RIO AI (UK) LIMITED

Rio Learn

Rio Learn is a flexible digital learning platform that delivers and builds practical sustainability, ESG, net-zero, and environmental skills. It offers self-study, CPD-accredited courses, many of which are free, designed to upskill individuals and organisations, build recognised capability, and support real behaviour change and measurable impact across the workforce.

Features

• Cloud-hosted learning platform with no local installation
• CDP grade and accredited learning courses
• Interactive course authoring with quizzes and assessments
• Real-time analytics and learner progress reporting
• Bespoke course and module development
• Role-based user access and permissions
• White-label branding and custom domains
• Mobile app builder for iOS and Android
• API integrations with third-party systems
• Scalable infrastructure for large user volumes

Benefits

• Publish learning content from any device
• Ability to update and co-create courses and modules
• Track learner progress instantly and accurately
• Automate enrolments, notifications and certifications
• Reduce administration through centralised management
• Bespoke training modules designed to your needs, built by experts.
• Manage users and permissions efficiently
• Integrate learning with existing organisational systems
• Scale training delivery without additional infrastructure
• Maintain consistent branding across learning environments

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at daniel.botterill@rio.ai. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

976771499209815

Contact

Daniel Botterill
020 3371 7612
daniel.botterill@rio.ai

About your service

• Service categories:

  Applications

  Production and operations

  • Other operations
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: The Rio sustainability data reporting platform.
• Cloud deployment model: Public cloud
• Service constraints: The service is delivered as a cloud-based SaaS platform and requires a reliable internet connection and use of modern, supported web browsers. Legacy browsers may have limited functionality. Planned maintenance and updates are managed by the platform provider and may result in brief periods of reduced availability, typically outside peak usage hours. Customisation is available at the application level only, with no access to underlying infrastructure. Mobile access depends on device and operating system compatibility. Integrations with third-party systems are subject to the availability, performance and constraints of those external services.
• System requirements:
  • Stable internet connection
  • Modern supported web browser
  • No additional software licences
  • No virtual machines or specialist hardware
  • Accessible on desktop, tablet and mobile devices
  • Buyer responsible for device security and antivirus

User support

• Email or online ticketing support: Yes
• Support response times: 2-3 working days. No response over the weekend of public holidays.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: No
• Support levels: We provide support in using the platform and its learning materials. Most support would be through guided email. Telephone contact is available. We have a dedicated Tutor to support learners with certain courses. There are also a range of FAQ's to provide answers to common questions.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Users are set up on the platform either individually or in bulk by an administrator. Once a user account is created, the system automatically triggers a welcome onboarding email containing login details and guidance on how to access the platform. This automated process ensures users receive immediate access information without manual intervention. Administrators can manage enrolments, resend welcome emails if required, and monitor activation status through the platform dashboard, supporting a simple and efficient onboarding experience.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: When a contract ends, users can extract their data from LearnWorlds using built-in administrative tools and API access. Administrators can export learner data, including user records, enrolments, course progress, completion statuses and reports, in standard formats such as CSV. Course content and materials can also be downloaded where applicable. Data extraction is performed prior to contract termination to ensure continued access. After the service ends, platform access is removed in line with data protection policies, and any remaining data is securely deleted in accordance with retention and GDPR requirements.
• End-of-contract process: At the end of the contract, or when a learner requests their account to be disabled, access to the platform is removed in a controlled and secure manner. When an account is disabled, the user can no longer log in or access learning content, but their data is retained in line with agreed retention periods and data protection requirements. Administrators can manage account status through the platform, including disabling, reactivating or deleting user accounts as required.; ; Prior to contract termination, administrators are given the opportunity to export learner data, including user records, enrolments, progress and completion reports. Once the contract ends, platform access is withdrawn for all users. Any remaining data is retained or securely deleted in accordance with contractual terms, GDPR obligations and the platform’s data retention policies. Learner data is not shared with third parties and is handled securely throughout the process.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: The service supports accessibility in line with recognised web standards. It is designed to be compatible with WCAG 2.1 Level AA principles, supporting perceivable, operable, understandable and robust content. LearnWorlds is accessible via modern web browsers and works with common assistive technologies, including screen readers, keyboard navigation and browser-based accessibility tools. Learners can adjust browser settings for text size, contrast and zoom, and content supports captions and alternative text where provided. Accessibility features are continually reviewed and improved through platform updates.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The website interface is responsive. There is also an option for an iOS and Android app, although we have not activated this functionality yet.
• Service interface: No
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: The platform provides an API that enables organisations to integrate the platform with existing systems and automate selected administrative tasks. Users can set up aspects of the service through the API by creating and managing users, enrolling learners onto courses, retrieving course and user data, and synchronising learning activity with external systems such as HR, CRM or reporting tools. The API allows users to make changes such as updating learner records, managing enrolments, tracking progress, and extracting completion and engagement data to support internal reporting and workflow automation.; ; The API is designed to support operational efficiency and data exchange rather than full platform configuration. Core platform setup, course creation, content design, branding, assessments and site-level configuration are managed through the LearnWorlds administrative interface rather than the API. The API operates within defined permissions and security controls, and access is subject to authentication and rate limits. Changes made via the API must align with the platform’s data models and cannot override system-level settings or infrastructure. As a SaaS platform, infrastructure configuration and underlying hosting are not accessible through the API.
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: Learning content on Rio Learn can be customised by Rio to meet organisational, sector and learner needs. Rio can adapt course content, language and examples to reflect specific organisational contexts, policies and priorities. New modules can also be designed for industry or regional based regulations for example and created by our learning team. These can be tailored to different roles or audiences, with targeted learning pathways, assessments and reflective activities. Branding elements such as logos, colour schemes and terminology can be applied to create a consistent organisational experience. Content can also be updated or refreshed to reflect regulatory changes, emerging best practice or new organisational objectives, ensuring learning remains relevant, practical and aligned to real-world application.

Scaling

• Independence of resources: The platform delivers the service using a scalable, cloud-based SaaS architecture designed to handle varying levels of user demand. Platform resources automatically scale to accommodate increases in user activity, ensuring consistent performance for all users. Usage is distributed across shared infrastructure with load balancing to prevent individual users or organisations from negatively affecting others. System monitoring and performance management are handled centrally to maintain availability and responsiveness. This approach ensures users experience reliable access and performance regardless of peak usage or demand from other customers.

Analytics

• Service usage metrics: Yes
• Metrics types: LearnWorlds provides service usage metrics through built-in analytics and reporting dashboards. Available metrics include user registrations and active users, course enrolments and completions, learner progress and completion rates, time spent on courses, assessment and quiz results, and video engagement data such as views and completion. The platform also tracks login activity, learner participation history, and certification records. Where enabled, enrolment and revenue metrics are available. Reports can be generated on demand and exported in standard formats to support monitoring, evaluation and organisational reporting.
• Reporting types: Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Staff screening not performed
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: Never
• Protecting data at rest: Other
• Other data at rest protection approach: The platform protects data at rest using industry-standard encryption on secure cloud infrastructure provided by Amazon Web Services (AWS). Stored data is encrypted and access is controlled through strict authentication and role-based permissions. These controls are part of the managed SaaS environment and are designed to protect customer data and support compliance with UK GDPR and EU GDPR requirements.
• Data sanitisation process: No
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: Users with administrator access can export data directly from the platform using built-in reporting and management tools. Learner data, including user profiles, enrolments, progress, assessment results and course completions, can be exported in standard formats such as CSV for offline storage or transfer to other systems. Exports can be generated on demand from the administration dashboard or retrieved via the API where integrations are in place. This allows organisations to retain records, meet reporting requirements and migrate data before account closure or contract end.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The platform is delivered as a cloud-based SaaS platform designed for high availability and reliability. The service is hosted on resilient cloud infrastructure with built-in redundancy, load balancing and continuous monitoring to minimise downtime and maintain consistent access for users. The platform targets high levels of service availability, excluding scheduled maintenance and events outside reasonable control.; ; Planned maintenance is managed centrally and, where possible, scheduled outside peak usage periods to reduce user impact. Users are notified in advance of any significant planned downtime. Availability and performance are monitored continuously to identify and address issues promptly.; ; Service availability commitments and any associated service level agreements (SLAs) are defined within the contractual terms agreed with the buyer. Where availability guarantees are not met, remedies, including service credits or other forms of compensation, are handled in accordance with those agreed contractual arrangements rather than automatic refunds. As a managed SaaS service, infrastructure-level SLAs are underpinned by the hosting provider, while LearnWorlds manages application-level availability and support.
• Approach to resilience: The platform is designed to be resilient and to maintain service availability in the event of component failure or fluctuating demand. It is delivered as a cloud-based SaaS service hosted on secure, highly available infrastructure provided by Amazon Web Services (AWS). The underlying datacentre environment uses geographically resilient facilities within the European Union, with built-in redundancy across compute, storage and networking layers.; ; The platform benefits from load balancing and auto-scaling capabilities to distribute traffic and manage peak usage without service degradation. Data is replicated across resilient storage systems to reduce the risk of data loss and support rapid recovery in the event of failure. Continuous monitoring and alerting are in place to identify and respond to incidents promptly, with managed updates and maintenance designed to minimise disruption.; ; Planned maintenance is scheduled to reduce impact on users, and the managed SaaS model removes the need for buyers to manage infrastructure resilience themselves. Detailed information on infrastructure resilience, disaster recovery and business continuity controls can be made available on request, in line with the government’s cloud security principle on asset protection and resilience.
• Outage reporting: The platform reports outages through its established service communication channels. Where a service disruption occurs, status updates are provided via platform notifications and direct communications to administrators, such as email alerts, as appropriate. Planned maintenance and known issues are communicated in advance wherever possible. Incidents are monitored centrally, and updates are issued to keep users informed of progress and resolution. This approach ensures transparency and timely communication during service interruptions.

Identity and authentication

• User authentication needed: No
• Access restrictions in management interfaces and support channels: The platform restricts access to management interfaces and support channels using role-based access controls and authentication mechanisms. Administrative interfaces are accessible only to authorised users with assigned roles and permissions, ensuring users can perform only functions relevant to their responsibilities. Strong authentication controls are applied to protect administrator access. Support channels are similarly restricted, with requests accepted only from verified account holders or authorised contacts. Access to sensitive information is limited to approved personnel, and activities within management interfaces are logged and monitored. These controls help prevent unauthorised access and support secure administration and support operations.
• Access restriction testing frequency: At least every 6 months
• Management access authentication: Username or password

Audit information for users

• Access to user activity audit information: No audit information available
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: The platform follows documented information security policies and processes designed to protect customer and learner data. These include access control and authentication policies, encryption of data in transit and at rest, and role-based permissions to limit access to authorised users only. Security monitoring, logging and incident management processes are in place to identify, assess and respond to potential security events. The platform operates within a managed SaaS environment hosted on secure infrastructure provided by Amazon Web Services (AWS), which applies additional physical and operational security controls. Policies and processes are reviewed and updated regularly to reflect best practice, regulatory requirements and emerging security risks.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: The platform uses controlled configuration and change management processes appropriate to a managed SaaS service. System changes, updates and security patches are planned, tested and approved before release. Version control and staged deployments are used to maintain stability and allow rollback if required. Buyers can manage application-level configuration, such as users, courses and branding, through administrative tools, while core system and infrastructure changes are centrally managed to minimise risk and disruption.
• Vulnerability management type: Undisclosed
• Vulnerability management approach: The platform follows a structured vulnerability management process to protect services and data. Potential threats are identified through continuous monitoring, vulnerability scanning and review of system activity. Risks are assessed based on severity and potential impact, with remediation actions prioritised accordingly. Security patches and updates are tested and deployed promptly through controlled release processes, with critical patches applied as a priority. Information on potential threats is obtained from internal monitoring, security testing, trusted industry security advisories and alerts from the underlying cloud infrastructure provider. This ensures vulnerabilities are identified, assessed and addressed in a timely manner.
• Protective monitoring type: Undisclosed
• Protective monitoring approach: The platform uses protective monitoring to detect and respond to potential security incidents. Monitoring tools and logging are used to identify unusual activity, unauthorised access attempts or indicators of compromise. Alerts are reviewed by security and operations teams to assess risk and impact. When a potential compromise is identified, access can be restricted, affected components isolated and corrective actions applied. Incidents are investigated, remediated and reviewed to prevent recurrence. Response actions are prioritised based on severity, with critical incidents addressed immediately and non-critical issues handled within defined operational timeframes.
• Incident management type: Undisclosed
• Incident management approach: The platform operates defined incident management processes appropriate to a managed SaaS service. Pre-defined procedures are in place for common events such as service disruption, security incidents and performance issues. Incidents are identified through system monitoring or reported by users via established support channels. Reported incidents are logged, assessed and prioritised based on severity and impact. Users are kept informed through direct communication and status updates as appropriate. Where required, incident reports outlining the issue, impact and resolution actions can be provided to buyers following incident closure.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: The free version of Rio’s service provides access to self-study sustainability, ESG and net zero courses, including interactive content and CPD-recognised learning. It excludes premium courses, bespoke content, advanced reporting and integrations. Access is not time-limited, subject to an active user account and service terms.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 5%
• Between £250,000 and £500,000: 7.5%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Assessment Bureau
• ISO/IEC 27001 accreditation date: Friday 16 May 2025
• What the ISO/IEC 27001 doesn’t cover: The certification does not cover customer-managed environments, devices, or networks; third-party services outside the certified scope; customer-exported data; non-production or experimental systems; or business activities unrelated to the development and maintenance of AI software applications.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 6815a0ac-dc2e-424c-999c-65ef646c7d6d
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Ensuring new workers are informed of their right to join a trade union
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)
    • Measures to engage users and communities and build relationships to increase community integration build trust and influence how the contract is delivered

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
    • Understanding of issues relating to entering the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at daniel.botterill@rio.ai. Tell them what format you need. It will help if you say what assistive technology you use.