demand is placed on the service.

Analytics

• Service usage metrics: Yes
• Metrics types: We have standard account logs in place to track user sign in, MFA, and log-in information (sing in/sign out timestamps, password change requests, etc.). Additionally, pre-built report library displays several usage metrics, such as "completed user transactions" showing the number of items each user is reviewing, other reports available based on "transaction status" to highlight which transactions have been flagged/are under investigations/are marked as resolved. Additional customised reporting is available alongside the pre-built suite of reports, so clients can request additional metrics and analytics reporting at any time during the contract.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Degaussing
  • Physical Destruction / Hardware containing data is completely destroyed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Capture’s audit modules and reporting interface allow users to seamlessly export flagged items and comprehensive audit data into Excel for deeper analysis. This functionality supports flexible reporting by enabling teams to filter, sort, and customise data before export, ensuring only relevant insights are included while still maintaining data integrity. ; ; Once exported, the data can be used for compliance reviews, financial reconciliations, and performance tracking across multiple audit streams.
• Data export formats:
  • CSV
  • Other
• Other data export formats: Excel
• Data import formats:
  • CSV
  • ODF
  • Other
• Other data import formats:
  • Text - fixed column width
  • Text - tab delimited
  • Text - complex character delimited
  • Any text format (variants on CSV)

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • Other
• Other protection between networks: Audit Partnership currently do not have a connection to the public sector network, however, it is possible to consider this, should it be required.
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: 99.9%
• Approach to resilience: Capture™ combines Microsoft Azure’s cloud capabilities with a secure UK data centre to keep the service available and responsive under stress.; ; On Azure, the application layer benefits from elastic scaling and load balancing, so traffic is spread across healthy instances and extra capacity is added during peaks. Azure uses multiple regions and availability zones to avoid single points of failure. Its built-in monitoring and managed services quickly spot and fix issues, so Capture can handle traffic spikes without affecting user experience.; ; At Audit Partnership’s dedicated UK head‑office data centre, client data is stored and processed on encrypted, virtualised servers in a temperature‑controlled, multi‑rack environment. Physical resilience is supported by strict access controls (card access with logged entry/exit, CCTV, 24/7 monitored alarms), and by segregating duties so only authorised staff can administer production. Regular encrypted off‑site backups to a remote storage facility provide recovery points if something goes wrong, while working data is restricted to central servers to simplify restoring operations. Redundant critical services & network components, in additional to virtualisation are utilised to allow for rapid failover and rebuilds should a failure occur.; ; More information on IT security and/or resilience measures is available upon request.
• Outage reporting: In the rare event of any service interruption or outage, this would be reported to the client via direct communication to impacted users, typically through email alerts and/or client account managers. For real-time incident updates, clients can rely on their designated support contact or account management team.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
• Other user authentication: It is possible to set up a dedicated link and/or PSN-limited access if the client requires.
• Access restrictions in management interfaces and support channels: User access groups are used to limit access to restricted/management resources. We have full control over the application access restrictions and use CPD to manage all restrictions at user level and role based. User permissions to view, edit or export are configurable for each area of the platform, and any area can be locked based on user level access restrictions.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
• Description of management access authentication: It is also possible to set up a dedicated link and/or PSN-limited access if the client requires.

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Audit Partnership operates under an ISO27001-certified Information Security Management System (ISMS), where all policies and controls are aligned with international best practices for data protection and risk management. Policies cover areas such as access control, encryption, physical security, backup and recovery, and secure disposal of assets.; Reporting Structure:; Information security is overseen by a dedicated compliance and IT leadership team, with ultimate accountability at Senior Director level. Regular internal and external audits and management reviews ensure adherence to ISO 27001 requirements. A documented escalation process is in place, with reports logged and reviewed by senior management.; How policies are enforced:; Policies are actively communicated to all staff and supported by mandatory training and strict technical controls (e.g., Active Directory, two-factor authentication, least-privilege access). Compliance is monitored through continuous system checks, access reviews, and regular audits. Changes to access or security configurations require Director approval, ensuring governance and accountability.

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: All service components (servers, apps, databases, network devices, service accounts, backups) are uniquely recorded in a Configuration Management Database, with baseline configurations and linked change records tracked through their lifecycle. Changes are categorised and assessed for security impact on confidentiality, integrity, and availability. Testing occurs in non‑production environments, with documented approvals, and Director sign‑off for high impact changes. Implementation is logged, monitored, and followed by a post‑implementation review.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Audit Partnership have multiple procedures to review vulnerabilities including Risk Assessments, mitigating treatments to reduce risks and internal code reviews. We also include an accredited external penetration test of firewalls and external applications at least annually, and utitlise a web application scanning tool (AppCheck). AppCheck scans are ran regularly to alert of any zero-day vulnerabilities and known security flaws that are discovered in-between penetration testing. The application development team review any issues and act accordingly.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Our monitoring is in line with ISO 27001 - Various tools are used to monitor the application; Microsoft Defender for Cloud, Integral CPD system, Entra ID & Cloudflare. Events from the majority of these systems flow into our Wazuh SIEM system, monitored by our in-house SOC team. Additionally, the team has a set of routine calendarised checks, which includes service monitoring and log reviewing to discover problems that might otherwise go unseen.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Post-quantum cryptography secure: Yes
• Incident management approach: Users can report incidents via the service desk (ticket/email) or their Account Manager. Audit Partnership operate a Security Incident and Corrective Action Reporting procedure (SICAR) which requires an investigation to be carried out, including root cause analysis, corrective and preventative action. SICARS are reviewed in the ISO 27001 security meetings, including whether any changes are needed to policies and procedures. All reports are logged and time‑stamped, covering timeline, scope, affected data/systems, actions taken, impact, required notifications, and corrective actions with owners and deadlines, and a post‑incident review. Clients would be contacted immediately by their Account Manager if affected.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: 3-month trial period of main platform functionalities

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 5%
• Between £250,000 and £500,000: 10%
• Between £500,001 and £1,000,000: 15%
• Between £1,000,001 and £2,500,000: 20%
• Between £2,500,001 and £5,000,000: 25%
• Over £5,000,001: 30%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: Alcumus ISOQAR
• ISO/IEC 27001 accreditation date: Wednesday 8 January 2025
• What the ISO/IEC 27001 doesn’t cover: In scope includes all UK assets, processes and facilities involved in the provision of Profit Recovery Auditing services and Software-as-a-Service. Assets and operations outside of the UK are not in scope for the certifications but all operations are through one management system and all countries follow the same procedures. In addition, all client data remains in our UK data centre with any access through a secure VDI network.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• ISO 9001 certification accredited by: Alcumus ISOQAR
• ISO 9001 accreditation date: Thursday 8 January 2026
• What the ISO 9001 doesn’t cover: In scope includes all UK assets, processes and facilities involved in the provision of Profit Recovery Auditing services and Software-as-a-Service. Assets and operations outside of the UK are not in scope for the certifications but all operations are through one management system and all countries follow the same procedures. In addition, all client data remains in our UK data centre with any access through a secure VDI network.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: A6541204-cec4-4c70-8546-487ed960d00c
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Plans to engage the contract workforce in deciding the most important workplace issues to address
  • Ensuring new workers are informed of their right to join a trade union
  • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges

  Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

  • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
  • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
  • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

  • Understanding of the issues affecting the development of new skills by target cohort
  • Understanding of issues relating to entering the contract workforce
  • Creation of outreach activities to create a pipeline of employees for the future contract delivery
• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at matthew.hill@auditpartnership.com. Tell them what format you need. It will help if you say what assistive technology you use.