ParentPay Limited

Cypad Monitor

Monitoring, inspection/auditing of catering, care-taking and cleaning services for QA. A real-time standards report is produced which can include photos, corrective actions and signatures. Included are : scoring so that sites are ranked , detailed insight into service quality by drilling down to individual questions to capture trends.


  • Report builder enables users to tailor reports as needed
  • Risk assessments including identification of hazards, risks posed, control measures
  • Facilitates property surveys
  • Room and floor measurements for servicing, refurbishing costings,
  • Staff H&S: working procedures, risk, accident reporting, first aid.
  • Quality assures compliance with nutritional standards
  • Moderates performance and productivity
  • Ongoing background sync to void data loss
  • Real-time data synced to a central database and HQ desktop.
  • Monitoring across all departments, facilities, exteriors


  • Flexible reporting for catering, grounds, cleaning, sharing device
  • Reports reviewed regularly by out teams for user suitability.
  • Flexible real-time updating, sits adaptable risk assessments.
  • maintains a high quality service
  • Complies with statutory standards and regulations
  • Collects data to support QA . Standards. Performance awards.
  • Improves viability and marketability of service
  • Reduces paper, saves time and money, grows profits.
  • Provides audit trail for case and incident management and reporting.
  • Managed tablet service including remote repair and next-day replacement.


£3,100 a unit a year

  • Education pricing available

Service documents


G-Cloud 12

Service ID

2 2 6 7 9 4 2 7 6 7 1 6 4 7 8


ParentPay Limited Nicola Howard
Telephone: 07881915899

Service scope

Software add-on or extension
Cloud deployment model
Hybrid cloud
Service constraints
Planned maintenance windows are applied
out of hours.
System requirements
  • Modern supported Web Browser, security patches applied.
  • Browser Javascript Support
  • Browser Cookies Support
  • TLS1.2 Transport Encryption Support

User support

Email or online ticketing support
Email or online ticketing
Support response times
As per SLA
User can manage status and priority of support tickets
Phone support
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
Web chat
Web chat support availability
9 to 5 (UK time), Monday to Friday
Web chat support accessibility standard
WCAG 2.1 AA or EN 301 549
Web chat accessibility testing
Available on request
Onsite support
Yes, at extra cost
Support levels
As required by the client. Pricing available on request
Support available to third parties

Onboarding and offboarding

Getting started
Training is available by telephone, web learning platform and through project management. A full suite of user documentation is available to users.
Service documentation
Documentation formats
  • HTML
  • PDF
End-of-contract data extraction
Upon completion or termination of the contract, the service will for up to thirty (30) days following such termination permit customer to export its data, in accordance with the capabilities of the service. Following such period, data stored or processed on behalf of the customer shall be removed or anonymised in accordance with the organisations Data Protection Policy, Privacy Notice, and Data Retention and Disposal Policy.
End-of-contract process
Annual licence fee is included. No additional end of contract cost.

Using the service

Web browser interface
Supported browsers
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
  • Opera
Application to install
Designed for use on mobile devices
Differences between the mobile and desktop service
Native mobile applications are available for iOS and Android
Service interface
Description of service interface
The service is accessed through a standard secure web browser interface. All interfaces have been designed with effective user experience and accessibility in mind.
Accessibility standards
None or don’t know
Description of accessibility
All interfaces have been designed with effective user experience and accessibility in mind and based on WCAG 2.1 AA.
Accessibility testing
No specific testing is conducted, however all interfaces have been designed with accessibility in mind, based on WCAG 2.1 AA.
What users can and can't do using the API
Customers can access a data extraction API
API documentation
API documentation formats
API sandbox or test environment
Customisation available
Description of customisation
Customers can upload logos to customise their service


Independence of resources
The core platform is privately managed and does not share capacity with any other tenants. Customer data is logically separated through robust application logic which is regularly tested. Significant redundancy is built into the infrastructure and server capacity to ensure the service is always available.


Service usage metrics
Metrics types
As required and defined by the client
Reporting types
  • Real-time dashboards
  • Regular reports
  • Reports on request


Supplier type
Not a reseller

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Baseline Personnel Security Standard (BPSS)

Asset protection

Knowledge of data storage and processing locations
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least once a year
Penetration testing approach
‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
Data sanitisation process
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
Local and centralised reporting suites are available
Data export formats
Other data export formats
Data import formats
Other data import formats

Data-in-transit protection

Data protection between buyer and supplier networks
TLS (version 1.2 or above)
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability
SLA available on request
Approach to resilience
Significant redundancy and resilience is built into the infrastructure and server capacity to ensure the service is always available. Enterprise monitoring solutions are deployed and the service is maintained on a 24x7 basis by a full IT team. Capacity management processes and procedures are established.
Outage reporting
In the event of an incident or outage, emails are sent to nominated contacts. Notifications are also sent to devices where appropriate.

Identity and authentication

User authentication needed
User authentication
Username or password
Access restrictions in management interfaces and support channels
Infrastructure management interfaces are only accessible via secure VPN and all access is protected by Multi-Factor-Authentication (MFA).
Access restriction testing frequency
At least every 6 months
Management access authentication
Username or password

Audit information for users

Access to user activity audit information
Users contact the support team to get audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users contact the support team to get audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
At least 12 months

Standards and certifications

ISO/IEC 27001 certification
ISO 28000:2007 certification
CSA STAR certification
PCI certification
Other security certifications
Any other security certifications
Cyber Essentials Plus

Security governance

Named board-level person responsible for service security
Security governance certified
Security governance standards
  • CSA CCM version 3.0
  • ISO/IEC 27001
  • Other
Other security governance standards
Cyber Essentials Plus.
Information security policies and processes
Cypad operates under an ISO 27001 certified Information Security Management System (ISMS) - this has been certified by a UKAS accredited certification body. A dedicated security team of qualified specialists maintain, monitor and enforce technical and organisational security controls. We are audited by independent specialist third parties at least four times per year. Cypad operate a comprehensive catalogue of security policies, processes and procedures; Including but not limited to: Security Policy. ISMS Manual. Acceptable Use Policy. Access Control and Onboarding-Offboarding. Business Continuity Strategy. Business Continuity Plans. BYOD Policy. Capacity Management Policy. Change Control Process. Clear Desk Policy. Cryptography, Certificates and Key Management Policy. Data Protection Policy. Data Retention and Disposal Policy. Development Process Standards and Practices. Firewall & Router Configuration Strategy. Incident Response Procedures. Information Classification and Handling. IT Decommission Process. Password Policy. Patch and Vulnerability Management Strategy. Physical Security Policy. Security within Project Management. Remote Working and Mobile Device Policy. Security Considerations for Key Decision Makers. Social Media Policy. Supplier and Third Party Management Policy. System Build Standards. IT Documented Operating Procedures.

Operational security

Configuration and change management standard
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach
Full change control process is applied to the product and hosting infrastructure. This applies to all assets. Changes require CAB review and approval. Security considerations are specifically identified as a strict requirement.
Vulnerability management type
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach
Internal and external components are assessed by industry leading vulnerability scanners on a weekly basis. Additional cyber risk assessment tools monitor OSINT data feeds on an ongoing basis. Any and all findings are subject to risk assessment and suitable remediation through change control processes. Critical and Security updates to be installed within one month of release. All other available vendor updates to be installed within 3 months of release. We actively participate in a threat sharing community and monitor special interest security groups continuously.
Protective monitoring type
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach
We operate network and host based intrusion detection systems. All infrastructure components and logging is supported by a SIEM platform, including User-Behaviour-Analytics (UBA) capabilities. Endpoint and back-office systems run DLP controls to help detect and prevent data loss events. External breach indicators are also independently monitored on an ongoing basis. Canary tokens and honeypot technology is also applied. We operate, train and regularly test a comprehensive Incident Response Programme - including forensics evidence collection capabilities. Security Incidents are responded to immediately following identification, by a dedicated security team.
Incident management type
Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach
Our detailed Incident Response Programme has developed a full array of specific response processes for particular events. We operate, train and regularly test the full process - including forensic evidence collection processes. Security Incidents are responded to immediately following identification, by a dedicated security team. All employees are required to report any confirmed or suspected security incidents. The security team can be contacted by customers, users or employees at any time via email or telephone. Detailed incident reports are provided as necessary - including an executive summary, event timeline, investigative and containment steps, root cause analysis, remediation and lessons learned.

Secure development

Approach to secure software development best practice
Conforms to a recognised standard, but self-assessed

Public sector networks

Connection to public sector networks


£3,100 a unit a year
Discount for educational organisations
Free trial available

Service documents