ParentPay Limited

Cypad Meal Selection

Pre-ordering of meals by parents from mobile devices, or pupils in classrooms, safe contact-less school dinner take-up by group, and full reporting on, meals served, payments and a healthy meals ethos. Allergen and special diet safeguards cover risk and case management. nutritional supports food education and links to the curriculum.

Features

  • Multiple device ordering from home or in classroom
  • Aggregation of meals by dishes, class, groups
  • Attendance register marked and fed into SIMS
  • Real-time transfer of information to kitchens,school admin
  • Mobile, agile system used in different settings
  • Contact-less, safe, sanitary, epos system: secondaries, primaries
  • Reports on take-up, meal ratings, new menus feedback
  • Built-in safeguards manage allergens and special diets risks
  • Interactive food education displays, themes, backgrounds , messages
  • Connects school food with curriculum, theme days, whole school, community

Benefits

  • Reduces errors, waste and speeds up school dinner service
  • Streamlines communication between stakeholders
  • Drives take-up and reduces paper process for several tasks
  • Evidences Quality Assurance, School Food Standards, Health & Safety
  • Increases allergen and special diets safety nets
  • Removes need for queuing at dinner service
  • Click-&-Collect contactless meal pre-order and collection for secondaries
  • Improves planning with pupil rating, feedback for new, popular menus
  • Supports development of healthy eating habits to reduce childhood obesity
  • Provides marketing opp and info for caterers and school

Pricing

£399 a unit a year

  • Education pricing available

Service documents

Framework

G-Cloud 12

Service ID

1 4 2 8 7 4 9 7 7 0 5 9 1 1 5

Contact

ParentPay Limited Nicola Howard
Telephone: 07881915899
Email: nicola.howard@parentpay.com

Service scope

Software add-on or extension
Yes, but can also be used as a standalone service
What software services is the service an extension to
It works with and enhances other ParentPay Group products such as Kitchen Manager and Online Payments.
Cloud deployment model
Hybrid cloud
Service constraints
Planned maintenance windows are applied out of hours
System requirements
  • Modern supported Web Browser, security patches applied
  • Browser Javascript Support
  • Browser Cookies Support
  • TLS1.2 Transport Encryption Support

User support

Email or online ticketing support
Email or online ticketing
Support response times
As per SLA. Standard Classifications are: P1 - Serious. Resolved within 6 working hours (24x7) P2 - Non-Serious. Resolved within 16 working hours ( 2 days ). Office Hours Only. Tickets can be logged 24x7 via email or online web support form. Telephone lines are available from 08:30 to 16:30 Mon - Fri. All systems are monitored 24x7 by our own team of infrastructure engineer
User can manage status and priority of support tickets
No
Phone support
Yes
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
No
Onsite support
Yes, at extra cost
Support levels
Comprehensive details of support are available in the ParentPay standard Terms & Conditions submitted as part of this service description. As a SAAS solution there is little requirement from schools for onsite support. On site training is available if required by our specialist training managers. Cost available on request.
Support available to third parties
Yes

Onboarding and offboarding

Getting started
Web-based and telephone training, project management, onsite training and a support documentation library is available to all users of the system
Service documentation
Yes
Documentation formats
  • HTML
  • PDF
End-of-contract data extraction
Upon completion or termination of the contract, the service will for up to thirty (30) days following such termination permit customer to export its data, in accordance with the capabilities of the service. Following such period, data stored or processed on behalf of the customer shall be removed or anonymised in accordance with the organisations Data Protection Policy, Privacy Notice, and Data Retention and Disposal Policy.
End-of-contract process
Annual licence fee is included. No additional end of contract cost.

Using the service

Web browser interface
Yes
Supported browsers
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
  • Opera
Application to install
No
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
Native mobile applications are available for iOS and Android
Service interface
Yes
Description of service interface
The service is accessed through a standard secure web browser interface. All interfaces have been designed with effective user experience and accessibility in mind.
Accessibility standards
None or don’t know
Description of accessibility
All interfaces have been designed with effective user experience and accessibility in mind and based on WCAG 2.1 AA.
Accessibility testing
No specific testing is conducted, however all interfaces have been designed with accessibility in mind, based on WCAG 2.1 AA.
API
Yes
What users can and can't do using the API
Customers can access a data extraction API
API documentation
Yes
API documentation formats
PDF
API sandbox or test environment
Yes
Customisation available
Yes
Description of customisation
Customers can upload logos to customise their service.

Scaling

Independence of resources
The core platform is privately managed and does not share capacity with any other tenants. Customer data is logically separated through robust application logic which is regularly tested. Significant redundancy is built into the infrastructure and server capacity to ensure the service is always available.

Analytics

Service usage metrics
Yes
Metrics types
Service metrics are provided as required by the client. Standard metrics are platform uptime, support tickets, escalations, activation rates and health reports.
Reporting types
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

Supplier type
Not a reseller

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Baseline Personnel Security Standard (BPSS)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
No
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least once a year
Penetration testing approach
‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
Data sanitisation process
Yes
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
Data can be exported using the microsoft suite of tools such as Excel.
Data export formats
CSV
Data import formats
CSV

Data-in-transit protection

Data protection between buyer and supplier networks
TLS (version 1.2 or above)
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability
As per SLA
Approach to resilience
Significant redundancy and resilience is built into the infrastructure and server capacity to ensure the service is always available. Enterprise monitoring solutions are deployed and the service is maintained on a 24x7 basis by a full IT team. Capacity management processes and procedures are established.
Outage reporting
In the event of an incident or outage, emails are sent to nominated contacts. Notifications are also sent to devices where appropriate.

Identity and authentication

User authentication needed
Yes
User authentication
Username or password
Access restrictions in management interfaces and support channels
Infrastructure management interfaces are only accessible via secure VPN and all access is protected by Multi-Factor-Authentication (MFA).
Access restriction testing frequency
At least every 6 months
Management access authentication
Username or password

Audit information for users

Access to user activity audit information
Users contact the support team to get audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users contact the support team to get audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
At least 12 months

Standards and certifications

ISO/IEC 27001 certification
No
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Other security certifications
Yes
Any other security certifications
Cyber Essentials Plus

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
  • CSA CCM version 3.0
  • ISO/IEC 27001
  • Other
Other security governance standards
PCI-DSS
Cyber Essentials Plus
Information security policies and processes
Cypad operates under an ISO 27001 certified Information Security Management System (ISMS) - this has been certified by a UKAS accredited certification body. A dedicated security team of qualified specialists maintain, monitor and enforce technical and organisational security controls. We are audited by independent specialist third parties at least four times per year. Cypad operate a comprehensive catalogue of security policies, processes and procedures; Including but not limited to: Security Policy. ISMS Manual. Acceptable Use Policy. Access Control and Onboarding-Offboarding. Business Continuity Strategy. Business Continuity Plans. BYOD Policy. Capacity Management Policy. Change Control Process. Clear Desk Policy. Cryptography, Certificates and Key Management Policy. Data Protection Policy. Data Retention and Disposal Policy. Development Process Standards and Practices. Firewall & Router Configuration Strategy. Incident Response Procedures. Information Classification and Handling. IT Decommission Process. Password Policy. Patch and Vulnerability Management Strategy. Physical Security Policy. Security within Project Management. Remote Working and Mobile Device Policy. Security Considerations for Key Decision Makers. Social Media Policy. Supplier and Third Party Management Policy. System Build Standards. IT Documented Operating Procedures.

Operational security

Configuration and change management standard
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach
Full change control process is applied to the product and hosting infrastructure. This applies to all assets. Changes require CAB review and approval. Security considerations are specifically identified as a strict requirement.
Vulnerability management type
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach
Internal and external components are assessed by industry leading vulnerability scanners on a weekly basis. Additional cyber risk assessment tools monitor OSINT data feeds on an ongoing basis. Any and all findings are subject to risk assessment and suitable remediation through change control processes. Critical and Security updates to be installed within one month of release. All other available vendor updates to be installed within 3 months of release. We actively participate in a threat sharing community and monitor special interest security groups continuously.
Protective monitoring type
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach
We operate network and host based intrusion detection systems. All infrastructure components and logging is supported by a SIEM platform, including User-Behaviour-Analytics (UBA) capabilities. Endpoint and back-office systems run DLP controls to help detect and prevent data loss events. External breach indicators are also independently monitored on an ongoing basis. Canary tokens and honeypot technology is also applied. We operate, train and regularly test a comprehensive Incident Response Programme - including forensics evidence collection capabilities. Security Incidents are responded to immediately following identification, by a dedicated security team.
Incident management type
Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach
Our detailed Incident Response Programme has developed a full array of specific response processes for particular events. We operate, train and regularly test the full process - including forensic evidence collection processes. Security Incidents are responded to immediately following identification, by a dedicated security team. All employees are required to report any confirmed or suspected security incidents. The security team can be contacted by customers, users or employees at any time via email or telephone. Detailed incident reports are provided as necessary - including an executive summary, event timeline, investigative and containment steps, root cause analysis, remediation and lessons learned.

Secure development

Approach to secure software development best practice
Conforms to a recognised standard, but self-assessed

Public sector networks

Connection to public sector networks
No

Pricing

Price
£399 a unit a year
Discount for educational organisations
Yes
Free trial available
No

Service documents