Epiq Europe Ltd

TMX - Cloud-based Bundle Management and Real-time Court Reporting

TMX is a secure, cloud-based, highly scalable, bundle creation and sharing platform that allows users to build electronic bundles quickly and easily for court hearings and arbitrations. TMX facilitates collaboration between legal teams, and provides a flexible and intuitive platform for bundle creation.

Features

  • Bundle creation in a flexible, familiar, and intuitive platform
  • Easy-to-use functionality
  • Fast and accurate searching
  • Presentation of transcripts and documents on an intuitive platform
  • Configurable private and shared workspaces
  • Personal, team and shared annotations including tagging
  • Automatic and manual hyperlinking
  • Pagination allowing for inserts and removals
  • Self-provisioning

Benefits

  • Collaboration between legal teams, experts and clients
  • Quick to learn how to use and get started
  • Self-provisioning enables control with little reliance on project managers/vendors
  • Cost-effective
  • Flexibility, scale up/scale down for large/small cases
  • Globalisation - work across borders seamlessly
  • Access anywhere and anytime
  • Secure access and hosting through private cloud

Pricing

£50 a user a week

Service documents

Framework

G-Cloud 12

Service ID

2 2 4 1 5 1 5 5 1 1 8 1 6 3 3

Contact

Epiq Europe Ltd Sandeep Patel
Telephone: 020 7367 9173
Email: contracts@epiqglobal.com

Service scope

Software add-on or extension
Yes, but can also be used as a standalone service
What software services is the service an extension to
Relativity and DMX integration
Cloud deployment model
Private cloud
Service constraints
All software upgrades are provided outside of normal working hours and we provide adequate notice to potential affected users.
System requirements
Access to the internet

User support

Email or online ticketing support
Email or online ticketing
Support response times
We aim to respond to all emails received within standard working hours (9am to 5.30pm, Monday to Friday) within one hour. We provide an emergency email address for queries received outside standard working hours. We aim to respond to these emails within two hours.
User can manage status and priority of support tickets
No
Phone support
Yes
Phone support availability
24 hours, 7 days a week
Web chat support
No
Onsite support
Yes, at extra cost
Support levels
Each client is supported by an account manager, as well as a project team who act as a first point of contact. The project support team will engage technical support and other resources as required, as they are best placed to analyse issues raised by clients, as well as having the capability to troubleshoot and resolve many day-to-day issues. The project support team is also assisted by a technical support desk, who are able to address general functionality questions. Technical support is included within the application licensing and is not separately charged. If on-site attendance is required, professional services and travel costs may be charged.
Support available to third parties
Yes

Onboarding and offboarding

Getting started
Initial client engagement is focused on a kick off meeting, which may take place in person or via a conference call/web presentation. This will define the scope of services to be provided, key client deadlines, data sources to be processed and loaded to the platform and information that will assist our project management team to design the database to the specific requirements of the matter. The initial meeting is followed by a training session, usually delivered online, where a small set of data is loaded to the platform and key stakeholders are introduced to the functionality of the platform, as well as the specific configuration that has been deployed for the team. After taking feedback from the key stakeholders, any further changes that need to be made are implemented by the project management team and training provided to the full user community, either online or in person. Our training programmes are also supported by user guides available in PDF format and other online resources.
Service documentation
Yes
Documentation formats
PDF
End-of-contract data extraction
Clients have a variety of choices over how their data is extracted when the contract ends. The solution can be tailored to meet client and project requirements. A 'cold hosting' option can be utilised where we will continue to host the data (at a reduced rate). Users also have the ability to export their data into a set of native files, PDFs and with a word index. Users also have the option of extracting their data offline for use in their own offline version of the platform.
End-of-contract process
The end-of-contract process will be discussed at the project kick off meeting and again towards the end of the project. The process will be managed by the Project Manager and a solution can be created to meet specific project and client requirements. A 'cold hosting' option can be utilised where we will continue to host the data at a reduced rate. Users also have the ability to export their data into a set of native files, PDFs and with a word index. Users also have the option of extracting their data offline for use in their own offline version of the platform. The price of the contract will depend on client requirements and how long the data will need to remain active.

Using the service

Web browser interface
Yes
Supported browsers
  • Internet Explorer 11
  • Microsoft Edge
  • Chrome
Application to install
Yes
Compatible operating systems
Windows
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
There are no differences between the mobile and desktop service.
Service interface
Yes
Description of service interface
We enlisted the skills of a User Interface consultancy to ensure that TMX is easy to use and familiar to users of platforms, such as Microsoft Outlook. TMX has a simple and uncluttered interface that makes it very intuitive to use. TMX provides prompts with reminders and usage tips while in the product.
Accessibility standards
None or don’t know
Description of accessibility
We have ensured that our service is accessible by: - using simple colours; - writing in plain English; - using simple sentences and bullet points; - making buttons descriptive; - using good contrasts and a readable font size; - using a combination of colour, shapes and text; - following a linear, logical layout, ensuring that text flows and is visible when text is magnified to 200%. All non-text content that is presented to the user has a text alternative that serves the equivalent purpose.
Accessibility testing
We have not done any interface testing with users of assistive technology.
API
No
Customisation available
No

Scaling

Independence of resources
This is a web based service and the capacity in our data centres is more than capable of meeting all client requirements.

Analytics

Service usage metrics
No

Resellers

Supplier type
Not a reseller

Staff security

Staff security clearance
Conforms to BS7858:2012
Government security clearance
Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
No
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least once a year
Penetration testing approach
Another external penetration testing organisation
Protecting data at rest
Physical access control, complying with another standard
Data sanitisation process
Yes
Data sanitisation type
Explicit overwriting of storage before reallocation
Equipment disposal approach
In-house destruction process

Data importing and exporting

Data export approach
Clients are able to export their data directly from TMX at any time provided they have the correct permissions. Users can export PDFs and/or native files with a system generated index. Projects can also be taken offline to a standalone version of the platform.
Data export formats
  • CSV
  • Other
Other data export formats
Adobe Acrobat (.PDF)
Data import formats
  • CSV
  • Other
Other data import formats
  • .DAT
  • .OPT
  • Drag & Drop in Native Format

Data-in-transit protection

Data protection between buyer and supplier networks
  • Private network or public sector network
  • Legacy SSL and TLS (under version 1.2)
Data protection within supplier network
Legacy SSL and TLS (under version 1.2)

Availability and resilience

Guaranteed availability
We train staff to answer phones within three rings, acknowledge emails within one hour and escalate all unusual queries to their manager. We maintain a formal policy for handling queries and all personnel are trained in our escalation process. Specific service level agreements for availability are agreed with clients on a case-by-case basis.
Approach to resilience
The physical protection of all data centres encompasses multiple layers including 24x7 onsite staff, strict personnel access controls utilising badge and/or biometric access and mantraps, and 24x7x365 video surveillance both inside and outside the facility. Hardware, servers, and network devices are maintained on raised flooring and are secured in locked cabinets. Visitors must be escorted at all times, sign in, and be assigned an electronic photo ID badge that does not grant access to any raised floor areas. Further information is available on request.
Outage reporting
Email alerts are sent directly to the IT support team, who will then investigate and report back to clients confirming the start and end times for any outage, our analysis of the cause of the outage and how the issue was/will be resolved. Reports will also include recommendations for any future changes or upgrades if these are required.

Identity and authentication

User authentication needed
Yes
User authentication
2-factor authentication
Access restrictions in management interfaces and support channels
TMX features a robust set of roles and user permissions that can be adapted depending on user profiles. Clients can host multiple matters that can contain customised permissions. Matter administration staff can assign users to matters and can choose from a standard set of roles (e.g. Team Admin, Power User, Standard User, Guest) or can set up custom permissions based on over 20 attributes. Matter data is encrypted and can only be accessed by users who have been added to the matter.
Access restriction testing frequency
At least once a year
Management access authentication
2-factor authentication

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
User-defined
Access to supplier activity audit information
Users contact the support team to get audit information
How long supplier audit data is stored for
User-defined
How long system logs are stored for
User-defined

Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
British Standards Institute (BSI)
ISO/IEC 27001 accreditation date
01/11/2016
What the ISO/IEC 27001 doesn’t cover
Services outside our core services which are Legal Services and Court Reporting. A statement of applicability can be provided on request.
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Other security certifications
Yes
Any other security certifications
Cyber Essentials

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
ISO/IEC 27001
Information security policies and processes
Information security is managed through a dedicated information security team who are responsible for designing and updating polices relating to user access, physical controls, network storage, appropriate use of systems and compliance with existing legislation. Policies are reviewed and updated on a quarterly basis. Mandatory training on security issues is provided to all employees when they join the company and at least annually during their tenure. Our data centre and operations centre have been accredited to ISO 27001 standard and as part of this certification we are regularly interviewed and audited by an external auditor - a process that evaluates our policies and practices to identify and resolve potential vulnerabilities.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
A formal Change Management programme monitors all development and maintenance activities for key systems, ensuring established policies and processes are followed. This includes a Change Control team which monitors and approves all changes. Documented policies and procedures are in place for software development and infrastructure changes which validates that a standardised and consistent process is followed. Software development change policies include Scrum/SDLC procedures, validation procedures and release procedures. All changes are impact-assessed including any possible information security related impacts. We use a centralised ticketing process for tracking requests and approvals for each change. Systems are restricted to authorised users only.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Continual evaluations of system and network security are conducted by a trusted external third party through regularly scheduled vulnerability scans and penetration tests. Epiq’s Security Team subscribes to multiple services for vulnerability alerts on deployed software and hardware. Daily reviews are executed by the Information Security team for emerging threats. Internal assessments are deemed confidential and proprietary. Patches are reviewed and assigned a severity level based on existing compensating controls. Epiq’s change management process governs the deployment of security patches. All patches are tested prior to deployment. The timeframe for security patches is governed by severity level.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
Epiq has a comprehensive Incident Response Plan (IRP) setting out how we respond to information security incidents. These include (but are not limited to) system intrusions/misuse, or any situation where confidentiality of sensitive data, data integrity or business critical systems may have been compromised. The primary goal of the IRP is to restore normal service operations as quickly as possible, whilst minimising the adverse impact on business operations, protecting Epiq and client data. An incident is identified either by Epiq’s IT staff or in-place utilities and we have a response team in place to quickly respond and rectify any situation.
Incident management type
Supplier-defined controls
Incident management approach
We maintain an Incident Response Plan, which sets out our approach to reporting and responding to security incidents. Employees report incidents to the information security team using a standard format document and the team is responsible for investigating the reported activity in a timely manner and reporting findings to the client, management and any appropriate external authorities as necessary. Incident reports are usually provided by secure email. Our information security team subscribes to various industry alert services to keep abreast of relevant threats, vulnerabilities or alerts from actual incidents.

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks
No

Pricing

Price
£50 a user a week
Discount for educational organisations
No
Free trial available
No

Service documents