WorkPal is a cloud hosted workflow management system that digitises all paper based processes from the office to field based workers and back. It gives a clear view of all workflows, tasks and people. It provides a management live view, control and full reports on tasks, inventory, people and costs.


  • Live job list
  • GPS Location Tracking
  • Job Scheduling
  • Asset Managment
  • Job Invoicing
  • Digital Forms
  • Time tracking and reporting
  • Mobile Device Managment
  • Document Storage
  • Quotations


  • Configurability
  • GDPR compliance
  • Going Paperless
  • Increased productivity
  • Live Job updats and data transfer
  • Offline working
  • Overhed reduction


£15 to £30 per user per month

  • Free trial available

Service documents


G-Cloud 11

Service ID

3 3 4 5 1 8 6 6 6 0 5 3 1 7 6



Graham Cameron


Service scope

Service scope
Software add-on or extension No
Cloud deployment model Private cloud
Service constraints The desktop version of WorkPal must be used through the Google Chrome browser, no more than 5 versions old.

The mobile app on Android must be installed directly - it is not available through the Google Play store. Likewise, the iOS app can only be installed through the Apple Business Management programme. These restrictions are to limit availability to WorkPal customers only, for security purposes.
System requirements
  • A windows PC running windows 7 or higher
  • Apple Mac running OS 10.9 or higher
  • Google Chrome
  • A Broadband conection of 89MB or above (desktop users)
  • Android Mobile Device Running OS V5 or above
  • Apple Mobile Device IOS 9 or above

User support

User support
Email or online ticketing support Email or online ticketing
Support response times Response to debug report
Initial contact to investigate issues raised through Debug report*
Call / email made and noted on the system
Internally generated debugs not included
Response to fault report
Initial contact to investigate issues raised through Fault report*
Call / email made and noted on the system
Internally generated Fault reports not included
Response to billing query
Initial contact to investigate issues raised through billing query
User can manage status and priority of support tickets No
Phone support Yes
Phone support availability 9 to 5 (UK time), Monday to Friday
Web chat support No
Onsite support Yes, at extra cost
Support levels We Provide every client a dedicated account manager this will cover Email and Phone support 8.30-5.30 Monday to Friday. Out of hours support is available via email, SLAs are in place.
Support available to third parties Yes

Onboarding and offboarding

Onboarding and offboarding
Getting started Once a customer signs up, we configure the system to their requirements, and import any data they wish to import, in the form of CSV files. We create user logins for the customer, and then complete the process by providing them with remote training via screen sharing, or on-site training, as required.
Service documentation Yes
Documentation formats
  • HTML
  • PDF
End-of-contract data extraction When a customer wishes to leave at the end of their contract, all the data is extracted in a spreadsheet format, and provided in a zip file by the WorkPal support team, along with any photos or forms added to the system during the course of the contract.
End-of-contract process We ensure a smooth handover of all customer information and data at the end of service. We provide this in a format that is suitable for each customer and is not charged to the customer.

Using the service

Using the service
Web browser interface Yes
Supported browsers
  • Internet Explorer 7
  • Internet Explorer 8
  • Internet Explorer 9
  • Internet Explorer 10
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
Application to install Yes
Compatible operating systems
  • Android
  • IOS
Designed for use on mobile devices Yes
Differences between the mobile and desktop service The mobile app is for field workers/engineers, and is tailored to their needs, providing job information and a means to capture their time, tasks, photos, forms and signatures, etc. on the jobs assigned to them.

The desktop app provides the means to administrate and schedule this work, manage customers, track users, generate reports, quote and invoice work. The Desktop app is available on mobile devices too.
Service interface No
What users can and can't do using the API As part of the discovery phase in implementation we would agree what the customer requirements were for an API and ensure this meets their needs. We use RESTful API as this is compatible with most customer systems. Any changes are completed through our team.
API documentation Yes
API documentation formats PDF
API sandbox or test environment Yes
Customisation available Yes
Description of customisation Both the desktop and mobile app can be configured, turning off or on the features required, as it suits the particular work of the company. For example, asset management can be turned on for companies who require it, or hidden for companies who do not need this feature.

This configuration is done by the WorkPal implementation team at the beginning of the contract, and can be revised throughout by request.

Bespoke forms for each company are also constructed at the beginning of the contract. These are reproduced digitally, in exactly the same forms as the companies existing paper forms.


Independence of resources Whilst we don't provide load-balancing as part of our service, our hosting is provisioned with much higher capacity than is currently required, so there is significant overhead for times of extra demand.

All our systems usage levels are constantly monitored, and capacity will be increased when we feel it is needed, to ensure no performance impact for our users.


Service usage metrics No


Supplier type Not a reseller

Staff security

Staff security
Staff security clearance Staff screening not performed
Government security clearance Up to Developed Vetting (DV)

Asset protection

Asset protection
Knowledge of data storage and processing locations Yes
Data storage and processing locations United Kingdom
User control over data storage and processing locations No
Datacentre security standards Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency At least every 6 months
Penetration testing approach Another external penetration testing organisation
Protecting data at rest Physical access control, complying with another standard
Data sanitisation process No
Equipment disposal approach Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data importing and exporting
Data export approach Users can export certain elements of their data from the report section of WorkPal, in CSV format, or request a full export of data, including files, from WorkPal support.
Data export formats CSV
Data import formats CSV

Data-in-transit protection

Data-in-transit protection
Data protection between buyer and supplier networks TLS (version 1.2 or above)
Data protection within supplier network TLS (version 1.2 or above)

Availability and resilience

Availability and resilience
Guaranteed availability We aim to exceed 99% uptime for our service, and have maintained this so far for the lifetime of our product. Should we have a significant outage of more than 4 hours on any one day, we will refund the cost of that days service to our customers
Approach to resilience Information available on request.
Outage reporting During any outage, customers will be informed via email, as well as a status page on our website. We will give regular updates, and notify customers when the service is available again.

Identity and authentication

Identity and authentication
User authentication needed Yes
User authentication Username or password
Access restrictions in management interfaces and support channels Access to management interfaces are username and password protected, and access is provided only to senior level staff with requirements to have access. Access to all staff computers are password protected, and access is restricted to our building only. Passwords are changed regularly, and meet strong password requirements. The develop team room also has physical access controls.
Access restriction testing frequency At least once a year
Management access authentication Username or password

Audit information for users

Audit information for users
Access to user activity audit information Users contact the support team to get audit information
How long user audit data is stored for User-defined
Access to supplier activity audit information You control when users can access audit information
How long supplier audit data is stored for At least 12 months
How long system logs are stored for At least 12 months

Standards and certifications

Standards and certifications
ISO/IEC 27001 certification Yes
Who accredited the ISO/IEC 27001 Exova
ISO/IEC 27001 accreditation date 4/7/17
What the ISO/IEC 27001 doesn’t cover The Provision of workflow and job management solution
ISO 28000:2007 certification Yes
Who accredited the ISO 28000:2007 Exova
ISO 28000:2007 accreditation date 4/7/17
What the ISO 28000:2007 doesn’t cover N/A
CSA STAR certification No
PCI certification No
Other security certifications No

Security governance

Security governance
Named board-level person responsible for service security No
Security governance certified Yes
Security governance standards ISO/IEC 27001
Information security policies and processes All ISO 27001 policies

Operational security

Operational security
Configuration and change management standard Supplier-defined controls
Configuration and change management approach As a department, changes will be reviewed and approval given based upon the potential risks and a urgency of the change.
The change will be scheduled, and if necessary communications to anyone potentially impacted will also occur.
Once the change is carried out, appropriate testing will be conducted to ensure stability has not been impacted, and if roll-back options are needed they will be carried out.
In the event a change is deemed urgent or critical to maintain service or prevent a security breach, IT Office may deem this process as being too time consuming, and skip straight to implementation.
Vulnerability management type Supplier-defined controls
Vulnerability management approach We work with our hosting provider to maintain our services, with regard to third-party software, such as operating systems and other software on our hosting platform. The provider will patch any known vulnerabilities as they become apparently. We aim to keep our software patched to the latest versions, paying attention to notices from the suppliers of this software.
Protective monitoring type Supplier-defined controls
Protective monitoring approach Most of the systems deployed and used by WorkPal have some basic form of event logging enabled by default. These logs are regularly reviewed for event ID’s which may indicate unexpected or unauthorised actions on these systems.

During any potential compromise, we would investigate, then notify the affected parties, if applicable.

The incident would be given immediate priority and all resources would be put on to it until it was resolved.
Incident management type Supplier-defined controls
Incident management approach Where an Information Security Incident has occurred (or is suspected) the following process MUST be followed.
Reported to a member of the IT Team as quickly as possible, and providing as much information as is available to the member of staff who first identified the problem.
The member of Staff who received the Incident Report should record the Information in the ticketing system
Once investigations have been concluded, a report should be prepared detailing everything that happened, steps that were taken to mitigate the Incident, and record any possible corrective actions will be recommended to prevent a re-occurrence

Secure development

Secure development
Approach to secure software development best practice Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Public sector networks
Connection to public sector networks No


Price £15 to £30 per user per month
Discount for educational organisations No
Free trial available Yes
Description of free trial All aspects of the service are included, it will not show specific customer forms but generic ones. This is a 30 day trial.

Service documents

Return to top ↑