Qubix International Ltd

Qubix Oracle Enterprise Performance Management

Oracle EPM Cloud is the leading Enterprise Performance Management software suite covering the entire financial cycle from Forecasting to Close. Qubix is an innovative, award-winning implementer of this technology, with many public sector success stories and cost-saving accelerators.


  • Budget and Forecast Creation and Adjustment
  • Tracking Actual performance vs Forecast or Budget
  • Reconcile Accounts efficiently and repeatably
  • 'What-if' Scenario Planning (e.g. for post-Covid operational change)
  • Manage and Drive Profitability or Financial Goal Effectiveness
  • Pay modelling and driving toward performance targets
  • Full dashboarding, reporting and 'burst' report sending
  • Spreadsheet and MS Office Integration
  • Optimise Financial Close
  • Organise data with MDM, Data management and Integration


  • Effective and rapid Budget and Forecast Creation
  • Track actual performance compared to Budget and Forecast
  • Improve change planning with scenario modelling
  • Burst Reports to stakeholders automatically saving time
  • Satisfy all your reporting and financial compliance requirements
  • Make finance teams more efficient and operate with fewer people
  • Reduce the FP&A cycle period allowing more analysis time
  • Make organisational change more efficient and predictable
  • Model Income, Capex, Pay and other Expenditure
  • Reduce data issues, risk and mistakes from spreadsheets


£180 a user a month

  • Free trial available

Service documents


G-Cloud 12

Service ID

1 1 3 5 5 2 8 4 5 5 6 9 3 4 8


Qubix International Ltd Paul Johnston
Telephone: 01483 480222
Email: paul.johnston@qubix.com

Service scope

Software add-on or extension
What software services is the service an extension to
Oracle EPM Cloud Platform is used for this service. Qubix will build services for the Public sector with the various modules of this technology.
Cloud deployment model
  • Public cloud
  • Private cloud
Service constraints
The service is configurable. Customers may wish to introduce constraints (such as using fewer modules) to save money.
Each user of the service requires a user license, though they can burst reports to staff that do not have a license.
System requirements
  • (With the service) Client would purchase Oracle EPM Cloud License
  • For MS Office Integration, MS Office 2003+ is required

User support

Email or online ticketing support
Email or online ticketing
Support response times
Platform Service is 24x365

Functionality Support provision is 8-6pm Mon-Friday.
Extended Support hours are available on request.
User can manage status and priority of support tickets
Online ticketing support accessibility
WCAG 2.1 AA or EN 301 549
Phone support
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
Onsite support
Onsite support
Support levels
Application Service Support is provided by Oracle Corporation, and provides an unlimited level of Support engagement over the course of the contract.

Functionality Support is provided by Qubix International. A number of different arrangements are possible based on either a consumption credits model or a Service Agreement-based flat-rate model. The standard contract is a consumption-based model, where the customer is supplied credits that they can consume on support tickets, change, or training. Credits are supplied free with the service, with additional at £625 per credit (4 hours). Service Agreement-based provision is by agreement and depends on the Service Catalogue options chosen. Genertally, clients with this service do not need to purchase additioal credits beyond the free provision.

Qubix and Oracle provide Account Managers. These resources have technical knowledge, but likely will not change configurations.
Support available to third parties

Onboarding and offboarding

Getting started
We perform many different types of engagements with this technology from advisory to full green-field implementation projects. Assuming a full project, the cycle would look like this:

Ahead of the project:
Demos of technology. Exposure to Qubix internal systems. Agree Strategy.

In project (Build Phase):
Show and tell phases (on site and remote). Component Demos. Training of core customer team on components (on site and remote).

Training Phase:
Training on Core EPM Technology to wider team (on-site, live classroom or remote we-classroom - both with system access)
Training on capabilities, best practice and usage to exec team (on-site or remote coaching)
Training on Platform to IT Team (usually remote)
(Option) Access to Qubix Academy web-based training resource (web-based training)

Post go-live Adoption Phase
Analysis of process usage.
ELS for important issues

Regular healthchecks / support checks
Exposure to new product functionality via briefings
(Optional) Access to Qubix Academy (web-based training)
(Optional) Access to additional free and paid-for Qubix and Oracle training
Service documentation
Documentation formats
  • HTML
  • PDF
End-of-contract data extraction
The system is securely torn-down at end-of-life, so only data that needs to be retained needs to be removed from the service. The easiest mode of achieving this is to extract the data with web interface.
However, Qubix can also perform this service for our customers.
End-of-contract process
Teardown of systems and removal of data is provided on contract termination.
The only additional charge is if certain options for the transfer of data are taken-up, which was provided on the previous response.

Using the service

Web browser interface
Supported browsers
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
  • Opera
Application to install
Compatible operating systems
  • Android
  • IOS
  • MacOS
  • Windows
Designed for use on mobile devices
Differences between the mobile and desktop service
All of the desktop web-access functionality is present, However, MS Office integration using the SmatView extension is only possible on Desktop.
Service interface
Description of service interface
There is a web interface to manage the overall Cloud Service, though it's unlikely that customer's users would need to ever access it other than to manage security.
Accessibility standards
WCAG 2.1 AA or EN 301 549
Accessibility testing
The console is provided by Oracle Corp. Oracle is committed to providing accessible technology and this is built into their standard testing regime.

Policy information on same is provided here:

Details of testing programmes are available here:
What users can and can't do using the API
There are API Layers to the ERP Cloud this APIs allows a full range of functionality to be exploited.
API documentation
API documentation formats
API sandbox or test environment
Customisation available
Description of customisation
The service is fully customisable, however, Qubix would deliver a fully-functioning product in a project phase.


Independence of resources
The Oracle platform uses various controls to prevent noisy neighbours from impacting provision of service. The way this is achieved requires a full architecture overview, but basically it virtualises customers independently and ensures that provision is ringfenced to these virtual notes, and that hardware provision for these nodes is distributed effectively, and onto physical hardware that is not over-subscribed.
The Oracle Cloud platform is the only one to guarantee latency of NVMe storage (for example) as a result of this approach.


Service usage metrics
Metrics types
Metrics are available across the service. Key examples include:

1. Usage
The system tracks all user interactions, and it is possible to audit who has been working on all areas of the system.
2. Security metrics (user logons, resets, etc)
3. Support ticket status
4. Support Credits used (for functional support via Qubix)
Reporting types
  • Real-time dashboards
  • Regular reports
  • Reports on request


Supplier type
Reseller providing extra features and support
Organisation whose services are being resold
Oracle Corporation

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Security Clearance (SC)

Asset protection

Knowledge of data storage and processing locations
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
User control over data storage and processing locations
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least once a year
Penetration testing approach
Another external penetration testing organisation
Protecting data at rest
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Encryption of all physical media
Data sanitisation process
Data sanitisation type
Deleted data can’t be directly accessed
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
Users can export data via the web GUI, and this can be exported to their devices or to cloud object storage. It is also possible to use the spreadsheet link for this purpose.
Also, there is a Data management layer that allows all sorts of ETL, import/export jobs to be built and run.
Data import/export is a platform capability, so there are many options to achieve this task, and the best one to use would depend on the amount of data and if the task was going to be repeated.
Data export formats
  • CSV
  • Other
Other data export formats
  • XML
  • Xls, xlsx
  • Pdf
  • We can handle almost anything else via CloudBridge conversions
Data import formats
  • CSV
  • Other
Other data import formats
  • Xls, xslx
  • XML
  • We can handle almost anything else via CloudBridge conversions

Data-in-transit protection

Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Bonded fibre optic connections
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability
SLA for the technology components is 99.95% .
This commitment is described in this linked document:

If availability targets are not upheld, Service credits are applicable. The level of these depends on the level of service requested, since they are calculated as a percentage of these fees. This is described in section of the linked document.
Approach to resilience
The architecture design of the Oracle Cloud Infrastructure (which hosts all of the PaaS components for Qubix Cloudbridge and the SaaS EPM Cloud) is world-class in terms of design for resilience.
There is redundancy at all hardware layers within an availability domain (data centre) and across availability domains. Local fault domains ensure that resources are allocated to the appropriate hardware, and that there is no resource bottlenecks on this hardware.
In addition to this underpinning resiliance, resources can be created with multiple servers that are front-ended with load balancers (or Oracle RAC for the Database). This will remove any single point of failure from the set-up.
This linked document has additional details:
Outage reporting
The Oracle SaaS platform reports service availability on a (customer accessible) Dashboard, and administrators get emails of service issues.
The system availability status can be made available via an API.

Identity and authentication

User authentication needed
User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
Access restrictions in management interfaces and support channels
The Security layer for the PaaS Cloud is entirely independent of the Application Technology and Data Layer. This means there are not the usual issues with hierarchical security management where you always need (technical) administrators with access to data.
For this reason, there is role-based access layer that allows provision of the correct level of access to all of the components, including Support Channels and Management consoles.
Access restriction testing frequency
At least once a year
Management access authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users have access to real-time audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for

Standards and certifications

ISO/IEC 27001 certification
Who accredited the ISO/IEC 27001
EY/CertifyPoint BV, Amsterdam, Netherlands
ISO/IEC 27001 accreditation date
What the ISO/IEC 27001 doesn’t cover
All the components in the solution are covered by the above Certification.

However, extension services such as the training platform and support console (which are from other providers) are not.
ISO 28000:2007 certification
CSA STAR certification
CSA STAR accreditation date
CSA STAR certification level
Level 1: CSA STAR Self-Assessment
What the CSA STAR doesn’t cover
All the components in the solution are covered by the above Certification.

However, extension services such as the training platform and support console (which are from other providers) are not.
PCI certification
Who accredited the PCI DSS certification
Not disclosed
PCI DSS accreditation date
What the PCI DSS doesn’t cover
The Analytics Component and the CloudBridge integration are not covered (these, in any case, can't be covered, as they have flexible data storage options that could lead to non-compliance against a standard based on customer use).
Other security certifications
Any other security certifications
  • Cyber Essentials Plus certification
  • DISA SRG—Defense Information Systems Agency, Security Requirements Guide
  • CJIS—Criminal Justice Information Services
  • United Kingdom Cloud Security Principles

Security governance

Named board-level person responsible for service security
Security governance certified
Security governance standards
  • ISO/IEC 27001
  • Other
Other security governance standards
There are several dozen security compliance standards that the solution is compliant it, including:
United Kingdom Cloud Security Principles
Data Privacy Act
GDPR—General Data Protection Regulation
A full list is contained here:
Information security policies and processes
The overall security policies are the responsibility of the Qubix Operations Director, who is a member of the Qubix Board. There are different policies in place for the various different aspects of security, such as password policies on builds, and asset security.
For the implementation of security policies this is led by either Product Managers (if building or changing products) or Project Managers for individual project implementations.
We occasionally use 3rd parties for independent testing against policy (for example penetration testing of our products or systems).

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Qubix has robust change and configuration management that allows it to build complex technology products and manage these across a wide install base.
Products are comprised of features, which can be independently introduced, changed, deprecated, and removed from the product. Features have their own version control and code management. The products also have their own versioning, as do the underpinning platform components. We use a variety of in-house (such as our corporate Wiki) and commercial tools (such as GitHub) to manage and deploy these configurations.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Some aspects of the Oracle SaaS Cloud are not disclosed in order to protect overall security. However, some relevant facts are:
Patches are kept up-to-date in a monthly cycle + emergency patches. Functionality updates are quarterly.
Oracle has an entire corporate area looking at vulnerability management and threat and threat vector identification is handled has part of this overall security management of its Cloud.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
There is a full application-monitoring layer built into the Oracle EPM SaaS cloud. This will raise alerts for admins, and can also be linked to wider service monitoring technology. This protects the infrastructure and application layers. In terms of service response, this means there is practically no delay between service impact and rectification teams being made aware.
In addition to this, we have Service Monitoring technology built into the CloudBridge, which will raise alerts instantly on service impact to Business Functionality (BPM Alerting).
Incident management type
Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach
The IM process is essentially an ITIL-aligned, structured process where the primary objectives are:
1. An easy and pleasant experience for the users.
2. Effective and efficient routing of the problem to the people that can address it.
3. Fastest possible end-to-end solution of the issue.
Users can log calls via eMail, web form, or phone.
Incident reports are provided monthly, and if there has been a major incident as soon as that report is prepared.

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks


£180 a user a month
Discount for educational organisations
Free trial available
Description of free trial
Pilot available with minimum dataset integration for up to 10 users.

Time period max 2 months.

Service documents