Qualtrics

Qualtrics Market Research Service

The Strategy and Research suite provides researchers and strategists with powerful tools for survey design,
research panel management, and advanced analytics on a unified platform. It drastically
reduces the time and cost associated with traditional, ad-hoc research.

Features

• Advanced Research Methodologies: Supports quantitative and qualitative studies
• UX Research Tools: Specialised for unmoderated testing, prototypes, and usability
• AI-Powered Stats iQ: Automated statistical analysis, regression, and topic/sentiment analysis
• Edge Audiences: Access to global human panels and synthetic respondents
• Edge Instant Insights: Provides pre-existing data and competitive industry benchmarks
• Research Centralisation: Central repository to manage all projects
• Tiered Credit Subscriptions: Cost-effective model based on respondent volume
• SAML 2.0 Identity Federation: Secure access through Single Sign-On
• AWS London Data Residency with 99.93£ availability
• 24/7 multi-channel support

Benefits

• Accelerate Insight Generation: Empowers teams to drive strategic decisions
• Reduce Costs: Lowers expenses associated with traditional research
• Increase Speed: Drastically reduces time to generate actionable insights
• Immediate Feedback: Edge integration provides rapid insights
• Trend Visibility: Visibility into consumer trends without launching full studies
• Standardised Data Management: Centralises findings into a single platform

• Education pricing available
• Free trial available

Service documents

• Pricing document

  ODS

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sstaveley@qualtrics.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

997507639326911

Contact

Simon Staveley
07999146946
sstaveley@qualtrics.com

About your service

• Service categories:

  Applications

  Customer relationship management

  • Marketing campaign management
  • Digital commerce
  • Sales force productivity and management
  • Customer service

  Advertising

  • Advertising Placement
  • Advertising Measurement
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Integration with most leading CRM, ERP/Service, Collaboration, Helpdesk and Marketing software suites
• Cloud deployment model: Public cloud
• Service constraints: Qualtrics S&R is a SaaS platform for UK Public Sector bodies to measure employee engagement and productivity. It integrates research data (R-data) with operational data (O-data) to provide AI-driven insights. Key features include lifecycle management, Text iQ analytics, and 360 feedback. Data is hosted on AWS London with AES 256-bit encryption. Pricing is based on employee headcount. Constraints include a 99.93% uptime guarantee, exclusions for implementation costs, and specific data extraction windows upon termination
• System requirements:
  • Internet connectivity
  • Modern browser such as Chrome Firefox or Edge
  • Modern OS such as Windows or iOS
  • Mobile access
  • SSO support via SAML2.0, Google OAuth, LDAP or CAS
  • Data encryption su8pporting TSL 1.2 or higher
  • SMTP and DKIM email protocols
  • REST API for integration wiht HRIS (if required)
  • Supported export file formats CSV, TSV, XML
  • No local SaaS software required

User support

• Email or online ticketing support: Yes
• Support response times: ITIL standards
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: None or don’t know
• How the web chat support is accessible: Qualtrics conducts rigorous accessibility testing to ensure the platform meets WCAG 2.1 AA standards for all users. In 2024 and 2025, extensive web chat and survey interface evaluations were performed with users of assistive technologies like JAWS, NVDA, and VoiceOver. These sessions focused on the end-to-end journey, from initial engagement to the final submission of feedback. Testing ensured that dynamic elements and conversational data tools, such as Text iQ, remain navigable via screen readers and keyboard-only inputs.; ; Key improvements resulting from this testing include the replacement of ambiguous symbols with descriptive text to provide clear directional cues for screen reader users. Additionally, the platform’s high-contrast settings and focus indicators were validated to assist users with visual or motor impairments. While most standard features now provide a high-fidelity experience, Qualtrics maintains updated VPAT documents to provide transparency on any specific question types that may still require alternative formats. This user-centric testing approach ensures that UK Public Sector bodies can capture inclusive, representative feedback from their entire workforce
• Web chat accessibility testing: Qualtrics conducts rigorous accessibility testing to ensure the platform meets WCAG 2.1 AA standards for all users. In 2024 and 2025, extensive web chat and survey interface evaluations were performed with users of assistive technologies like JAWS, NVDA, and VoiceOver. These sessions focused on the end-to-end journey, from initial engagement to the final submission of feedback. Testing ensured that dynamic elements and conversational data tools, such as Text iQ, remain navigable via screen readers and keyboard-only inputs.; ; Key improvements resulting from this testing include the replacement of ambiguous symbols with descriptive text to provide clear directional cues for screen reader users. Additionally, the platform’s high-contrast settings and focus indicators were validated to assist users with visual or motor impairments. While most standard features now provide a high-fidelity experience, Qualtrics maintains updated VPAT documents to provide transparency on any specific question types that may still require alternative formats. This user-centric testing approach ensures that UK Public Sector bodies can capture inclusive, representative feedback from their entire workforce
• Onsite support: No
• Support levels: Qualtrics provides comprehensive multi-channel support to ensure continuous service for UK Public Sector bodies. The standard offering includes 24/7/365 access to support experts through web, chat, and phone channels. This global coverage ensures that technical assistance is available at any time, regardless of the user's location or time zone. To maintain service quality, response times are governed by strict Service Level Agreements (SLAs) that are prioritized based on the severity of the reported incident.; ; Beyond live support, users have access to real-time transparency regarding platform performance. System health and maintenance updates are provided through the Qualtrics Status Page, where administrators can subscribe to email or text notifications for immediate alerts. The service also features a 99.93% monthly availability guarantee for the production environment. If uptime falls below this threshold, a tiered Fee Credit system is applied, providing financial recourse based on the duration of the downtime. These structured support and availability levels are designed to provide both technical stability and administrative peace of mind for mission-critical employee experience programs.
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: Qualtrics provides a multi-tiered support and training ecosystem designed to ensure UK Public Sector success. Standard support includes 24/7/365 multi-channel assistance via web, chat, and phone, with response SLAs prioritized by incident severity. For self-paced learning, users access XM Basecamp, an on-demand training platform offering "Beginner Quick Start" guides, specialized learning paths for Employee Experience, and formal Qualtrics Certification programs.; ; Organizations seeking deeper expertise can leverage the Qualtrics Partner Network (QPN), which includes global and local partners like Capventis, Deloitte, and EY. These partners provide tailored services ranging from strategic advisory and program design to technical implementation and bespoke end-user coaching.; ; Additionally, Qualtrics offers in-house advisory services specifically for the public sector, drawing on experience from large-scale projects like the Civil Service People Survey. This hybrid model allows buyers to choose between standard automated support, specialized partner-led delivery, or direct expert consultation to mature their employee listening programs.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: Upon termination of the service, Qualtrics provides a structured contractual window for customers to extract their data. During this period, users can export all collected employee experience data directly from the platform in several industry-standard formats, including CSV, TSV, and XML. This ensures that public sector bodies maintain full ownership and portability of their historical records for future use or migration to alternative systems.; ; Once this extraction window closes, Qualtrics initiates a secure decommissioning process. This includes the permanent, secure deletion of all remaining customer data and any associated metadata from the production environment. The service also guarantees that data is purged from all backup systems within a maximum contractual timeframe, which typically ranges from 90 to 180 days. This rigorous approach ensures compliance with data protection regulations by ensuring no residual information remains on Qualtrics infrastructure after the relationship has ended.
• End-of-contract process: The annual SaaS subscription for Qualtrics EX is all-inclusive regarding the standard platform maintenance, necessary security controls, and 24/7 technical support. At the end of the contract, there are no additional fees for data extraction if performed using the provided self-service tools, which allow exports in CSV, TSV, or XML formats. This self-service data return is included in the base licensing costs as part of the standard offboarding process.; ; However, certain services are strictly excluded and will incur extra charges. Implementation, bespoke training, and premium features—such as specialized Data Isolation—must be scoped and priced separately. Additionally, while standard web, chat, and phone support are included, enhanced support response SLAs or dedicated premium support tiers may be available at an extra cost. If a customer is unable to extract data themselves due to technical limitations and requires Qualtrics to perform a manual export or "return" of personal data, additional professional service fees may apply
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: The Qualtrics platform is built to meet WCAG 2.1 AA standards, ensuring inclusivity across the UK Public Sector. The service interface uses a responsive design that automatically optimizes layouts for both desktop and mobile browsers. Accessibility features include support for screen readers like JAWS and NVDA, keyboard-only navigation, and high-contrast settings. Additionally, the "New Survey Taking Experience" leverages AI to ensure that complex question types remain accessible to all users. Security is maintained through SAML 2.0 SSO and Multi-Factor Authentication during the login process.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The Qualtrics service uses a responsive web design, ensuring a consistent experience across desktop and mobile without separate app installations. The desktop interface is optimized for administrators to build surveys and perform deep data engineering. Conversely, the mobile experience is tailored for respondents, automatically converting complex layouts into touch-friendly, accessible formats. While managers can view AI-driven insights on any device, desktop remains the primary environment for detailed configuration, whereas mobile facilitates "in-the-moment" feedback and real-time dashboard viewing for employees on the move.
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: The Qualtrics service interface is a unified, purpose-built system of action accessible via modern web browsers. It features a centralized platform where users can manage the full employee lifecycle through intuitive, role-based dashboards. These dashboards provide real-time, customizable visualizations of both experience and operational data. The interface includes AI-powered tools like Text iQ for conversational data exploration and natural language queries, alongside "Manager Assist" for targeted coaching recommendations. Designed with a responsive layout, the interface automatically optimizes for both desktop and mobile use
• Accessibility standards: None or don’t know
• Description of accessibility: The Qualtrics platform is built to meet WCAG 2.1 AA standards, ensuring inclusivity across the UK Public Sector. The service interface uses a responsive design that automatically optimizes layouts for both desktop and mobile browsers. Accessibility features include support for screen readers like JAWS and NVDA, keyboard-only navigation, and high-contrast settings. Additionally, the "New Survey Taking Experience" leverages AI to ensure that complex question types remain accessible to all users. Security is maintained through SAML 2.0 SSO and Multi-Factor Authentication during the login process
• Accessibility testing: The Qualtrics platform is built to meet WCAG 2.1 AA standards, ensuring inclusivity across the UK Public Sector. The service interface uses a responsive design that automatically optimizes layouts for both desktop and mobile browsers. Accessibility features include support for screen readers like JAWS and NVDA, keyboard-only navigation, and high-contrast settings. Additionally, the "New Survey Taking Experience" leverages AI to ensure that complex question types remain accessible to all users. Security is maintained through SAML 2.0 SSO and Multi-Factor Authentication during the login process
• API: Yes
• What users can and can't do using the API: The Qualtrics API allows users to programmatically manage the entire employee experience lifecycle. You can automate administrative tasks such as creating user accounts, assigning roles, and managing permissions. It supports full survey management, enabling you to create, update, or delete surveys and distribute them via automated email invitations. Additionally, the API facilitates real-time data extraction in JSON format, which is essential for integrating employee feedback with external BI tools, CRMs like Salesforce, or custom HR dashboards.; ; However, there are critical constraints to consider. The API is subject to brand-wide rate limits, typically allowing up to 3,000 requests per minute across all calls. Specific technical limitations also exist, such as a hard limit of 10 embedded data fields when creating distributions via the API. Furthermore, while the API is powerful, implementing complex extensions typically requires significant programming knowledge. It is important to note that Qualtrics does not provide an API sandbox or test environment, meaning all development must be managed carefully within your production instance
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Qualtrics offers extensive customization to align the platform with specific organizational needs. Users can tailor the Survey Builder by choosing from over 70 question types and applying advanced logic, such as branching or embedded data, to create personalized employee journeys. The interface supports branding through custom login pages, logos, and themes, ensuring a consistent user experience.; ; For data analysis, administrators can build role-based dashboards with customizable widgets, charts, and tables. These can be further refined by recoding fields, shortening labels, or creating private pages for internal testing before a broader rollout.; ; Automation is another core customization area. Through Workflows, users can set up no-code triggers for tasks like sending follow-up emails, creating support tickets in systems like Jira or ServiceNow, or updating HRIS data via APIs. This flexibility allows public sector bodies to integrate feedback into existing processes and automate actions across the entire employee lifecycle.

Scaling

• Independence of resources: Qualtrics ensure performance through multi-tenant architecture designed to isolate and protect resources for all UK Public Sector customers. The platform employs sophisticated rate limiting to prevent any single user or organisation monopolising system capacity. By imposing thresholds on API requests and survey distributions, the service maintains stability even during peak demand periods.; ; Furthermore, the infrastructure is built on Amazon Web Services (AWS), which provides elastic scaling to accommodate fluctuating workloads across the entire platform. Automated monitoring by the 24/7 Security Operations Center ensures that traffic spikes are identified and managed instantly, preventing noisy neighbours from impacting your specific production environment

Analytics

• Service usage metrics: Yes
• Metrics types: Qualtrics provides comprehensive service metrics for UK Public Sector organisations to monitor system health and programme impact. Operationally, it guarantees 99.93% monthly system availability for the production environment. Administrators have access to usage metrics through dedicated dashboards, tracking user logins, password changes, and session activity.; ; For programme success, the service measures key performance indicators (KPIs) like employee engagement, intent to stay, inclusion, and well-being. It also tracks operational data, such as response rates and stage-by-stage conversion across the hiring funnel and employee lifecycle.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest: Physical access control, complying with SSAE-18 / ISAE 3402
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: Users can export data through the Data & Analysis tab by selecting Export & Import then Export Data. They can choose from various formats, including CSV, TSV, XML, SPSS, and Excel. For automated processes, the Qualtrics API or Response Export Automations via SFTP are available. Users can further customize exports by selecting specific fields, recoding values, or including survey metadata. Large datasets are managed through a Manage Downloads window where users can track export progress.
• Data export formats:
  • CSV
  • ODF
• Data import formats:
  • CSV
  • ODF

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: 99.93%
• Approach to resilience: Qualtrics ensures service resilience through a robust multi-tenant architecture hosted on Amazon Web Services (AWS). The platform is designed with complete infrastructure and systems redundancy, utilizing multiple physically separate Availability Zones to protect against data centre failures. All data is replicated in real-time across these zones to ensure high availability and integrity.; ; The service employs a sophisticated Disaster Recovery Plan (DRP) and Business Continuity Plan (BCP), which are tested at least twice annually. These plans allow Qualtrics to quickly shift production workloads to unaffected servers in geographically distinct areas during a local catastrophe.; ; To protect overall system performance, Qualtrics uses rate limiters for all tenants, preventing any single user from impacting the experience of others. The infrastructure also features advanced DDoS protection and self-healing capabilities that automatically detect and remediate network events or hardware degradation. Furthermore, daily backups are performed and encrypted to facilitate rapid restoration if required. This layered approach allows Qualtrics to maintain a consistent uptime, historically averaging 99.97%
• Outage reporting: Qualtrics provides two primary channels for reporting and monitoring service outages, ensuring UK Public Sector users are kept informed in real time. For immediate self-service information, users should consult the Qualtrics Status Page, which displays the current operational health of all platform components, including Logins, Surveys, and Dashboards across specific geographic regions like the UK and EU. Users can subscribe to these updates to receive automated notifications if an incident occurs.; ; If you encounter an issue not yet listed on the status page, you can report it via the Customer Success Hub. Once logged in—typically via SAML 2.0 SSO—you can submit a technical support request through live chat, email, or a 24/7 call-back service. For G-Cloud 15 customers, these incidents are managed under a prioritised framework where Critical (P1) issues receive a response within 15 minutes.; ; Brand Administrators also receive in-platform notifications (indicated by a bell icon) and email alerts for important administrative or security events affecting their specific organisation. This dual approach ensures that both global outages and account-specific issues are identified and communicated rapidly to maintain service continuity.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Qualtrics enforces strict access controls through Role-Based Access Control (RBAC) and Single Sign-On (SSO) with mandatory Multi-Factor Authentication (MFA). Administrators use the Admin Page to define granular permissions, ensuring users only access the specific projects or data subsets relevant to their role.; ; For support, access is restricted via the Customer Success Hub, which requires authenticated login. Qualtrics staff cannot access customer accounts by default; such access requires explicit, time-limited permission from the Brand Administrator through a secure "proxy" or "support access" setting, ensuring full buyer control over management interfaces and support interactions
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: Between 6 months and 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: Between 6 months and 12 months
• How long system logs are stored for: Between 6 months and 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
• Information security policies and processes: Qualtrics maintains a robust Information Security Management System (ISMS) designed to protect the confidentiality, integrity, and availability of all data. Our security framework is built upon international standards, including ISO 27001, ISO 27017, ISO 27018, and FedRAMP High, which mandate strict adherence to over 300 security controls based on NIST 800-53.; ; Reporting Structure and Oversight; The overall security function is led by the Chief Security Officer (CSO) and the Chief Information Officer (CIO), who oversee a dedicated team of security professionals. Security governance is managed by a centralised Security Governance Committee responsible for setting policy and strategic direction. This team also operates an in-house Security Operations Center (SOC) that monitors the platform 24/7 for potential threats and anomalies.; ; Ensuring Policy Compliance; To ensure policies are followed, Qualtrics employs a "continuous monitoring" approach. This includes annual independent penetration tests and regular surveillance audits by accredited third-party bodies to maintain our certifications. Internally, all employees undergo security training and are bound by confidentiality obligations, with their access to sensitive systems restricted through Role-Based Access Control (RBAC) and monitored via automated audit logs.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Qualtrics follows a rigorous Change Management process to ensure platform stability and security. Every change is tracked through a centralised management system, requiring documentation of the scope, risk assessment, and peer review before approval. To protect the production environment, updates are first deployed and validated in isolated Staging and QA environments.; ; Deployments are managed by the Site Reliability Engineering team, utilising automated testing and "canary" releases to identify issues early. Post-deployment monitoring ensures performance remains optimal, with predefined rollback procedures available to restore service immediately if any regression is detected.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Qualtrics employs a proactive Vulnerability Management program to identify and remediate risks across the XM Platform. We conduct regular automated scans of our infrastructure and applications to detect known vulnerabilities and misconfigurations. This is supplemented by annual third-party penetration tests and an active Bug Bounty program to uncover complex security flaws.; ; Identified risks are prioritised based on their CVSS score and business impact. High-priority vulnerabilities are addressed within strict, contractually defined SLAs. Our Security Operations Centre (SOC) monitors threats 24/7, ensuring that patches and mitigations are deployed rapidly to protect UK Public Sector data.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Qualtrics utilizes a 24/7 Security Operations Centre (SOC) to perform continuous protective monitoring across the entire platform. We employ Security Information and Event Management (SIEM) systems to aggregate and correlate logs from infrastructure, applications, and network traffic. This allows for real-time detection of unauthorised access attempts, anomalous data movements, or potential system compromises.; ; Threat intelligence feeds are integrated to identify evolving risks, while automated alerts notify our incident response team of high-priority events. This ensures rapid investigation and mitigation, maintaining a secure environment for all UK Public Sector data and services.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Qualtrics employs a 24/7 Security Operations Centre (SOC) to manage incidents. Following the NIST 800-61 framework, we focus on rapid detection, containment, and recovery.; ; For G-Cloud 15 customers, Critical (P1) incidents have a 15-minute response SLA. Post-incident, a Root Cause Analysis (RCA) is conducted to prevent recurrence and ensure platform resilience.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Qualtrics offers a free account with no expiry, including three active surveys, 500 total responses, and basic logic. Additionally, a 30-day trial of our premium Strategic Research suite provides 500 responses, 22+ question types, and advanced analytics tools like Stats iQ to test full enterprise capabilities.
• Link to free trial: Qualtrics.com/en-gb/free-account/

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 5%
• Between £250,000 and £500,000: 10%
• Between £500,001 and £1,000,000: 15%
• Between £1,000,001 and £2,500,000: 20%
• Between £2,500,001 and £5,000,000: 25%
• Over £5,000,001: 30%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Bryan Schader, Moss Adams Certifications LLC
• ISO/IEC 27001 accreditation date: Thursday 16 October 2025
• What the ISO/IEC 27001 doesn’t cover: Anything outside of the scope of the 27001 certification
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: TUV Rheinland of North America
• ISO 9001 accreditation date: Saturday 1 November 2025
• What the ISO 9001 doesn’t cover: Anything outside of the scope of ISO 9901
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 8b9f0af6-5d57-4216-bf1e-325b46e6e328
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: Yes
• Any other security certifications:
  • FedRAMP High: U.S. government's highest standard
  • SOC 2 Type II: Independent audit verifying controls for security
  • ISO 42001: World's first standard for responsible AI systems
  • ISO 27017: Cloud-specific standard for securing cloud service provision
  • ISO 27018: Cloud-specific standard for protecting PII

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Ensuring new workers are informed of their right to join a trade union
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain
    • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

Service documents

• Pricing document

  ODS

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sstaveley@qualtrics.com. Tell them what format you need. It will help if you say what assistive technology you use.