Civica UK Limited


Saffron provides functionality to support the management of catering services across all sectors of the hospitality industry covering recipe/menu engineering inc. nutrition, allergens and dietary preference, e-procurement management, stock control, central production kitchen management, bedside patient/resident feeding, operational trading analysis, analytical reporting and paperless kitchen management.


  • Cloud Hosted- fully managed service
  • Up to Date- Benefit from latest releases, upgrades, and improvements
  • Central Database- Single point of truth across entire organisation
  • Configurable Functionality- only invest in functionality required
  • Interoperability- extensive import/export interfaces enabled
  • Standard User Interface- common working practices improves efficiency
  • Highly Configurable User Profiling- delivers functionality and permissions to stakeholders
  • Supply Chain Integration- supports EDI and non-EDI suppliers
  • Extensive Reporting- multi-format financial and operational reports
  • Analytical Performance Dashboards- Visual KPI Performance monitoring


  • Improve Operational Efficiency- standardize and simplify operational processes
  • Eliminate Accounting Mistakes- reduce double entry of data
  • Increase Profitability- gain greater visibility of potential
  • Healthier Meals- nutritional analysis and menus for allergens/dietary preferences
  • Reduce Food Wastage- identify all aspects of cost control
  • Mobile Operations- complete tasks on Windows, iOS & Android devices
  • Simplify Purchasing Activity- Maximize purchasing compliance with approved purchasing lists
  • Ensure Legal Compliance- Monitor and report upon compliance
  • Improve Decision Making- Access Reports anytime, anywhere
  • Simplify Business Governance- Quickly identify process variations


£3,600 a unit a year

  • Education pricing available

Service documents


G-Cloud 12

Service ID

1 1 7 7 8 5 0 5 8 2 5 4 5 4 4


Civica UK Limited Civica UK Limited
Telephone: 01132441404

Service scope

Software add-on or extension
Yes, but can also be used as a standalone service
What software services is the service an extension to
Saffron has been designed to form part of an organisations wider MIS for example, integrating with supply chain ERP solutions, EPOS and other sales solutions, HR systems to capture labour costs, food labelling systems and the customers finance system.
Cloud deployment model
Public cloud
Service constraints
Saffron will endeavor to ensure availability is an average level of 99.5% of the working days during 3 calendar months excluding any time incurred for a scheduled outage.
Saffron aims to ensure that System maintenance and upgrades are scheduled outside of the Working Day and give 48 hours advance notice.
In the case of an event outside of Saffron’s control requiring immediate rectification, Customers will receive relevant notifications.
Enhanced managed services are available subject to scope and quotation.
Devices to enable the mobile platform can be provided directly by the Customer or Saffron, subject to confirmation of requirements and quotation.
System requirements
  • Access to Internet required
  • Minimum of 2MB recommended, 4MB bandwidth to access the service

User support

Email or online ticketing support
Email or online ticketing
Support response times
Saffron aims to respond to and resolve Faults, during Working Days, in accordance with the following:

1 Critical - 1hr Initial Response, 8hrs Target Fix
2 Urgent - 1hr Initial Response 16hr Target Fix
3 Non-Critical - 4hr Initial Response 16hr Target Fix
4 Information/Alerts - 4hr Initial Response 16hr Target Fix
5 System Enhancement - 30 business days
Fix time is based on elements within Saffron’s control or responsibility and excludes any third-party requirements (hardware fault, loss of communications link, time to approve change)
Resolution, if deemed necessary will be included in a future release at the Company’s discretion.
User can manage status and priority of support tickets
Phone support
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
Web chat
Web chat support availability
9 to 5 (UK time), Monday to Friday
Web chat support accessibility standard
None or don’t know
How the web chat support is accessible
Our web chat service via our website is provided by the plug-in solution “Drift” (
Web chat accessibility testing
Onsite support
Yes, at extra cost
Support levels
Saffron aims to respond to and resolve Faults, during Working Days, in accordance with the following:

1 Critical - 1hr Initial Response, 8hrs Target Fix
2 Urgent - 1hr Initial Response 16hr Target Fix
3 Non-Critical - 4hr Initial Response 16hr Target Fix
4 Information/Alerts - 4hr Initial Response 16hr Target Fix
5 System Enhancement - 30 business days
Fix time is based on elements within Saffron’s control or responsibility and excludes any third-party requirements (hardware fault, loss of communications link, time to approve change)
Resolution, if deemed necessary will be included in a future release at the Company’s discretion.
Support available to third parties

Onboarding and offboarding

Getting started
• Phase One – Engagement & Design
o Customer DocuSign quotation confirming proposal meets requirements
o Initial project meeting establishes delivery criteria, timeline, milestones, and responsibilities.
o Both parties identify scope of any interface requirements, create and sign-off interface specification
• Phase Two - Build
o Project team manage creation of customer instance in AWS
o Project team collate master data, configure client estate profile and initial data import
o Saffron project team and Customer validate imported data
o Customer instance of Saffron built to operational specification and processes tested with Customer.
• Phase Three – Training
o Saffron deliver Administrator training and train the trainer program to customer personnel
o Training provided to initial/pilot sites
o Training provided to all other sites
• Phase Four - Go Live
o Test system is signed off
o Go Live Date confirmed
o Initial/Pilot sites begin trading
o Hyper care support of initial site operations
o Sign off of initial trading period
• Phase Five – Project Sign Off
o Roll out to remaining sites confirmed, scheduled, and delivered
o Project signed off as delivered and passed to Saffron support team
Service documentation
Documentation formats
  • HTML
  • PDF
  • Other
Other documentation formats
  • Microsoft Word
  • Microsoft Excel
  • Microsoft PowerPoint
  • YouTube Video
End-of-contract data extraction
If requested by the Subscriber prior to the date of termination, and at the Subscriber’s expense, FDH shall make available a SQL server backup copy of the Subscriber’s data and User’s Personal Data on a secure SFTP website. The Subscriber may also request read only access to the Subscriber’s data (excluding any User’s Personal Data which shall be deleted by FDH in accordance with this clause) subject to payment of an annual fee which is payable in advance. Details of such fees are available on request. Both parties shall return or destroy the other’s Confidential Information following termination of the Contract.
End-of-contract process
Where a Contract is terminated, all rights granted to the Subscriber under the Contract shall cease and the Subscriber must cease all activities authorised by the Contract including (without limitation) ceasing to use the System; the Subscriber must immediately pay to FDH any sums due to FDH under the Contract. FDH shall delete all User’s Personal Data from its servers thirty (30) days after the termination date. Either party shall give the other at least one hundred and eighty days’ notice in writing prior to the end of the Initial System Term or, following renewal thereafter, one hundred and eighty days prior to the relevant System Renewal Date.
At the end of the contract all user access will be revoked.

Using the service

Web browser interface
Supported browsers
  • Internet Explorer 7
  • Internet Explorer 8
  • Internet Explorer 9
  • Internet Explorer 10
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
  • Opera
Application to install
Compatible operating systems
  • Android
  • IOS
  • Windows
  • Other
Designed for use on mobile devices
Differences between the mobile and desktop service
Key user functionality, such as Beside Ordering, Messaging, Task, Forms, Documents, Stock Taking, Purchasing, Data Capture, Wastage recording and Attendance is enabled on iOS and Android device.

Whilst Saffron Check could be used on any applicable iOS/Android device the solution has been tested, optimized and support services enabled based upon the Samsung A10 tablet.
Service interface
Description of service interface
Saffron is accessed via any web browser (latest versions) and a 2 factor authentication log-in portal that presents the assigned functionality to the user via a web user interface.

Access to Saffron Check is pre-designated based upon the site where the user works and accessed via the iOS or android app
Accessibility standards
None or don’t know
Description of accessibility
Accessibility testing
What users can and can't do using the API
All API services are provided on a bespoke basis
API documentation
API documentation formats
API sandbox or test environment
Customisation available
Description of customisation
Saffron is an off the shelf catering management solution that is, within the framework of Saffron’s functional scope, customized to meet the governance and compliance requirements of each customer.

1. Saffron Functionality Suite – deployment based upon contracted licence arrangements
2. User roles and associated permissions
3. User Interface
4. Business Process Routines e.g. end of week/period
5. Manage VAT codes and processing
6. URL – subject to specification and quotation
7. EPOS Interface
8. Finance System Interface
9. Supply Chain data interface
10. Financial Calendar i.e. Trading Periods
11. Reports Library
12. Analytic Dashboards
13. Ingredient Nutritional Datasets
14. Customer Estate – sites, users, data access


Independence of resources
Saffron is hosted in AWS, the infrastructure of which is monitored by the Saffron Tech Services Team and supporting tools that monitor usage and demand. This approach enables us to adjust the service provision in relation to demand which, within a catering environment, usually increases as week and period end routines are completed.

Customers also have the option, for additional fees, to implement Saffron within a dedicated hosting environment.


Service usage metrics
Metrics types
User metrics are available as part of our enhanced managed service offer
Reporting types
Reports on request


Supplier type
Not a reseller

Staff security

Staff security clearance
Other security clearance
Government security clearance

Asset protection

Knowledge of data storage and processing locations
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least every 6 months
Penetration testing approach
‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest
Encryption of all physical media
Data sanitisation process
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
Equipment disposal approach
A third-party destruction service

Data importing and exporting

Data export approach
• Reports- Data from a number of reports can be exported directly to Microsoft Excel
• Defined System Interface- data can be exported to third party systems using a defined interface specification with data transferred directly between systems or via an SFTP
• Analytical Data Extract- enables high level reporting
• Defined Data Extract- provided by bespoke arrangement the database can be exported to a designated location or secure access provided to the clients’ backup instance.
• EPOS Interface- a standard interface supports two-way data transfer via SFTP with point of sale systems
Data export formats
  • CSV
  • Other
Other data export formats
Data import formats
  • CSV
  • Other
Other data import formats

Data-in-transit protection

Data protection between buyer and supplier networks
TLS (version 1.2 or above)
Data protection within supplier network
TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability
Saffron will use its reasonable endeavors to ensure that Availability is at an average level of 99.5% of the Working Days during a period of 3 calendar months excluding any time incurred for a scheduled outage.
Approach to resilience
Web servers distributed across three separate availability zones within the AWS London region to ensure availability.
Outage reporting
Email alerts
Should unplanned outages occur all clients will be informed of via the Saffron log-in portal and the Saffron Support Team will email the designated customer contact via email. Resolution will also be communicated via email to the designated customer contact.

Identity and authentication

User authentication needed
User authentication
  • 2-factor authentication
  • Username or password
Access restrictions in management interfaces and support channels
Access to any Saffron interface and support channel is enabled through a pre-configured user profile (inc. user name and password) managed by the customer’s system administrator(s), with the option for 2-Factor authentication.
Password Profile – user defined complexity, number of tries and validity period
Profiles enable customer personnel to access functionality, via the Saffron Home Page, relevant to their individual or user group job menus where permissions set against a specific group and then specific users added to a group.
Access restriction testing frequency
At least once a year
Management access authentication
  • 2-factor authentication
  • Username or password

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users have access to real-time audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
At least 12 months

Standards and certifications

ISO/IEC 27001 certification
Who accredited the ISO/IEC 27001
Bureau Veritas
ISO/IEC 27001 accreditation date
What the ISO/IEC 27001 doesn’t cover
ISO 28000:2007 certification
CSA STAR certification
PCI certification
Other security certifications
Any other security certifications
Cyber Essentials

Security governance

Named board-level person responsible for service security
Security governance certified
Security governance standards
ISO/IEC 27001
Information security policies and processes
In order to provide a wide range of services to public and private sector organisations, Saffron maintains an active information security programme.
This programme requires regular internal and external audit inspection of both physical and logical data protection structures.
The policies and procedures are aligned to ISO 27001 and Cyber Essentials certifications.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Saffron's Change Management process ensures that all changes are considered and planned, and appropriate, and that there is a clear audit trail of all changes.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Saffron has vulnerability management processes in place for ISO27001.
These processes are externally audited on a bi-annual basis to ensure continued compliance.
For external vulnerability scanning, Saffron employs the services of an external ‘Intertek’ approved provider to perform a penetration test against the external management IP interface.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
Saffron take a proactive approach to information security through a process of continual monitoring and review.
As part of a documented risk assessment methodology to identify and manage information security risks a dedicated security team update the risk register monthly.
Saffron has a network monitoring solution in place as well as Symantec’s full antivirus and anti-malware solution.
These technologies check the hosted services for errors, infections and unexpected network traffic and are supported by AWS WAF at the perimeter layer.
This monitoring service provides defence in depth, against compromise, by detecting infections and suspicious networking activity within the environment.
Incident management type
Supplier-defined controls
Incident management approach
Saffron have developed an Incident Management process under ISO9001 standard which details both the Incident and Service Request Management processes.
The Saffron Service Desk manages end user Service Requests, Incidents and Requests for Change which can be logged by e-mail, telephone and web portal.

Secure development

Approach to secure software development best practice
Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks


£3,600 a unit a year
Discount for educational organisations
Free trial available

Service documents