M3 HOUSING LIMITED

M3Pamwin Plus

M3Pamwin Plus is a cloud-based housing development appraisal and project management application. It helps housing providers assess scheme viability, manage costs, and monitor delivery. The service supports transparent, auditable decision-making from feasibility through completion.

Features

• Cloud-based housing development appraisal solution
• Supports multiple tenure and funding models
• Long-term scheme viability calculations
• Integrated cashflow forecasting and management
• End-to-end project tracking from approval to completion
• Real-time KPI and financial recalculation
• Programme, project, and unit-level reporting
• Annual regulatory rent updates built-in
• Data export to Power BI and analytics tools
• Integrates with finance and appraisal systems

Benefits

• Single platform for development appraisal and delivery
• One consistent data source across teams
• Improved budgeting accuracy and cost control
• Clear visibility of project progress in real time
• Faster, more accurate cashflow reforecasting
• Better decision-making through clear reporting
• Easy adoption through intuitive user experience
• Models adapt to organisational priorities
• Reduced overhead through included upgrades and support
• Developed with deep housing sector expertise

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@m3h.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

914216358822008

Contact

Ben Virgo
020 8274 4000
sales@m3h.co.uk

About your service

• Service categories:

  Applications

  Enterprise resource management

  • Project and portfolio management
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: The service requires a stable internet connection and does not support offline use. Planned maintenance is carried out with advance notice. The system is optimised for modern browsers and does not support Internet Explorer. The service is accessible on mobile devices, but it is not optimised for smaller screens, which may affect usability.
• System requirements:
  • Modern web browser with WebAssembly support
  • Runs on any OS capable of running a current browser
  • No client installation or special hardware required
  • Requires HTTPS network access to the application and APIs

User support

• Email or online ticketing support: Yes
• Support response times: M3 operates a standard support service level agreement of 48 hours for responding to questions, with most queries typically answered within 24 hours. Support is provided during standard business hours on weekdays only. There is no routine support service available at weekends or on public holidays.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: We have not yet undertaken formal web chat testing with assistive technology users. However, accessibility is considered during design and development, and the service is delivered through standard web technologies compatible with common assistive tools. Accessibility improvements are reviewed as part of ongoing product development and in response to customer feedback.
• Onsite support: Yes
• Support levels: M3 provides a single, inclusive support level delivered through a dedicated help desk and ticketing system. Support is included within the licence fee, with no additional support charges. Requests are triaged and assigned to specialist consultants or technical engineers, depending on issue type. Technical account managers are not provided as standard, but technical specialists support complex issues when required. Training is available remotely or on-site during implementation and ongoing use. Documentation, user guides, and training videos are provided as part of the service.
• Support available to third parties: Yes
• AI chatbot: No

Onboarding and offboarding

• Getting started: We support onboarding through a managed implementation led by an experienced M3 consultant. This includes system setup, configuration, user acceptance testing, and structured training. Training can be delivered onsite or remotely, depending on client preference. Users are supported with role-based training sessions, written user guides, and supporting documentation. Ongoing access to helpdesk support and refresher training is available to help users embed the service and use it effectively.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: When a contract ends, customers can extract their data in standard formats. Most operational and reporting data can be exported directly to Excel from within the system. On request, M3 can also provide a database backup covering the customer’s data, subject to contractual and data protection requirements. Data extraction support is provided during offboarding to ensure customers retain access to their information in a usable format.
• End-of-contract process: At the end of the contract, access to M3Pamwin Plus continues until the agreed licence expiry date. During this period, users can export their data and complete any agreed transition or offboarding activities. After expiry, system access is removed in line with contractual terms and data retention policies, and customer data is securely exported, deleted, or retained as agreed and in accordance with data protection requirements.; ; The contract price includes access to the hosted service, routine maintenance, software updates, and standard remote support. Additional costs may apply for optional services such as on-site support, bespoke consultancy, data migration assistance, or extended training.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: M3Pamwin Plus is accessed through a secure, browser-based user interface using modern web browsers. Users log in via a web portal and interact through structured screens, menus, and dashboards. The interface includes sidebar navigation for appraisal and project management, guided data entry forms, and reporting views. Multiple screens can be opened simultaneously within the workspace to support comparison and data transfer. Users do not manage infrastructure or hosting. Data can be viewed, edited, and exported for reporting and analysis.
• Accessibility standards: None or don’t know
• Description of accessibility: M3Pamwin Plus is designed to be intuitive and easy to use for non-technical users. The interface uses clear navigation, structured screens, and consistent layouts to guide users through appraisals and project management tasks. Data entry follows logical workflows aligned to housing development processes, reducing training requirements. On-screen validation and automated calculations help prevent errors. The service is accessed through standard web browsers and does not require specialist hardware. While accessible on mobile devices, it is optimised for desktop use and does not currently provide offline access or advanced assistive technology customisation.
• Accessibility testing: We use tools such as WebAIM to test the service ourselves. We have worked with clients to improve areas highlighted by their testing and/or users.
• API: Yes
• What users can and can't do using the API: The API allows authorised users to extract project, tenure, and unit-level data in JSON format for integration with other systems. The API also supports limited updates to specific unit fields within existing tenures, including sales values, sold percentages, and handover dates. The API is not used to set up the service itself, create new projects or tenures, or change core templates, corporate assumptions, permissions, or configuration. API access is restricted to authenticated clients and only exposes the endpoints and fields that M3 enables for the customer’s environment.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: M3Pamwin Plus can be configured to meet organisation-specific requirements while working out of the box. Client administrators can customise labels, calculations, reports, and selected data fields using built-in configuration tools. Templates and assumptions can be tailored to reflect organisational policies and development models. Customisation is typically carried out by client system administrators following implementation, with optional support from M3 during setup or change. Core system functionality and underlying logic are not altered through customisation.

Scaling

• Independence of resources: Users are isolated from one another through dedicated data layers and controlled resource allocation. Each customer operates within their own instance, which separates data and prevents cross-tenant performance impact. System resources are distributed across available infrastructure to manage load effectively, ensuring that demand from one customer does not adversely affect the performance, security, or availability experienced by others.

Analytics

• Service usage metrics: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Data Erasure

Data importing and exporting

• Data export approach: Users can export data directly from M3Pamwin Plus using built-in export functionality, including export to Excel for reporting and analysis. Data can also be extracted programmatically using the API, which allows authorised systems to retrieve project, tenure, and unit-level data in structured JSON format for integration or onward use.
• Data export formats: Other
• Other data export formats:
  • Excel (XLSX)
  • API (JSON)
• Data import formats: Other
• Other data import formats:
  • Excel (XLSX)
  • API (JSON)

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: M3Pamwin Plus is provided on a best-endeavours availability basis, supported by resilient, centrally managed cloud infrastructure. Planned maintenance is scheduled in advance and communicated to customers to minimise disruption. While no specific uptime percentage is guaranteed, service availability is actively monitored and managed. Where availability issues occur, they are handled in line with the agreed support arrangements. Any service credits or refunds relating to availability are applied in accordance with the contractual terms agreed with the customer, rather than automatic financial penalties.
• Approach to resilience: M3Pamwin Plus is designed to be resilient and is hosted on secure cloud infrastructure provided by an accredited hosting partner. The hosting environment supports high availability, subject to planned maintenance, and includes geo-redundant backups to protect against regional outages. This ensures continuity of service even if a single datacentre or cloud region is unavailable. Resilience is further supported by robust backup and recovery arrangements. Data is protected through regular backups and replication, enabling systems and data to be restored quickly in the event of a failure. Physical and logical security controls are in place to protect infrastructure, including restricted access, monitored environments, and encrypted storage. Business continuity is supported by documented recovery procedures and tested processes. Detailed information on datacentre architecture, backup schedules, and disaster recovery arrangements is available to buyers on request.
• Outage reporting: M3 reports service outages and service-impacting issues through email alerts. Customers are notified when an outage occurs and are kept informed of progress and resolution updates.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is controlled through role-based permissions. Users are assigned defined roles, and management functions are only visible and accessible to authorised roles. Support channels are restricted to approved users, ensuring that only designated contacts can raise requests or access administrative support.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: INFORMATION SECURITY POLICY - To protect the information assets that handles, stores, exchanges, processes and has access to, and to ensure the ongoing maintenance of their confidentiality, integrity/availability. - To ensure controls are implemented that provide protection for information assets and are proportionate to their value and the threats to which they are exposed. - To ensure the organisation complies with all relevant legal, customer and other third-party requirements relating to information security. - To continually improve the organisation’s Information Security Management System and its ability to withstand threats. Responsibilities - It is the responsibility of the MD to ensure that this policy is implemented and that any resources required are made available. - It is the responsibility of the Strategic Partnerships & Operations Director to monitor the effectiveness of this policy and report the results at management reviews. - It is the responsibility of the Technical Director to create and maintain an Asset and Risk Assessment Register and to ensure all assets that need to be covered by this policy are identified. - responsibility of all employees and subcontractors and employees and subcontractors of information security critical suppliers, to adhere to this policy and report to the Technical Director
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: M3Pamwin Plus uses a controlled configuration and change management approach to manage updates throughout the service lifecycle. Core service components, configurations, and releases are version controlled and tracked from development through testing, deployment, and live operation. Configuration changes are managed through defined administrative controls, ensuring changes are logged and traceable. All changes are assessed before release to identify potential impacts on security, performance, and availability. Changes are deployed in a managed manner, with maintenance communicated in advance where relevant, and rollback procedures available if required.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: M3 operates a structured vulnerability management process. Software defects and potential vulnerabilities are logged in a central tracking system and assessed based on security impact, business risk, and operational reliability. Issues are prioritised accordingly. Critical security patches are deployed as soon as practicable, while non-critical updates are included within scheduled release cycles. Information on potential threats is obtained from security monitoring tools, supplier notifications, and industry security advisory services. Infrastructure updates are applied in line with an established patch management policy.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: M3Pamwin Plus uses protective monitoring provided by its cloud platform and hosting partners, including log analysis and automated activity alerts, to identify potential compromises such as unusual access patterns or system behaviour. When an alert is triggered, it is investigated in line with the incident management procedure, with appropriate actions taken to contain and remediate any issue. Incidents are acknowledged within one business day and a substantive response is provided within two business days, in accordance with the agreed support service levels.
• Incident management type: Supplier-defined controls
• Incident management approach: M3 operates a defined incident management process with pre-defined procedures for common events, including security incidents and service disruptions. Users report incidents through established support channels, where they are logged, assessed, and prioritised. Incidents are investigated and managed in line with documented procedures to minimise impact and prevent recurrence. Users are kept informed as appropriate, and incident reports can be provided outlining the issue, impact, and actions taken. Response times align with agreed support service levels.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: A free, time-limited test instance of M3Pamwin Plus can be provided to prospective customers. The trial includes access to core appraisal and reporting features. It excludes full data migration, bespoke configuration, and implementation services. Trial access typically lasts up to one month, unless otherwise agreed.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 5%
• Between £250,000 and £500,000: 7.5%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 12.5%
• Between £2,500,001 and £5,000,000: 15%
• Over £5,000,001: 20%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: UKAS Management Systems
• ISO/IEC 27001 accreditation date: Thursday 6 November 2025
• What the ISO/IEC 27001 doesn’t cover: .
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: UKAS Management Systems
• ISO 9001 accreditation date: Thursday 6 November 2025
• What the ISO 9001 doesn’t cover: .
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
    • Understanding of issues relating to entering the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@m3h.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.