Bramble Hub Limited

Bramble Hub Icon - SignAnywhere and SIGNificant eSigning Solutions

An e-signing solutions that provides a range of technologies to assist workflow, document creation, multi-channel output, biometric authorisation options and more.

Features

  • HTML5 based siignatures on any device
  • Biometric handwritten signatures
  • Sign on Phone
  • Certificate based signing
  • Workflow for multi-participant signing ad review
  • Biometrict Identity Management
  • e-forms validation and e-signing
  • eIDAS complient e-signing of document
  • Easy integration into existing applications and workflow
  • Full audit trails

Benefits

  • ISO 3200 & ISO 19005 future-proofed signed documents
  • Automated and managed multi-participant signing solution
  • On solution that provides all types of signing methods
  • Fully eIDAS complient solution
  • Forensically identifiable digital signatures on tablets, mobiles, and signature pads
  • Full set of API for Windows, Androis and iOS
  • Paper reduction, Faster turnaround, Imporved security and compliance
  • Legal admissibility, imporved customer experience
  • Socially accepted and real-time identity management
  • Choice of data storage options, Scalable, Rapid Deployment

Pricing

£0.22 per transaction

  • Free trial available

Service documents

Framework

G-Cloud 11

Service ID

2 2 0 1 2 7 0 2 6 1 3 0 7 5 4

Contact

Bramble Hub Limited

Roland Cunningham

+44 (0) 2077350030

contact@bramblehub.co.uk

Service scope

Software add-on or extension
Yes, but can also be used as a standalone service
What software services is the service an extension to
The signing solution can output the signed document to an archiving solution of choice, cloud based or on premise. Digital certificates can be issued and used dynamically based on our LiveID solution.
Cloud deployment model
  • Public cloud
  • Private cloud
  • Hybrid cloud
Service constraints
None
System requirements
  • Azure platform is in Microsoft’s Western European data centre
  • A certificate is required during a signing process
  • Significant server components require Windows server 2008/2013

User support

Email or online ticketing support
Email or online ticketing
Support response times
Support levels are determined by the severity of any incident or request. Response times for critical (severity 1) is 1 hour. For non critical it is 4 hours and for the least important response time is 8 hours.
User can manage status and priority of support tickets
No
Phone support
Yes
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
Web chat
Web chat support availability
9 to 5 (UK time), Monday to Friday
Web chat support accessibility standard
None or don’t know
How the web chat support is accessible
Web chat meets WCAG 2.0 A
Web chat accessibility testing
None
Onsite support
Yes, at extra cost
Support levels
Icon UK provides standard technical support services between 9am and 5pm UK time on normal UK working days. Our support services can be contacted either by telephone or email, getting through to trained technical support engineers. Extended 24 x 7 support is available (for an uplift associated with this, depending upon particular circumstances).
Support available to third parties
Yes

Onboarding and offboarding

Getting started
On-line documentation and videos are available. Remote support is also available.
Service documentation
Yes
Documentation formats
  • HTML
  • PDF
  • Other
Other documentation formats
Online video
End-of-contract data extraction
Finalised documents are not stored on our systems, but archive to the system of choice on an ongoing basis.
End-of-contract process
Customers can export all certificates and signed documents.

Using the service

Web browser interface
Yes
Supported browsers
  • Internet Explorer 10
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
  • Opera
Application to install
No
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
The mobile app are designed to allow documents to be signed even when a network connection is unavailable, in off-line mode. When a connection becomes available the signed document is uploaded to the cloud server for processing. With the desktop all services are on-line and are access through a web browser.
Service interface
Yes
Description of service interface
Redmine is used to submit and track issues
https://www.redmine.org
Accessibility standards
None or don’t know
Description of accessibility
The interface is for support personnel to submit and track issues, and is not intended to be used by end users.
Accessibility testing
https://www.powermapper.com/products/sortsite/ads/acc-wcag-testing/
This testing tool was used to identify WCAG accessibility
API
Yes
What users can and can't do using the API
The APIs provide the following functionality: Initiate batch, Initiate interactive creation of a document, Fetch additional data via call-backs, Fax, Print, e-mail, SMS, Import of legacy template components (logos, fonts, text blocks, Business logic, etc)
API documentation
Yes
API documentation formats
  • HTML
  • PDF
  • Other
API sandbox or test environment
Yes
Customisation available
Yes
Description of customisation
Look and feel can be changed, or embedded into other applications

Scaling

Independence of resources
There is a capacity management threshold policy that ensures all resources are monitored and adjusted to ensure the SLA is always maintained.

Analytics

Service usage metrics
Yes
Metrics types
Metrics can be recorded at several levels: User usage, Pages signed, Documents Signed, Biometric signatures validated, Biometric signature profiles created
Reporting types
  • API access
  • Regular reports
  • Reports on request

Resellers

Supplier type
Reseller providing extra support
Organisation whose services are being resold
Namirial GmbH

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Baseline Personnel Security Standard (BPSS)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
User control over data storage and processing locations
Yes
Datacentre security standards
Supplier-defined controls
Penetration testing frequency
At least once a year
Penetration testing approach
In-house
Protecting data at rest
Other
Other data at rest protection approach
FIPS-assured encryption, assured by independent validation of assertion
Data sanitisation process
Yes
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
Equipment disposal approach
In-house destruction process

Data importing and exporting

Data export approach
By making a request to the help desk, who will then provide the data in the requested format.
Data export formats
  • CSV
  • Other
Other data export formats
  • XML
  • JSON
  • Export to a cloud based database
Data import formats
  • CSV
  • Other
Other data import formats
  • XML
  • JSON
  • PDF

Data-in-transit protection

Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
  • Other
Other protection between networks
VPN using TLS, version 1.2 or later
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
  • Other
Other protection within supplier network
VPN using TLS, version 1.2 or later

Availability and resilience

Guaranteed availability
We have a range of SLAs with up to 99.995% availability.
Approach to resilience
The services are delivered by load balanced servers in two locations. Services can be maintained with only a single server. Minimum configuration is to have two servers in two different locations making the minimum configuration 4 in total. All environments are virtual and are dynamically reallocated to a different physical server if required due to any hardware failure.
Outage reporting
Outage reports are provided by e-mail.

Identity and authentication

User authentication needed
Yes
User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Dedicated link (for example VPN)
  • Username or password
  • Other
Other user authentication
By use of a biometric signature, validated against a known secure registry
Access restrictions in management interfaces and support channels
Through a rights and roles management system, linked to an identity or group of identities.
Access restriction testing frequency
At least once a year
Management access authentication
  • 2-factor authentication
  • Username or password
  • Other
Description of management access authentication
For on-prem or hybrid solutions the authentication method is user determined, and could be 2FA or any of the above methods

Audit information for users

Access to user activity audit information
Users contact the support team to get audit information
How long user audit data is stored for
User-defined
Access to supplier activity audit information
Users contact the support team to get audit information
How long supplier audit data is stored for
User-defined
How long system logs are stored for
User-defined

Standards and certifications

ISO/IEC 27001 certification
No
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Other security certifications
No

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
No
Security governance approach
We operate accordingly to ISO27001 standard (but note we are not audited) and to the Cloud Security Alliance Checklist 3.0.1
Information security policies and processes
We operate accordingly to ISO27001 standard (but note we are not audited) and to the Cloud Security Alliance Checklist 3.0.1

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
We maintain a comprehensive release management process, which includes (1) release plan and document, architectural review, functional testing, regression testing, security review and security testing (if required). Post release we undertake PVT. We have roll back procedures for all releases. Client comms are managed in advance via our client service team.
Vulnerability management type
Undisclosed
Vulnerability management approach
Vulnerability Management consists of: Assessment, Monitoring, Mitigation Prioritisation, tracking and Mitigation timescales.
Protective monitoring type
Undisclosed
Protective monitoring approach
We leverage the standardised and accredited vulnerability management processes of our Cloud Providers (Oracle and AWS)
Incident management type
Undisclosed
Incident management approach
All incidents are taken through an ITIL incident management process. This includes the processes, email incident reporting and management reporting.

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks
No

Pricing

Price
£0.22 per transaction
Discount for educational organisations
No
Free trial available
Yes
Description of free trial
There is a 30 day trial of the SignAnyWhere solution, and Mobile application

Service documents

Return to top ↑