Pi Ltd

Travel

Pi’s solution allows users to quickly understand, forecast and control travel activity across individuals, business units and geographies. Our service transforms your ability to communicate what is really happening, together with its consequences and the need for change; not only within the travel category but across the wider business.

Features

  • Complete Report Automation
  • Compatible with all travel, card and expense data feeds
  • Available through all web enabled devices
  • Dynamic graphical reporting suite
  • Integrated workflow engine
  • R statistical package integration
  • Elastic Cloud Architecture
  • Flexibility for local dashboard development
  • Multiple reporting levels and hierarchies within a single solution
  • ISO27001 Certified for both business and personal level data

Benefits

  • Monitor KPIs
  • Monitor Compliance
  • React quicker to changing circumstances
  • Automate data cleansing
  • Improve data quality
  • Streamline reporting processes
  • Create mobile analytics

Pricing

£25000 to £100000 per unit per year

  • Free trial available

Service documents

Framework

G-Cloud 11

Service ID

2 5 1 5 3 2 6 3 4 5 9 8 9 0 1

Contact

Pi Ltd

Keesup Choe

+44 (0)808 204 0344

info@predictx.com

Service scope

Software add-on or extension
No
Cloud deployment model
Private cloud
Service constraints
None
System requirements
We deliver Software-as-service so clients only need a browser

User support

Email or online ticketing support
Email or online ticketing
Support response times
We do have ability to use e-mails however we will use sales force as a ticketing system
User can manage status and priority of support tickets
User can manage status and priority of support tickets
Yes
Online ticketing support accessibility
WCAG 2.1 AA or EN 301 549
Phone support
Yes
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
No
Onsite support
Yes, at extra cost
Support levels
We provide 3 levels:
1) Help desk support via online or phone
2) Part-time analyst support to assist clients with functions periodically
3) Full-time dedicated analyst support to assist clients with functions periodically
Support available to third parties
No

Onboarding and offboarding

Getting started
We provide a range of training services including onsite, online dedicated sessions, and open regular client webinars.

We typically do initial training as part of our implementation program with a client.
Service documentation
Yes
Documentation formats
PDF
End-of-contract data extraction
They can download their files.
End-of-contract process
At the end of a contract we typically have a renewal and expansion of services. If a customer is leaving then we help them extract their data.

What is included in the price is access to the analytics software and any services to enable it.

Using the service

Web browser interface
Yes
Supported browsers
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
Application to install
No
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
None
Service interface
No
API
Yes
What users can and can't do using the API
Can be made available on request
API documentation
Yes
API documentation formats
Other
API sandbox or test environment
No
Customisation available
Yes
Description of customisation
Buyers can, with training, create their own analytics on data.

Scaling

Independence of resources
We have independent multi-tenant data base structure that enables us to scale easily and without risk of impact across customers.

Analytics

Service usage metrics
Yes
Metrics types
Our metrics focus mainly on user counts and activity to share with our customers how much they are using the service.
Reporting types
Regular reports

Resellers

Supplier type
Not a reseller

Staff security

Staff security clearance
Conforms to BS7858:2012
Government security clearance
Up to Security Clearance (SC)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
No
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least every 6 months
Penetration testing approach
In-house
Protecting data at rest
Physical access control, complying with CSA CCM v3.0
Data sanitisation process
No
Equipment disposal approach
A third-party destruction service

Data importing and exporting

Data export approach
Download to CSV
Data export formats
CSV
Data import formats
CSV

Data-in-transit protection

Data protection between buyer and supplier networks
Private network or public sector network
Data protection within supplier network
TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability
SLA agreements with 99.999% uptime. The DR is completely developed, managed, and executed by Pi. In terms of RTO, this is virtually instantaneous, thus the RPO concerns are not applicable as the user will not be aware that DR has been invoked and the service has shifted to the DR location.
As described above Pi has build a dynamic DR environment that automatically and virtually instantly shifts service provision to DR if service at the primary facility is disrupted.

Users are refunded based on the agreement outlined in the individual contracts
Approach to resilience
In the event of failures any one of the website stacks can operate independently providing the full service with the current state of all data. Cluster replication ensures that all servers are kept up to date so all servers have current data and documents.
Clients will usually be configured with two servers at the primary site, Equinix LD5 datacentre in Slough. These will provide the service under normal operation. In addition we will run a single server at Equinix LD3 datacentre in Park Royal to act as a live offsite standby. Any one of these servers is capable of providing the full service. All servers are kept fully up to date via the clustering capabilities of Galera and Gluster.
Access to the primary servers is via our main load balancer in LD5, Slough. This load balancer will normally direct traffic at the primary servers in LD5. If none of these servers are available then traffic will be directed to the offsite standby in LD3. An alternate web address will be allocated on the standby load balancer in LD3, Park Royal to provide access to the same backend servers in the unlikely event of loss of communication to LD5.
Outage reporting
Resilience is configured on all Pi equipment - dual Internet connections, Dual Cisco F/W, dual core S/W, dual network S/W dual load balancers, dual servers, in the event of any outage or unavailabity of services the users are informed by email alerts and web based dashboards

Identity and authentication

User authentication needed
Yes
User authentication
2-factor authentication
Access restrictions in management interfaces and support channels
Access rights & Access control policy enforced - Access rights for PI staff members are controlled by the systems support team. Final authority lies with the Head of IT. Access to technical resources such as drive shares, e-mail etc. is also controlled by the systems support team. PI staff members do not have administrative rights on their machines to install unauthorised software. Access to various areas of the PI software suite is allocated by a role based access mechanism.
Access restriction testing frequency
At least every 6 months
Management access authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

Access to user activity audit information
Users contact the support team to get audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users receive audit information on a regular basis
How long supplier audit data is stored for
User-defined
How long system logs are stored for
At least 12 months

Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
BSI
ISO/IEC 27001 accreditation date
2014
What the ISO/IEC 27001 doesn’t cover
EU GDPR
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Other security certifications
Yes
Any other security certifications
  • PCI/DSS compliance
  • QMS ISO27001:2013

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
ISO/IEC 27001
Information security policies and processes
ISO 27001/27002/31000 (ISMS), DPA, recent implementation ongoing with Cyber Essentials and EU GDPR.

Information Governance Security Policy - this is the documented information that is shared across the organisation that covers the security requirements and the procedures.

Confidentiality disclosure agreement,
ISO 27001:2013 Certification,
EU GDPR & Data Protection Registration,
NHS Information Governance Toolkit,
HR Procedure for PI staff,
Staff Clearance,
IT Policy and Procedure,
Patient/Customer level Datasets,
Client Data,
Network & Servers Security plus Monitoring,
Secure configuration & Removable Media control,
Data Security ,
Data Disposal, Backup and Business Continuity,
Server Hosting at Equinix Data Centre,
User Access Rights,
Malware prevention,
User education and awareness,
Incident management,
Patch management,
Home & Mobile working,
Enforced Policies,
Care and HealthTrak,

Pi carried out internal IT Awareness training programme on quarterly or on ad hoc basis to ensure employees are competence in their role and security aware and adhere to company policies and GPG. (Good practice guidelines)

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Change control policy enforced that defines and outlines the change management process where Information technology systems are subject to formal change control procedures. Such procedures provide a managed and orderly method by which changes are requested, tested, approved, communicated prior to implementation and logged and assessed for security impacts with defined change control process.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Network / Application vulnerabilities by Third party PEN Testers & QualysGuard, Vulnerabilities detection through service monitoring & Nagios Monitoring. Linux servers are protected by Selinux security patch updates and Fail2ban process running in realtime. Additionally the server internal firewalls are configured for required services - network, protocols and ports. Information on threats through security information web sites and by proprietary vendors
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
This is automated within Nagios - Nagios monitoring tool has a plugin for Cisco, Servers, Networks and Applications for realtime monitoring of any changes and is configured to send out alerts/warnings. Any failing services are detected and are picked up instantaneously Additionally, Cisco Firewall, Systems, Application logs are centralized on the log server for any forensic processes and requirements
Incident management type
Supplier-defined controls
Incident management approach
Change control policy is enforced and is managed through Jira, an internal web based DB application. Information technology systems are subject to formal change control procedures. Such procedures provide a managed and orderly method by which changes are requested, tested, approved, communicated prior to implementation and logged. All Incidents are recorded in a central document that is web based for data gathering that provides incident reports

Secure development

Approach to secure software development best practice
Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks
No

Pricing

Price
£25000 to £100000 per unit per year
Discount for educational organisations
No
Free trial available
Yes
Description of free trial
Access to testdrive site allowing user to see a subset of reports and interact with the system as if it were live with sample data.

Service documents

Return to top ↑