Bottomline Technologies Ltd

PTX

Bottomline PTX is a cloud-based payment platform that
securely manages Bacs, Faster Payments, International
Payments, Payouts, Account Visibility, Direct Debits,
Cheques, Cards, Pay Direct, Prompt to Pay and all
accompanying documentation, one secure environment.
PTX also provides Validation, Verification of UK and
International Bank accounts to combat error and fraud.

Features

• UK Payments
• Platform
• Receivables
• Payables
• Cash Management
• Payment Verification
• Global Payments Hub - International Payments, SWIFT

Benefits

• Safely and securely manage Business payments and collections
• Bank Account Management
• Matrix approvals available for amount/date/person etc
• Cheque production
• Incident Case Management
• Internal Fraud Management
• Direct Debit Management
• Cash Visibility
• Cash Forecasting
• Bank Verification and Validation

£20 to £25,000 a transaction a month

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at chris.toon@bottomline.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

926622195615811

Contact

Christopher Toon
01183540928
chris.toon@bottomline.com

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: PTX Payments can be used as an extention to other solutions (CRM, ERP etc) or as a standalone service
• Cloud deployment model: Private cloud
• Service constraints: Maintenance windows (publicised when used):; - Tuesday & Thursdays - 4am until 7am; - Saturday & Sunday - 00:00 until 07:30
• System requirements: N/A

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: According to SLAs contracted
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Web chat
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: None or don’t know
• How the web chat support is accessible: -
• Web chat accessibility testing: -
• Onsite support: Yes, at extra cost
• Support levels: Support only offer one level of support however accounts can be assigned a Customer Success Manager if required.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We will set the system up working with the project manager to ensure all data is accurate and correct, full training is given via Webex and the readme site has full explanation as to how to use the system. Onsite training will come at a cost but we tend to find most customers don’t want it and happy with remote training.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
  • Other
• Other documentation formats:
  • Word
  • Excel
• End-of-contract data extraction: Depends on product module. To be discussed with clients Account Manager.
• End-of-contract process: Included in T+Cs

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Though the majority of customers access using a PC or integrate via the API.
• Service interface: Yes
• User support accessibility: WCAG 2.1 AA or EN 301 549
• Description of service interface: PTX allows API integration for select functionality in addition to the use of the UI.
• Accessibility standards: WCAG 2.1 AA or EN 301 549
• Accessibility testing: Third party vendor for Accessibility testing has used Screen Readers.
• API: Yes
• What users can and can't do using the API: How users can set up the service through the API.; How users can make changes through the API.; Any limitations to how users can set up or make changes through the API.
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: Resources are clustered and user activities are load balanced to dedicated resources. E.g. API request activities are segregated from UI Users.

Analytics

• Service usage metrics: Yes
• Metrics types: API, Callbacks, Regular Reporting, CSV or PDF download.

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: Less than once a year
• Penetration testing approach: In-house
• Protecting data at rest: Other
• Other data at rest protection approach: Our encryption standards comply with ISO/IEC 27001-2013 standards as well as follow NIST and COBIT controls. Data at rest is stored on encrypted using Oracle's Transparent Data Encryption - AES 256
• Data sanitisation process: Yes
• Data sanitisation type: Explicit overwriting of storage before reallocation
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Transaction data can be manually exported as a CSV file.; Data can also be exported automatically using the API or a callback URL.; Drive enables PTX Payments Hub users to automatically push data, generated by accounting software package to PTX, and to also export Bacs reports that have previously been collected from Bacs.
• Data export formats:
  • CSV
  • Other
• Other data export formats: PDF
• Data import formats:
  • CSV
  • Other
• Other data import formats: API

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: PTX aims to exceed 99.9% uptime but has no contractually comitted SLA.
• Approach to resilience: Available on request
• Outage reporting: Available on request.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Username or password
• Access restrictions in management interfaces and support channels: We restrict tenancy management only to Bottomline Platform Administrators. Both the Bottomline Platform Admins and Customer Admins can do the User, API Clients, Roles management.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: Between 6 months and 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: MSECB
• ISO/IEC 27001 accreditation date: 26/01/2023
• What the ISO/IEC 27001 doesn’t cover: 14.2.7 Outsourced Development was excluded from ISO due to being not applicable.
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber essentials plus: No
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Please request "Information Securities Policy".

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: Weekly CAB meetings held to discuss, review and authorize changes to production systems.; Pre-production test environments used for testing releases prior to deploys (including with customer access); Full SDLC available on request.
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: "Patch and Vulnerability Management Standard"
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: At Bottomline, we use a QRadar SIEM to capture audit information with respect to authentication, network devices, firewalls, anti-virus, and key production systems. This information is checked daily by the Security Operations Team and used to track offenses and anomalous activity as well as vulnerability scanning and remediation. Log reviews are performed regularly each business day, as well as ad-hoc during investigation or threat hunting activities.
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: "Incident Reporting Standard"

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Covid-19 recovery
  • Tackling economic inequality
  • Wellbeing

  Fighting climate change

  Our PTX Payouts solution provides a digital alternative to the environmentally damaging practices associated with traditional cheque payments. Unlike cheques, which contribute to deforestation through paper consumption and rely on fossil fuel-intensive postal transportation, our digital platform eliminates the need for paper and physical delivery. Embracing digital alternatives not only enhances efficiency but also demonstrates a commitment to sustainability, paving the way for a greener future.

  Covid-19 recovery

  Payments have been instrumental in the COVID-19 recovery process, aiding numerous organizations in disbursing relief and compensation to individuals financially impacted by the pandemic. This has enabled individuals and businesses to meet essential needs, sustain livelihoods, and stimulate economic activity amidst pandemic-related restrictions. By streamlining payment processes and ensuring timely disbursement, PTX has played a pivotal role in supporting recovery efforts, fostering resilience, and laying the groundwork for a more robust economic future.

  Tackling economic inequality

  PTX solutions have facilitated thousands of digital payments aimed at alleviating financial burdens, including cost of living, energy rebate, and winter fuel payments. By leveraging our platform, we enable our customers empower those most in need during challenging economic periods. These digital payments not only ensure timely assistance but also promote financial inclusion by reaching marginalized communities. By extending support to vulnerable individuals and families, PTX contributes tacking economic inequality and creating a fairer society.

  Wellbeing

  PTX not only facilitates payroll, compensation, and regular payments, ensuring reliability and efficiency for our customers' financial wellbeing, but it also incorporates robust security features. This enhanced security offers peace of mind, shielding finance teams from potential blame or guilt related to scams. By reinforcing trust in payment processes, these features cultivate a safer and more supportive environment, preserving the mental wellbeing of finance professionals and boosting their confidence in their responsibilities.

Pricing

• Price: £20 to £25,000 a transaction a month
• Discount for educational organisations: No
• Free trial available: No

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at chris.toon@bottomline.com. Tell them what format you need. It will help if you say what assistive technology you use.