Bramble Hub Limited

Bramble Hub Icon - SignAnywhere and SIGNificant eSigning Solutions

An e-signing solutions that provides a range of technologies to assist workflow, document creation, multi-channel output, biometric authorisation options and more.

Features

  • HTML5 based siignatures on any device
  • Biometric handwritten signatures
  • Sign on Phone
  • Certificate based signing
  • Workflow for multi-participant signing ad review
  • Biometrict Identity Management
  • e-forms validation and e-signing
  • eIDAS complient e-signing of document
  • Easy integration into existing applications and workflow
  • Full audit trails

Benefits

  • ISO 3200 & ISO 19005 future-proofed signed documents
  • Automated and managed multi-participant signing solution
  • On solution that provides all types of signing methods
  • Fully eIDAS complient solution
  • Forensically identifiable digital signatures on tablets, mobiles, and signature pads
  • Full set of API for Windows, Androis and iOS
  • Paper reduction, Faster turnaround, Imporved security and compliance
  • Legal admissibility, imporved customer experience
  • Socially accepted and real-time identity management
  • Choice of data storage options, Scalable, Rapid Deployment

Pricing

£0.22 per transaction

  • Free trial available

Service documents

G-Cloud 11

220127026130754

Bramble Hub Limited

Roland Cunningham

+44 (0) 2077350030

contact@bramblehub.co.uk

Service scope

Service scope
Software add-on or extension Yes, but can also be used as a standalone service
What software services is the service an extension to The signing solution can output the signed document to an archiving solution of choice, cloud based or on premise. Digital certificates can be issued and used dynamically based on our LiveID solution.
Cloud deployment model
  • Public cloud
  • Private cloud
  • Hybrid cloud
Service constraints None
System requirements
  • Azure platform is in Microsoft’s Western European data centre
  • A certificate is required during a signing process
  • Significant server components require Windows server 2008/2013

User support

User support
Email or online ticketing support Email or online ticketing
Support response times Support levels are determined by the severity of any incident or request. Response times for critical (severity 1) is 1 hour. For non critical it is 4 hours and for the least important response time is 8 hours.
User can manage status and priority of support tickets No
Phone support Yes
Phone support availability 9 to 5 (UK time), Monday to Friday
Web chat support Web chat
Web chat support availability 9 to 5 (UK time), Monday to Friday
Web chat support accessibility standard None or don’t know
How the web chat support is accessible Web chat meets WCAG 2.0 A
Web chat accessibility testing None
Onsite support Yes, at extra cost
Support levels Icon UK provides standard technical support services between 9am and 5pm UK time on normal UK working days. Our support services can be contacted either by telephone or email, getting through to trained technical support engineers. Extended 24 x 7 support is available (for an uplift associated with this, depending upon particular circumstances).
Support available to third parties Yes

Onboarding and offboarding

Onboarding and offboarding
Getting started On-line documentation and videos are available. Remote support is also available.
Service documentation Yes
Documentation formats
  • HTML
  • PDF
  • Other
Other documentation formats Online video
End-of-contract data extraction Finalised documents are not stored on our systems, but archive to the system of choice on an ongoing basis.
End-of-contract process Customers can export all certificates and signed documents.

Using the service

Using the service
Web browser interface Yes
Supported browsers
  • Internet Explorer 10
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
  • Opera
Application to install No
Designed for use on mobile devices Yes
Differences between the mobile and desktop service The mobile app are designed to allow documents to be signed even when a network connection is unavailable, in off-line mode. When a connection becomes available the signed document is uploaded to the cloud server for processing. With the desktop all services are on-line and are access through a web browser.
Accessibility standards None or don’t know
Description of accessibility The interface is for support personnel to submit and track issues, and is not intended to be used by end users.
Accessibility testing https://www.powermapper.com/products/sortsite/ads/acc-wcag-testing/
This testing tool was used to identify WCAG accessibility
API Yes
What users can and can't do using the API The APIs provide the following functionality: Initiate batch, Initiate interactive creation of a document, Fetch additional data via call-backs, Fax, Print, e-mail, SMS, Import of legacy template components (logos, fonts, text blocks, Business logic, etc)
API documentation Yes
API documentation formats
  • HTML
  • PDF
  • Other
API sandbox or test environment Yes
Customisation available Yes
Description of customisation Look and feel can be changed, or embedded into other applications

Scaling

Scaling
Independence of resources There is a capacity management threshold policy that ensures all resources are monitored and adjusted to ensure the SLA is always maintained.

Analytics

Analytics
Service usage metrics Yes
Metrics types Metrics can be recorded at several levels: User usage, Pages signed, Documents Signed, Biometric signatures validated, Biometric signature profiles created
Reporting types
  • API access
  • Regular reports
  • Reports on request

Resellers

Resellers
Supplier type Reseller providing extra support
Organisation whose services are being resold Namirial GmbH

Staff security

Staff security
Staff security clearance Other security clearance
Government security clearance Up to Baseline Personnel Security Standard (BPSS)

Asset protection

Asset protection
Knowledge of data storage and processing locations Yes
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
User control over data storage and processing locations Yes
Datacentre security standards Supplier-defined controls
Penetration testing frequency At least once a year
Penetration testing approach In-house
Protecting data at rest Other
Other data at rest protection approach FIPS-assured encryption, assured by independent validation of assertion
Data sanitisation process Yes
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
Equipment disposal approach In-house destruction process

Data importing and exporting

Data importing and exporting
Data export approach By making a request to the help desk, who will then provide the data in the requested format.
Data export formats
  • CSV
  • Other
Other data export formats
  • XML
  • JSON
  • Export to a cloud based database
Data import formats
  • CSV
  • Other
Other data import formats
  • XML
  • JSON
  • PDF

Data-in-transit protection

Data-in-transit protection
Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
  • Other
Other protection between networks VPN using TLS, version 1.2 or later
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
  • Other
Other protection within supplier network VPN using TLS, version 1.2 or later

Availability and resilience

Availability and resilience
Guaranteed availability We have a range of SLAs with up to 99.995% availability.
Approach to resilience The services are delivered by load balanced servers in two locations. Services can be maintained with only a single server. Minimum configuration is to have two servers in two different locations making the minimum configuration 4 in total. All environments are virtual and are dynamically reallocated to a different physical server if required due to any hardware failure.
Outage reporting Outage reports are provided by e-mail.

Identity and authentication

Identity and authentication
User authentication needed Yes
User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Dedicated link (for example VPN)
  • Username or password
  • Other
Other user authentication By use of a biometric signature, validated against a known secure registry
Access restrictions in management interfaces and support channels Through a rights and roles management system, linked to an identity or group of identities.
Access restriction testing frequency At least once a year
Management access authentication
  • 2-factor authentication
  • Username or password
  • Other
Description of management access authentication For on-prem or hybrid solutions the authentication method is user determined, and could be 2FA or any of the above methods

Audit information for users

Audit information for users
Access to user activity audit information Users contact the support team to get audit information
How long user audit data is stored for User-defined
Access to supplier activity audit information Users contact the support team to get audit information
How long supplier audit data is stored for User-defined
How long system logs are stored for User-defined

Standards and certifications

Standards and certifications
ISO/IEC 27001 certification No
ISO 28000:2007 certification No
CSA STAR certification No
PCI certification No
Other security certifications No

Security governance

Security governance
Named board-level person responsible for service security Yes
Security governance certified No
Security governance approach We operate accordingly to ISO27001 standard (but note we are not audited) and to the Cloud Security Alliance Checklist 3.0.1
Information security policies and processes We operate accordingly to ISO27001 standard (but note we are not audited) and to the Cloud Security Alliance Checklist 3.0.1

Operational security

Operational security
Configuration and change management standard Supplier-defined controls
Configuration and change management approach We maintain a comprehensive release management process, which includes (1) release plan and document, architectural review, functional testing, regression testing, security review and security testing (if required). Post release we undertake PVT. We have roll back procedures for all releases. Client comms are managed in advance via our client service team.
Vulnerability management type Undisclosed
Vulnerability management approach Vulnerability Management consists of: Assessment, Monitoring, Mitigation Prioritisation, tracking and Mitigation timescales.
Protective monitoring type Undisclosed
Protective monitoring approach We leverage the standardised and accredited vulnerability management processes of our Cloud Providers (Oracle and AWS)
Incident management type Undisclosed
Incident management approach All incidents are taken through an ITIL incident management process. This includes the processes, email incident reporting and management reporting.

Secure development

Secure development
Approach to secure software development best practice Supplier-defined process

Public sector networks

Public sector networks
Connection to public sector networks No

Pricing

Pricing
Price £0.22 per transaction
Discount for educational organisations No
Free trial available Yes
Description of free trial There is a 30 day trial of the SignAnyWhere solution, and Mobile application

Service documents

pdf document: Pricing document pdf document: Skills Framework for the Information Age rate card pdf document: Service definition document pdf document: Terms and conditions
Service documents
Return to top ↑