ALERT DATA LIMITED

Access Control as a Service (ACAAS)

ACAAS is a cloud‑based access control system supporting single or multi‑site businesses. User roles and permissions are centrally managed, with encrypted, 24/7 access from any approved device. Hardware is minimal (readers/keypads), and the platform is flexible, scalable, and integrates with alarms, video, and intrusion systems.

Features

• Cloud‑hosted access control system.
• Centralised multi-site management.
• Role‑based user permissions.
• Integration with alarms, video, intrusion systems.
• Scalable - add new access points easily.
• 24/7 remote administration via internet
• Minimal on‑site hardware required.
• Supported hardware: Maxxess, Paxton, TDSi (Gardis).
• Web-based browser management interface.
• Secure encrypted data storage.

Benefits

• Data stored securely off‑site at compliant UK data centre
• Accessible anytime from any connected device.
• Scales easily to additional sites.
• Simplifies adding doors or entry points.
• Reduces on‑site installation complexity for faster deployment.
• Central oversight reduces administrative burden.
• Improves security via integrated systems.
• Flexible user role assignment.
• Continuous access monitoring.
• Lower total cost compared to legacy on‑premises systems.

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at enquiries@alertdata.io. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

948413048291887

Contact

Phil Davies
0333 2200250
enquiries@alertdata.io

About your service

• Service categories:

  Applications

  Enterprise resource management

  Human capital management

  • Core Human Resources Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: These will be the same as for the software product on which the add-on is installed.
• System requirements:
  • Modern HTML5 compatible web browser
  • Internet Connection
  • Access to the cloud service URL via any corporate firewalls

User support

• Email or online ticketing support: Yes
• Support response times: Response times based on priority of the incident raised. Initial response times based on priorities outlined below.; P1 – within 1 hour of case submission; P2 – within 4 hours of case submission; P3 – within 1 business day of case submission; P4 – within 2 business days of case submission
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: ACaaS is delivered as a fully managed service, providing end-to-end support throughout the customer journey. We handle system setup, onboarding, and team training to ensure rapid adoption of the platform. Our proactive monitoring continuously checks system health, camera performance, and cloud infrastructure, resolving issues on behalf of the customer and only contacting them when necessary. Support is available via ticketing, email, phone, or by booking calls and reporting faults online. Each customer is assigned a dedicated Account Manager to provide ongoing guidance and act as the primary point of contact. Standard managed service and self-service support are included in the subscription.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: ACaaS is provided as a fully managed service, ensuring users can start quickly and easily. We handle full system setup and configuration, onboarding new sites, and installing hardware if required. Our team trains users on platform features and workflows. Proactive support ensures the system is operational from day one, with any issues identified and resolved by our team. Users also have access to manufactures guides, and online resources to reinforce training and enable self-service.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: We provide an electronic data extract for users and events.
• End-of-contract process: Dependent on customer needs. ACaaS operates on a subscription basis, so if the customer continues with their subscription the managed service will also continue. If the customer chooses not to renew, we will support them in getting user information out in a suitable format for no additional cost.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Onboarding and offboarding documentation is provided in both text and video formats. Guides and tutorials are accessible, designed to be compatible with assistive technologies such as screen readers, keyboard navigation, and adjustable text sizes, ensuring all users can follow procedures effectively.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Manufacture dependant.
• Service interface: No
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: Manufacture dependant. What is possible is set out in the API documentation.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: ACaaS is delivered via a cloud-based architecture designed for scalability and resilience. Each customer’s resources, including storage, and processing, are logically isolated, ensuring that high demand from other users does not affect performance. The platform automatically scales infrastructure to handle peak loads, maintaining consistent performance and reliability for all users.

Analytics

• Service usage metrics: Yes
• Metrics types: Service Usage is monitored at the user access level for license compliance purposes. Available service metrics are available to subscribers of the service.
• Reporting types:
  • Real-time dashboards
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: TDSi, Maxxess, Paxton.

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: Users can export and share data by generating by the system, method dependant on the product / manufacture.
• Data export formats:
  • CSV
  • Other
• Other data export formats: PDF
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: 99% subject software patching and updates.
• Approach to resilience: Our service is designed for high resilience, ensuring continuous availability and secure operation. The platform is hosted in UK-based cloud datacentres with redundant power, network, and storage systems. Core infrastructure and data are replicated across multiple nodes to prevent service disruption. Proactive system health monitoring identifies and mitigates potential issues before they impact users. Detailed information about our datacentre setup and resilience measures is available on request for procurement or security review purposes.
• Outage reporting: Service outage reporting is provided via email. If any devices go offline or experience issues, the system automatically generates alerts and notifies users by email. This ensures customers are promptly informed of outages and can take any necessary action.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: SEiNG manages access through a combination of Single Sign-On (SSO), two-factor authentication, and role-based access controls. Users can sign in securely using SSO, with an added layer of protection provided by two-factor authentication. Access within the platform is governed by clearly defined roles—such as Admin, Editor, and Guest—ensuring that each user has the appropriate level of permission. For organisations requiring more precision, custom roles can also be created to provide more granular control over who can access specific features or data.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Cyber Essentials Plus.
• Information security policies and processes: Alert Data are certified according to the following security policies:; ; ISO 9001: Based upon quality management principles including strong customer focus and with the involvement of top management with the ultimate goal of continual improvement.; ; We also follow: ; ISO/IEC 27001: Provides a holistic, risked-based approach to security and a comprehensive and measurable set of information security management practices.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: All processes and policies follow ISO27001 standards: Initial Review and Logging: Create submission, classify and verify change, and obtain sign-off. Seniority of approver depends on change priority. Assessment and Approval: Change owner conducts impact assessment; final approval and scheduling completed. Implementation: Changes progress from Development → UAT → Live environments. Review and Closure: Assess success, document any issues, and formally close the change.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Our vulnerability management approach follows ISO27001. Preparation: secure written permission and clearly define the scope of IP addresses and servers Execution: Tools like Nmap and Nessus used to gather intelligence and perform deep scans on both external and internal networks. Reporting: findings are compiled into a restricted report that details the severity of risks and provides a prioritised action plan for fixes. Oversight: throughout the assessment, strict logging and real-time monitoring are required to ensure the process runs smoothly and safely. Patches are deployed within 14 days depending on severity.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Following Company Information Security Policy - Technical, we maintain a robust logging and monitoring framework using Wazuh and SIEM to protect information assets. All infrastructure components record key events, including access attempts, privileged account usage, and configuration changes. Logs are stored securely for three months, with administrators strictly prohibited from tampering with their own activity records. Real-time monitoring and fault logging ensure swift investigation of security breaches or unauthorised media use, while strict clock synchronisation via domain controllers ensures forensic accuracy. All activities comply with GDPR requirements, ensuring data integrity, legal compliance, and effective incident response.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Following company policy QAPIS-08, this streamlined incident response process manages Ransomware, DoS, and Data Breaches through five critical phases. It begins with Detection and Analysis to confirm the attack's scope, followed by immediate Containment via system isolation or traffic filtering to prevent further damage. During Eradication, the priority is wiping affected systems and restoring from clean backups rather than negotiating with attackers. Recovery focuses on restoring services, patching vulnerabilities, and resetting credentials. Finally, the Notification phase ensures legal compliance with regulations like GDPR, requiring formal reporting if personal data is compromised during the incident.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 15%
• Between £2,500,001 and £5,000,000: 20%
• Over £5,000,001: 20%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: TBC
• ISO/IEC 27001 accreditation date: Monday 1 December 2025
• What the ISO/IEC 27001 doesn’t cover: Application currently in progress.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: 005001
• ISO 9001 accreditation date: Tuesday 7 January 2025
• What the ISO 9001 doesn’t cover: NA
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 6154ea5d-8631-4d61-9ae6-aaf35035466b
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 703d5b66-cafc-4757-bbc4-755bd7e7b27c
• Other security certifications: Yes
• Any other security certifications:
  • IASME - IoT Level 1
  • IASME - IoT Level 2

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering
    • Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at enquiries@alertdata.io. Tell them what format you need. It will help if you say what assistive technology you use.