Qubix International Ltd

Qubix Oracle Enterprise Resource Planning (ERP) Applications

Qubix is one of the UK's leading implementation and managed service providers for Oracle Enterprise Resource Planning (ERP), Analytics, and EPM (Enterprise Management) solutions. Established in 1987 we have over 1000 successful engagements we are perfectly positioned to assist the UK government with their cloud strategy.


  • Budget Creation and Adjustment
  • Forecast Creation and Tracking
  • NHSI Plan Creation and Tracking
  • 'What-if' Scenario Planning (e.g. for post-Covid operational change)
  • Tracking Actual performance vs Forecast or Budget
  • Pay modelling and driving toward performance targets
  • Full dashboarding, reporting and 'burst' report sending
  • Spreadsheet and MS Office Integration
  • Full data integration technology with CloudBridge
  • Master Data (Metadata) management capability with CloudBridge


  • Effective and rapid Budget Creation across Trusts
  • Effective and rapid Forecast Creation across Trusts
  • Track Actual performance compared to Budget and Forecast
  • Improve change planning with
  • Burst Reports to stakeholders automatically saving time
  • Improve the accuracy of forecasts and budgets
  • Reduce the FP&A cycle period allowing more analysis time
  • Make finance teams more efficient and operate with fewer people
  • Make organisational change more efficient and predictable


£256 a person a month

Service documents


G-Cloud 12

Service ID

2 7 5 1 5 5 5 5 9 4 3 6 7 7 3


Qubix International Ltd Paul Johnston
Telephone: 01483 480222
Email: paul.johnston@qubix.com

Service scope

Software add-on or extension
What software services is the service an extension to
Qubix Oracle Enterprise Resource Planning (ERP) Applications Product uses Oracle Oracle Fusion ERP to provide its capabilities.
Cloud deployment model
  • Public cloud
  • Private cloud
  • Hybrid cloud
Service constraints
The service is configurable. Customers may wish to introduce constraints (such as using fewer modules) to save money.
System requirements
Client would purchase an Oracle Fusion ERP License

User support

Email or online ticketing support
Email or online ticketing
Support response times
Platform Service is 24x365

Functionality Support provision is available 24x365 or as limited hours.
User can manage status and priority of support tickets
Online ticketing support accessibility
WCAG 2.1 AA or EN 301 549
Phone support
Phone support availability
24 hours, 7 days a week
Web chat support
Onsite support
Yes, at extra cost
Support levels
Core Product Service Support is provided by Oracle Corporation, and provides an unlimited level of Support engagement over the course of the contract.

Functionality Support is provided by Qubix International. A number of different arrangements are possible based on either a consumption credits model or a Full Service Agreement-based model.
The standard contract is a consumption-based model, where the customer is supplied credits that they can consume on support tickets, change, or training. Credits are supplied free with the service, with additional at £625 per credit (4 hours). Service Agreement-based provision is by agreement and depends on the Service Catalogue options chosen. Genertally, clients with this service do not need to purchase additioal credits beyond the free provision.

Qubix and Oracle provide Account Managers. These resources have technical knowledge, but likely will not change configurations.
Support available to third parties

Onboarding and offboarding

Getting started
User adoption is at the heart of our delivery framework and this is achieved in a number of ways :

1) Full communication of service to all parties
2) Conference Room Pilots throughout an implementation
3) Continuous Improvement
4) Training analysis, online and offline training and on-line documentation
5) Exposure to new product functionality via briefings

Training Phase within an implementation :

Training on Core ERPM Technology to all relevant parties (on-site, live classroom or remote we-classroom - both with system access)

Training on capabilities, best practice and usage to exec team (on-site or remote coaching)

Training on Platform to IT Team (usually remote)
(Option) Access to Qubix Academy web-based training resource (web-based training)

Ongoing Training through :

1) Regular health-checks / support checks
2) Exposure to new product functionality via briefings
3) Access to Qubix Academy (web-based training)
4) Access to additional free and paid-for Qubix and Oracle training
Service documentation
Documentation formats
  • HTML
  • PDF
End-of-contract data extraction
The system is securely torn-down at end-of-life, so only data that needs to be retained needs to be removed from the service.

There are 2 options to achieve this:
1. Extract Data with web interface.
2. Use of API to extract data
End-of-contract process
Teardown of systems and removal of data is provided on contract termination.

Using the service

Web browser interface
Supported browsers
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
  • Opera
Application to install
Designed for use on mobile devices
Differences between the mobile and desktop service
All of the core ERP functionality is present across desktop and mobile devices.
Service interface
Description of service interface
There is a web interface (Enterprise Manager) to manage the overall Cloud Service, though icustomer's users might not need to access this.
Accessibility standards
WCAG 2.1 AA or EN 301 549
Accessibility testing
The console is provided by Oracle Corp. Oracle is committed to providing accessible technology and this is built into their standard testing regime.

Policy information on same is provided here:

Details of testing programmes are available here:
What users can and can't do using the API
There are API Layers to the ERP Cloud technology.
The ERP technology provides very wide functional coverage, and the API layer exposes this in a modular way with various endpoints available. These are documented here:
API documentation
API documentation formats
API sandbox or test environment
Customisation available
Description of customisation
The service is fully customisable. This is achieved via the application front-end, by administrators or configured. This is performed mainly at implementation phase, and subsequently maintained.
For example, core customisation would be the set-up of Chart of Accounts, Ledgers and Subledgers.

All components have role-based security. To make the changes listed above a user would have to have Administrator-level access. There are 3 systems in the landscape to allow safe flow of change to the Live system.


Independence of resources
The Oracle platform uses various controls to prevent noisy neighbours from impacting provision of service. The way this is achieved requires a full architecture overview, put simply it virtualises customers independently and ensures that provision is ring-fenced to these virtual notes, and that hardware provision for these nodes is distributed effectively, and onto physical hardware that is not over-subscribed.


Service usage metrics
Metrics types
Metrics are available across the service. Key examples include:

1. Usage
The system tracks all user interactions, and it is possible to audit who has been working on all areas of the system.
2. Security metrics (user logons, resets, etc)
3. Support ticket status
4. Support Credits used (for functional support via Qubix)
Reporting types
  • Real-time dashboards
  • Regular reports
  • Reports on request


Supplier type
Reseller providing extra support
Organisation whose services are being resold
Oracle Corporation

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Security Clearance (SC)

Asset protection

Knowledge of data storage and processing locations
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
User control over data storage and processing locations
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least once a year
Penetration testing approach
Another external penetration testing organisation
Protecting data at rest
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
Data sanitisation process
Data sanitisation type
Deleted data can’t be directly accessed
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
Users can export data via the web GUI, and this can be exported to their devices or to cloud object storage. It is also possible to use the spreadsheet link for this purpose.
Also, there is a Data management layer that allows all sorts of ETL, import/export jobs to be built and run.
Data import/export is a platform capability, so there are many options to achieve this task, and the best one to use would depend on the amount of data and if the task was going to be repeated.
Data export formats
  • CSV
  • Other
Other data export formats
  • XML
  • Xls, xlsx
  • Pdf
Data import formats
  • CSV
  • Other
Other data import formats
  • Xls, xslx
  • XML
  • We can handle almost anything else via CloudBridge conversions

Data-in-transit protection

Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Bonded fibre optic connections
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability
SLA for the technology components is 99.95% .
This commitment is described in this linked document:

If availability targets are not upheld, Service credits are applicable. The level of these depends on the level of service requested, since they are calculated as a percentage of these fees. This is described in section 2 of the linked document.
Approach to resilience
The architecture design of the Oracle Cloud Infrastructure (SaaS EPM Cloud Components) is world-class in terms of design for resilience.
There is redundancy at all hardware layers within an availability domain (data centre) and across availability domains. Local fault domains ensure that resources are allocated to the appropriate hardware, and that there is no resource bottlenecks on this hardware.
In addition to this underpinning resilience, resources can be created with multiple servers that are front-ended with load balancers (or Oracle RAC for the Database). This will remove any single point of failure from the set-up.
This linked document has additional details:
Outage reporting
The Oracle SaaS platform reports service availability on a (customer accessible) Dashboard, and administrators get emails of service issues.
The system availability status can be made available via an API.

Identity and authentication

User authentication needed
User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
Access restrictions in management interfaces and support channels
The Security layer for the PaaS Cloud is entirely independent of the Application Technology and Data Layer. This means there are not the usual issues with hierarchical security management where you always need (technical) administrators with access to data.
For this reason, there is role-based access layer that allows provision of the correct level of access to all of the components, including Support Channels and Management consoles.
Access restriction testing frequency
At least once a year
Management access authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users have access to real-time audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for

Standards and certifications

ISO/IEC 27001 certification
Who accredited the ISO/IEC 27001
EY/CertifyPoint BV, Amsterdam, Netherlands
ISO/IEC 27001 accreditation date
What the ISO/IEC 27001 doesn’t cover
All the components in the solution are covered by the above Certification.

However, extension services such as the training platform and support console (which are from other providers) are not.
ISO 28000:2007 certification
CSA STAR certification
CSA STAR accreditation date
CSA STAR certification level
Level 1: CSA STAR Self-Assessment
What the CSA STAR doesn’t cover
All the components in the solution are covered by the above Certification.

However, extension services such as the training platform and support console (which are from other providers) are not.
PCI certification
Who accredited the PCI DSS certification
Not disclosed
PCI DSS accreditation date
What the PCI DSS doesn’t cover
The Analytics Component and the CloudBridge integration are not covered (these, in any case, can't be covered, as they have flexible data storage options that could lead to non-compliance against a standard based on customer use).
Other security certifications
Any other security certifications
  • Cyber Essentials Plus certification
  • DISA SRG—Defense Information Systems Agency, Security Requirements Guide
  • CJIS—Criminal Justice Information Services
  • United Kingdom Cloud Security Principles

Security governance

Named board-level person responsible for service security
Security governance certified
Security governance standards
  • ISO/IEC 27001
  • Other
Other security governance standards
There are several dozen security compliance standards that the solution is compliant it, including:
United Kingdom Cloud Security Principles
Data Privacy Act
GDPR—General Data Protection Regulation
A full list is contained here:
Information security policies and processes
The overall security policies are the responsibility of the Qubix Operations Director, who is a member of the Qubix Board. There are different policies in place for the various different aspects of security, such as password policies on builds, and asset security.
For the implementation of security policies this is led by either Product Managers (if building or changing products) or Project Managers for individual project implementations.
We occasionally use 3rd parties for independent testing against policy (for example penetration testing of our products or systems).

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Qubix has robust change and configuration management that allows it to build complex technology products and manage these across a wide install base.
Products are comprised of features, which can be independently introduced, changed, deprecated, and removed from the product. Features have their own version control and code management. The products also have their own versioning, as do the underpinning platform components. We use a variety of in-house (such as our corporate Wiki) and commercial tools (such as GitHub) to manage and deploy these configurations.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Some aspects of the Oracle SaaS Cloud are not disclosed in order to protect overall security. However, some relevant facts are:
Patches are kept up-to-date in a monthly cycle + emergency patches. Functionality updates are quarterly.
Oracle has an entire corporate area looking at vulnerability management and threat and threat vector identification is handled has part of this overall security management of its Cloud.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
There is a full application-monitoring layer built into the Oracle ERP SaaS cloud. This will raise alerts for admins, and can also be linked to wider service monitoring technology. This protects the infrastructure and application layers. In terms of service response, this means there is practically no delay between service impact and rectification teams being made aware.
In addition to this, we have Service Monitoring technology built into the CloudBridge, which will raise alerts instantly on service impact to Business Functionality (BPM Alerting).
Incident management type
Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach
The IM process is essentially an ITIL-aligned, structured process where the primary objectives are:
1. An easy and pleasant experience for the users.
2. Effective and efficient routing of the problem to the people that can address it.
3. Fastest possible end-to-end solution of the issue.
Users can log calls via eMail, web form, or phone.
Incident reports are provided monthly, and if there has been a major incident as soon as that report is prepared.

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks


£256 a person a month
Discount for educational organisations
Free trial available

Service documents