QES

Datahub

Data Hub is an intelligent data management solution that matches millions of records from multiple sources to create a single, trusted golden view of data. Using advanced algorithms and configurable matching rules, it enables organisations to accurately merge, analyse and utilise data across a wide range of operational use cases.

Features

• Matches millions of data sources to create a golden view.
• Manual or automated data import.
• Data cleansing and processing to remove duplicates.
• Local customisations for rules, datasets, reports and more
• Hundreds of matching rules for address, person and household.
• Manual matching is available with suggested matches.
• Reporting and analysis using SQL reporting database
• Optional claim hub for troubled family claims
• Optional school hub for view of all schools across locality
• User friendly front-end for practitioners

Benefits

• Secure and UK GDPR compliant with multi-factor authentication
• Saves significant administrative time, matching millions of records instantly
• Unlimited number of user licences and partners
• Future proofed with product evolution
• Supported within our customer care team, including training
• Accessible on mobile devices
• Fully hosted, maintained and support service
• System adapts with your current project needs.
• Weekly senior developer meetings for additional technical support.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at emmamoreton@qes-online.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

970221943920802

Contact

Emma Moreton
07889 435679
emmamoreton@qes-online.com

About your service

• Service categories:

  Application Development and Deployment

  Data management

  Database management systems

  • Data Lake Management Systems

  Data integration and intelligence

  • Data Ingestion and Transformation Software
  • Master Data Intelligence Software
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Uses latest microsoft-support browsers. Requires internet connection.
• System requirements:
  • Internet connection
  • Latest microsoft-supported browsers

User support

• Email or online ticketing support: Yes
• Support response times: Same day
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: A Customer Success Manager is appointed to your principle point of contact, along with access the Customer Success Service Desk to raise questions or issues. They will provide support, including initial administrative training, hosting, maintenance and support. All support is done remotely, unless on-site chargeable support is required.; Support is available Mon-Fri 9:00-17:00 excluding bank holidays.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Virtual training to adminstrative users, along with user guidance documents.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: The extract report within the system allows users to extract their data during and after the contract duration.
• End-of-contract process: At contract end, QES will ensure the safe return of customer data and removing their system. Backups will be retained a 30 day period, at which point a full decommissioning of the service will take place, with all databases deleted, including backups.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: No difference, apart from styling to fit device's smaller screen.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Web-based application
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: The system has a user-friendly interface to navigate across, so multi-agency users can access the relevant data and reporting.; QES are compliant to WCAG 2.2 AA standards, using SonarQube to conduct automated checks and flag any non-compliance to developers to rectify. QES use the Chrome plugins: WCAG colour contract checker and wave evaluation tool. QES also use Google Chrome Lighthouse which has an accessibility review tool.
• API: No
• Customisation available: Yes
• Description of customisation: QES can customise the datasets, import method (manual, FTP or API), data matching rules for person, family and address. This is done via QES on request. Note, automated data feeds are subject to an extra fee (POA).

Scaling

• Independence of resources: Each customer’s data is stored in a completely separate, dedicated SQL database with strict access controls, meaning data is logically isolated and cannot be seen, accessed, or affected by any other client.

Analytics

• Service usage metrics: Yes
• Metrics types: Real-time reporting can take place using the connected SQL reporting connection.; Usage metrics can also be provided on request via email if needed in addition to audit reports embedded within the system to admins.; Optional API also available for connecting to your reporting solution.
• Reporting types:
  • API access
  • Real-time dashboards
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: Physical access control - NCSC access control
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Using the data extract system within the system, allowing users to extract all data.
• Data export formats:
  • CSV
  • Other
• Other data export formats: SQL Reporting Database
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • Optional FTP
  • Optional API
  • Manual import

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: QES have an uptime of 99.99% with the exception of planned maintenance. RPO - service would be reinstated to within 5 minutes of when the event occurred. RTO - return to service time will be <1 hour. Planned outages are completed outside of business hours, and completed within 5 minutes of downtime.
• Approach to resilience: QES use Microsoft Azure data centre, with the primary data centre in Cardiff, Wales and secondary site in London, England. All data remains in the UK. QES use Microsoft Azure's highly secure data centre protocols which can be found on their website or can be sent by us on request.
• Outage reporting: Email alerts will be provided by the customer care team.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: The application has a role based security model where by only users assigned management roles will be able to access management interfaces.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Our information security policies are externally audited during our ISO 27001 annual audits. QES also regularly review these internally during management reviews. The DPO is responsible for the maintenance of the security policy, who reports to the COO and then to the MD. All 3 staff members meet regularly throughout the year to ensure these policies are followed, assigning actions, and monitoring actions to track progress and completion where needed. Our policies are also compliant with UK GDPR, Cyber Essentials, and CE+ standards.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: We have a change management team who review all change requests raised by our user group, and schedule them into a product evolution sprint. All changes are subject to a series of automated test controls (SonarQube static application security testing), build validation, release validation, unit tests requiring 100% pass rate, open source library versions, open source library vulnerabilities, open source library licenses and manual test controls including code review, quality assurance review and project management review.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: QES use a 3rd party testing company to annually assess the vulnerability of our solutions. All issues are resolved within 1 month of being raised and the application is re-tested with a pass in the same period. We also use SonarQube in our automated DevOps pipeline to scan for vulnerabilities within our code every time we make a change using OWASPs top 10 vulnerabilities.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Microsoft defender for cloud provides threat detection and prevention across the application. QES are notified through the Azure defender portal as well as email and teams alerts. We deploy patches to medium-critical issues within 24 hours and agree a schedule of works for the others.
• Incident management type: Supplier-defined controls
• Incident management approach: Users will raise system issues through the QES customer care team and their appointed account manager, via email or phone call. The issues will be fixed within the SLA, testing with our QA team and released back to the client's environment with release notes. We complete root cause analysis reviews to assess common events, and update the systems back with any fixes to known common events across multiple systems.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Assessment Bureau
• ISO/IEC 27001 accreditation date: Tuesday 8 July 2025
• What the ISO/IEC 27001 doesn’t cover: The certification covers all operations, assets and personnel involved in the delivery and management of our product services. No controls relevant to the delivery of this service have been excluded. Exclusions are limited strictly to controls deemed non-applicable by our Statement of Applicability (e.g. physical security of data centres managed by Microsoft Azure).
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: British Assessment Bureau
• ISO 9001 accreditation date: Tuesday 8 July 2025
• What the ISO 9001 doesn’t cover: The ISO 9001:2015 certification covers all processes and operations related to the design, delivery and operations related to our products. There are no exemptions within the defined scope. Any requirements of the standard deemed not applicable (such as Clause 7.1.5 if monitoring/measuring equipment is not used) are justified within our Quality Manual and do not affect our ability to ensure product/service conformity.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Ab2a5f87-d68e-4c58-bf63-9f34f2104902
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at emmamoreton@qes-online.com. Tell them what format you need. It will help if you say what assistive technology you use.