TRUSTFOLIO LTD

Trustledger

The Platform provides Local Authorities with a single view of debt portfolios and allows them to automate manual processes without compromising on quality or compliance. It enables seamless digital communication and engagement with Insolvency Practitioners and Debt Management Companies for increased time and cost savings and a more collaborative approach.

Features

• Cloud based, no time or resource to set up
• Digitises all communications with debt solution providers.
• Automates decision making within agreed mandate
• Lists data exceptions for individual attention
• Displays debt solution accounts in one easy to access place
• Produces useful management information automatically

Benefits

• Reduces resources required to manage portfolio of accounts in debt
• Frees up staff to concentrate on more demanding tasks
• Increases the visibility of debt portfolio
• Improves the turnaround time of voting in IVAs
• Facilitates the secure provision of required documents
• Digitises processes to remove paper and unsecure data processing
• Drives efficiency in data processing and storage
• Improves data security and compliance with GDPR
• Drives faster and more decisive outcomes for customers
• Enables a digital flag to highlight financial vulnerable individuals

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at services@trustfolio.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

999757322793087

Contact

Tom Reeves
07555217893
services@trustfolio.co.uk

About the service

• Service categories:
  • Applications
    • Enterprise resource management
      • Financial
        • Financial and Accounting Applications
        • Accounts Receivable Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: Users must be using Microsoft Entra if they require single sign on (as opposed to username and password separately managed in the application).
• System requirements: NA

User support

• Email or online ticketing support: Yes
• Support response times: We expect to respond to all queries by close of the following working day. Working day defined as Monday to Friday on a non-public bank holiday.
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: Yes
• Support levels: We provide training and onboarding support either electronically or on site and general ongoing support via our ticketing system Monday to Friday. We also have our personnel's contact phone numbers on email footers for emergency phone support. On site support has not been a necessity to date but we remain flexible as to the specific requirements of our customers.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We have a managed onboarding process whereby we provide consultation on system configuration. We then run online or onsite training and demonstrations as required. We assist with management of transition from existing processes to the new platform. We further support with access to committed additional onboarding resource throughout the first month and we have a dedicated support team on standby thereafter.
• Service documentation: Yes
• Documentation formats: PDF
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: These are provided to key personnel as part of the onboarding process
• End-of-contract data extraction: Users are given access to download and export necessary documentation for a specified period at the end of the contract term.
• End-of-contract process: Upon termination we allow access to the system for the user to access relevant documentation at no extra costs. Any further, bespoke requirements would be chargeable.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• Description of service interface: The service interface is a secure online portal that enables our customers to access and review data, process documentation and produce reports about their use of the services
• Accessibility standards: None or don’t know
• Description of accessibility: Through a secure login the service is available via a web browser interface. The system allows users to view and respond to documentation and information requests pertinent to the requirements of debt and insolvency solutions being adopted by debtors.
• Accessibility testing: Tested for use with colourblind people but not beyond this use case.
• User support accessibility: None or don’t know
• API: No
• Customisation available: Yes
• Description of customisation: Administration users only can customise and configure:; - User permissions; - Team structures ; - Automation rules; - Display themes

Scaling

• Independence of resources: A fully scalable service is securely provided my Microsoft Azure

Analytics

• Service usage metrics: Yes
• Metrics types: Service metrics are provided through accessible reports which can be downloaded as CSV files.
• Reporting types:
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: Less than once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Data Erasure
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: The system facilitates export of user data which can be exported as a CSV file
• Data export formats: CSV
• Data import formats: Other
• Other data import formats: Users can upload PDF documents only

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Our availability of service mirrors that of Microsoft Azure and any disruption to service is remedied by an pro-rata extension of the service contract and not as a refund.
• Approach to resilience: All of our assets are hosted in Microsoft Azure and are located in the UK South Microsoft Data centre. This means we have the same level of asset protection and resilience as provided by Microsoft Azure itself. We have no physical assets so need no security around access to assets or redundant hardware in case of failure. We have the ability to relocate our services to a different Microsoft Data Centre in the event that the UK South data centre suffers a failure.
• Outage reporting: E-mail alerts

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Only defined administrator users have access to management interfaces
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We follow strict information security policies in accordance with our ISO/IEC27001:2022 accreditation. We further hold an annual internal audit and ISO audit, both conducted by external, approved organisations.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We operate a Microsoft Dev Ops system which tracks all changes which are implemented using agile methodology. Any changes deemed to have a potential impact on security are reviewed through an internal sign off process. all information assets are located in Microsoft Azure which provides alerts to changes as well as change and access logs.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We use specialist software to flag any vulnerabilities that might pose a threat to our services.; All security updates are set up to automatically install.; Critical patches are installed within 1 month of release.; Information about potential threats comes from Community websites including CVE and we also operate an OWASP methodology for vulnerability management within our code.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We utilise Microsoft Azure security scans to identify and alert us to compromises, suspicious activity or attacks.; We have a documented Incident Response procedure that defines an Incident Response Team, how they handle any security incidents, and who is responsible for each part of the response. In the unlikely event of a successful attack then any clients whose data may have been compromised are notified.; Incidents are investigated and assessed immediately, responses are made accordingly.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: Yes
• Incident management approach: We have a documented Incident Response procedure which is followed when incidents arise and is reviewed annually, this procedure is triggered upon receipt of incident notification.; Users can report incidents via email or telephone.; All incidents are logged and reported internally in our risk and compliance meetings.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: Peers Quality Assurance Ltd
• ISO/IEC 27001 accreditation date: Tuesday 3 June 2025
• What the ISO/IEC 27001 doesn’t cover: NA
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 1f008cf0-1b26-49c7-95de-784f770fc349
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • Plans to engage the contract workforce in deciding the most important workplace issues to address
  • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

  • Understanding of issues relating to entering the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at services@trustfolio.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.