i2N Ltd

Evidence Manager

Evidence Manager is a comprehensive Digital Evidence Management Solution that stores digital material in a secure cloud environment. It can manage a wide variety of evidence formats including PDF, audio, video and images for police and HMPPS. Evidence Manager includes powerful and sophisticated bundling and case preparation tools


  • Secure storage of digital evidence and material
  • Bundling of evidence into a single, managed, referenced document
  • Compliant with BS 10008 for legal admissibility of electronic evidence
  • Inbuilt file conversion capability for ease of management and presentation
  • Scalable for thousands of users and terabytes of storage
  • Automatic numbering of evidence documents
  • MOPI compliant records management and retention capability
  • Role based access controls, full audit trail for all activities
  • Integrates with Hearings Manager and Case Publishing Manager
  • Views different multi media formats without requiring plug ins


  • Manage case information more effectively - no lost information
  • Enables collaboration of staff on case creation and preparation
  • Fast preparation of evidence for different parties, including redaction
  • Easy, secure transfer of evidence to the courtroom environment
  • Secure and audited information
  • Allows remote access to evidence, minimising travelling
  • Provides standard evidence formats, minimising effort to view evidence
  • Fast searching of descriptive information
  • Enables efficient burning to DVD, where required
  • Automate process of evaluating evidence and discarding non-evidential material


£300 per user per year

  • Free trial available

Service documents

G-Cloud 11


i2N Ltd

Marco Fiorentino

01473 731230


Service scope

Service scope
Software add-on or extension No
Cloud deployment model Hybrid cloud
Service constraints Evidence Manager can be used on PCs, Laptop or tablets and is tested for compatibility with latest versions on all common browsers but may need to be tested with very old browser versions.
Depending on the sensitivity of your data you can access using internet or a secure intranet; we will work with your data-owner to set up appropriate controls to protect your data.
Service Desk support is currently 08:00 to 18:00 on working days. Extended support up to 247 can be provided on request.
Maintenance is currently done at weekends. Maintenance windows can be agreed with individual customers.
System requirements
  • Modern Browser Technologies (supporting HTM5)
  • Access to Secure Intranets such as PSN in some circumstances.

User support

User support
Email or online ticketing support Email or online ticketing
Support response times Incidents can be raised with the Service Desk by email or telephone and will be responded to within 15 minutes during office hours. Normal office hours are 08:00 to 18:00 weekdays (except public holidays), calls or emails received outside of these hours will be responded to within 15 minutes of the start of the next working day. Extended cover up to 24/7 can be arranged if required with the same response times as working days.
User can manage status and priority of support tickets No
Phone support Yes
Phone support availability 9 to 5 (UK time), Monday to Friday
Web chat support Yes, at an extra cost
Web chat support availability 9 to 5 (UK time), Monday to Friday
Web chat support accessibility standard WCAG 2.1 AA or EN 301 549
Web chat accessibility testing Web Chat support is provided by a COTS product that has been extensively tested for assistive technology support and conforms to W3C AA Standards for Accessibility.
Onsite support Yes, at extra cost
Support levels Our Software-as-a-Service products comes with Service Desk, Hosting and Infrastructure Support all included in the cost. Standard Service Desk support is the same for all customers: Service Desk hours 08:00 to 18:00 weekdays (except public holidays), accessed via email, customer portal (with Web Chat support) or phone, responses within 15 minutes, severity one incidents resolved within 4 hours (see detailed SLA). The i2N Service Desk is staffed with ITIL trained, SC Cleared Analysts, fully trained on all i2N applications, able to resolve the majority of incidents on the first call. Extended Service hours up to 24/7 quoted on request at individual customer rate depending on requirement.
Support available to third parties Yes

Onboarding and offboarding

Onboarding and offboarding
Getting started The standard onboarding process is free and consists of the initial set-up of authentication and loading of reference data. Evidence Manager comes with a self-service portal for password maintenance with administrator facilities for on-going security management. We can set up the administrators who can then manage the rest of the staff or we can perform an initial loading. Each customer will have an account manager who takes care of the onboarding process, ensuring the correct set-up of authentication and reference data. EM has an individual instance of the EM training system for each customer and comes with a free train-the-trainer session.
Additional on-boarding including cascade training, development of bespoke modules or APIs or individual infrastructure will be quoted on an individual basis.
The standard EM offering is a multi-tenanted offering utilised by multiple customers with individual authentication paths to segregate their data. Customers with particularly sensitive data may request an individual bespoke hosting environment (in the cloud hosting environment of their choice) with addition security and defence architecture. MOJ customers already have an accredited multi-tenanted infrastructure in UKCloud Elevated so additional on-boarding infrastructure is quick and cost-effective.
Service documentation Yes
Documentation formats
  • ODF
  • PDF
End-of-contract data extraction At the end of the contract customers will be provided with their production data using a CESG certified procedure. The data is extracted from the production system and can be provided in a number of formats. If the data is sensitive, we will protect it on a CESG approved encrypted drive that will be securely transported to the customer using a process approved by the customer data owner. Once the data has been extracted the cloud data storage will be erased using CESG approved techniques.
End-of-contract process Evidence Manager is a cloud hosted Software-as-a-Service Product and is charged on a usage basis plus a basic monthly subscription. At the start of the contract each customer is provided with a URL to access EM and their users are set up with valid authentication to access the system. At the end of the contract, after the customer data has been returned, access will be removed and the customer’s databases (including the authentication) will be erased using CESG approved techniques. There is no additional cost to provision of the data extract or termination.

Using the service

Using the service
Web browser interface Yes
Supported browsers
  • Internet Explorer 7
  • Internet Explorer 8
  • Internet Explorer 9
  • Internet Explorer 10
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
  • Opera
Application to install No
Designed for use on mobile devices Yes
Differences between the mobile and desktop service Evidence Manager is built using modern browser-based application frameworks which allow for the easy transition between desktop to mobile devices. Additionally, Evidence Manager has been worked on by the i2N development team to add additional rendering benefits to improve usability on smaller tablet devices. Device-aware components automatically switch appearance and behaviour to best suit the size of the device, and to provide a better experience for touch screens. Finger taps and gestures arrive as normal mouse events, so your event handlers just work - users can even trigger context menus and hovers via touch-and-hold, and drag-and-drop via finger slides.
Accessibility standards WCAG 2.1 AA or EN 301 549
Accessibility testing I2N’s utilises modern frameworks and technologies which deliver the basic set of requirements for semantic and accessible UI code. We perform assistive technology testing using ZoomText, JAWS and Dragon Naturally Speaking and ensure we are in compliance of W3C AA Standards for Accessibility.
What users can and can't do using the API Evidence Manager has an easily configurable API for interfacing with Case Management Systems. The standard API operates between any SOAP / RESTful interface on the CMS and is quick to implement at On-Boarding.
API documentation No
API sandbox or test environment No
Customisation available No


Independence of resources Performance on all customer systems is monitored with real-time dashboard displaying utilisation of processor, memory and disk. Automatic alerting provides timely warning or the need to augment resource and new virtualised resource can be implemented before any impact occurs. Network analysis tools display all internal traffic within applications so any constraints building on any system node are anticipated and managed. Customers with particularly sensitive data may opt to operate on dedicated virtual cloud infrastructure for security reasons; regardless of whether running on dedicated or shared infrastructure resources are maintained well above thresholds and monitored to ensure better that SLA performance.


Service usage metrics Yes
Metrics types Evidence Manager provides detailed usage metrics. The i2N Service Desk statistics on incident management and SLA performance are also available to users and to the User Group. We, as a standard, provide monthly service desk reports which include a usage report.
Reporting types
  • Regular reports
  • Reports on request


Supplier type Not a reseller

Staff security

Staff security
Staff security clearance Conforms to BS7858:2012
Government security clearance Up to Security Clearance (SC)

Asset protection

Asset protection
Knowledge of data storage and processing locations Yes
Data storage and processing locations United Kingdom
User control over data storage and processing locations Yes
Datacentre security standards Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency At least once a year
Penetration testing approach ‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Encryption of all physical media
  • Other
Other data at rest protection approach Data at rest is protected according to the solution selected by the customer and the cloud provider capabilities. All cloud providers support as a minimum AES-256 encryption of data. i2N encourage its customers to protect their own data using encryption technologies where they are the sole decryption key owners. In this way, our customers are assured that their data can never be accessed by a third party. i2N own data is encrypted when the service requires it.
Data sanitisation process Yes
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
Equipment disposal approach Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data importing and exporting
Data export approach Evidence Manager is designed to provide easy access to data within and outside the application. The micro-services architecture facilitates interfacing through APIs including a standardised CMS interface and the potential for customised interfaces with other customer applications. Standard reporting provides comprehensive dashboards and KPI monitoring and users are able to build their own reports and data extracts. Search screens are customisable and the data from any search can be exported to Excel.
Data export formats CSV
Data import formats CSV

Data-in-transit protection

Data-in-transit protection
Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
Other protection between networks Alongside deep inspection of protocols (Palo Alto IPS), i2N controls the logical networks that are created atop the physical cloud provider infrastrcuture. We use defence in depth approach, logically segment networks where possible, configure several firewall layers, IPSs, deep packet inspection and real time security event correlation monitoring.
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
  • Other
Other protection within supplier network As well as using Private network or public sector networks, Palo Alto Firewalls and Segmentation, i2N controls the logical networks that are created atop the physical cloud provider infrastrcuture. We use defence in depth approach, we logically segment networks where possible, configure several firewall layers, IPSs, deep packet inspection and real time security event correlation monitoring.

Availability and resilience

Availability and resilience
Guaranteed availability I2N Guarantees high levels of availability by hand picking cloud providers which promise outstanding uptimes and high levels of accountability in their work. The minimum uptime requirement that we consider acceptable is 99.9%. We strive to ensure that on the rare occasion that downtimes does occur that the root cause of the problem is identify to prevent future occurrences. Our commitment to above and beyond levels of availability help us to ensure the highest levels of end user availability.
Approach to resilience Our service relies on the cloud providers capabilities, which are deployed across a number of zones (local replication), sites (datacenter replication) and regions (geo replication) offering various levels of resilience. Each zone is designed to eliminate single points of failure (such as power, network and hardware). By default, a standard service would allocate a VM in a single datacenter. The customer must then decide whether their solution requires further resilience and purchase the corresponding service level from i2N. Load balancing and autofailover are available. Customers are encouraged to ensure their solution spans multiple sites, regions or zones to ensure service continuity should a failure occur.
Outage reporting Outages are identified as Planned maintenance, Emergency maintenance, and platform issues. Service outage portals provide end user live feedback on outages allowing the user to know in real time without having to call the i2N support desk to ask one of our expert engineers to launch an investigation into the root cause. Email are also sent out for Planned maintenance, Emergency maintenance, and platform issues. The designated Technical Account Manager will proactively contact customers as appropriate.

Identity and authentication

Identity and authentication
User authentication needed Yes
User authentication
  • Public key authentication (including by TLS client certificate)
  • Limited access network (for example PSN)
  • Username or password
Access restrictions in management interfaces and support channels Access to the Management Interfaces for Evidence Manager are specifically controlled by i2N’s Access Control Policy. Administration and Support staff must be SC cleared, and must use privileged super user or administrative accounts, which are granted on the basis of least privilege.

Rigorous authentication policies control privileged access.
The activities of all privileged accounts are fully tracked and recorded, clearly identifying the access and actions undertaken. i2N review all privilege access accounts for different systems including user accounts on regular intervals as part of ISO27001 active control”
Access restriction testing frequency At least every 6 months
Management access authentication
  • 2-factor authentication
  • Limited access network (for example PSN)
  • Username or password

Audit information for users

Audit information for users
Access to user activity audit information Users contact the support team to get audit information
How long user audit data is stored for User-defined
Access to supplier activity audit information Users contact the support team to get audit information
How long supplier audit data is stored for User-defined
How long system logs are stored for User-defined

Standards and certifications

Standards and certifications
ISO/IEC 27001 certification Yes
Who accredited the ISO/IEC 27001 DNV GL
ISO/IEC 27001 accreditation date 26/03/2019
What the ISO/IEC 27001 doesn’t cover The scope of the Information Security Policy includes the entire company. Specifics are: all identified company assets, based in Suffolk office, the corporate communications infrastructure that supports all company business areas and functions. All staff -all employees and all Associates contracted to i2N at any time.​ All company assets are listed within the i2N Configuration Management database are considered to be within the scope of the information security policy. All company assets are included in scope of ISO27001 accreditation apart from 2 Meeting rooms located in Unit 1A, Copdock.
ISO 28000:2007 certification No
CSA STAR certification No
PCI certification No
Other security certifications Yes
Any other security certifications
  • Cyber Essentials Certificate of Compliance
  • I2N PSN Connection Compliance Certificate
  • Formerly MoJ-CESG PGA i2N dev, test and AGN network

Security governance

Security governance
Named board-level person responsible for service security Yes
Security governance certified Yes
Security governance standards ISO/IEC 27001
Information security policies and processes I2N has a number of inter-connected governance frameworks in place which control how the company operates and provides its services to customers. The most relevant of these is certification to ISO/IEC27001:2013, the international standard for Information Security Management Systems. Various policies refer to: SPG016P-Acceptable use of i2N resources & assets; SIM009P – User account security instructions and password management; SIM033P-User access control instructions; SPG017P-Physical security procedures; SPG018P-Data handling procedures; SPG019P-Data access procedures; SPG020P Network access procedures; SPG022P-Change management; SPG026P-Incident management; SPG027D- Business and service continuity; SPG032P-Backup procedures; SIM011P – i2N Network Administrator SyOps; SIM039N – i2N Infrastructure Group Policies; SIM020N – Log Monitoring Guide; SPG023P Internal IS Audit Procedures; SPG029P Document Management Procedure; SPG030P Compliance Checking Procedures; SPG036P Software Patching Procedures; SPG037P Hardware Lifecycle Management; SPG038P Software Lifecycle Management; SPG042P Software Development - Testing; SPG045P Agile Software Development Policy; SPG046P Secure Services Engineering; SIM003P Illegal Working checklist; SIM034P Staff Recruitment Checklist; SIM041P Infrastructure Outage Instructions; SIM043P Acceptance into Service Checklist There are several other Technical server builds, client builds, vulnerability management, firewall controls baselined documents. All policies are covered by i2N review procedure. Policies for critical assets are reviewed six monthly and other are reviewed at least annually.

Operational security

Operational security
Configuration and change management standard Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach I2N fully tracks the status, location and configuration of service components throughout their lifetime to industry best practice. Security considerations are mandatory prior to its submission for review by the Change Advisory Board, including: User service(s), team or location impacted Risk and impact assessed. Identification of the applicable assets involved in the proposed change. Plan for change testing activities and regression testing. Assignment of appropriately qualified resources, in-line with change impact assessment tasks. Changes are only permitted where the above criteria are met, and any potential security issues are identified and properly prepared for.
Vulnerability management type Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach I2N has a process to identify threats and vulnerabilities which could have impact on the loss of the confidentiality, integrity or availability of data assets. Information with regard to technical vulnerability is sought from various sources. These include; Regular independent ITHC check, Nessus vulnerability scans and Microsoft windows alerts. Patches are deployed manually and via automated processes. i2N technical services team prioritise the mitigation of vulnerabilities based on its severity. Evidence of vulnerability management is independent validated by ISO 27001 auditors and status of the action taken against vulnerabilities is periodically assessed as part of the ITHC checks.
Protective monitoring type Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach I2N G-cloud services are protected by the i2N Secure Operations Centre (iSOC). The iSOC delivers a full GPG-compliant logging service. All application and system logs are reviewed and alerted based on twelve core control areas documented within GPG13. The iSOC team monitors alerts displayed on consoles in the secure area, allowing i2N G-cloud Services to support active monitoring, incident identification and active response and investigative activities. Potential threats are analysed with clear escalation paths to second-level support for specific threats. Evidence of an effective protective monitoring service has been validated, assessed, and certified, multiple times by the MOJ Accreditors.
Incident management type Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach I2N has formal policies and procedures for incident management activities to identify, remediate & resolve incidents. i2N’s service desk is ISO27001 accredited and all staff are SC cleared. i2N provides ITIL compliant support for service desk tickets. The Incident Management Process are published within the on-line Customer Portal all provide clear information to customers on what a incident is and how it should be reported to the Service Desk. The Service Desk will provide a triage service for all calls and route them to i2N Application/Infrastructure Support, or third party Service Desks for incident analysis and resolution.

Secure development

Secure development
Approach to secure software development best practice Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Public sector networks
Connection to public sector networks Yes
Connected networks Public Services Network (PSN)


Price £300 per user per year
Discount for educational organisations No
Free trial available Yes
Description of free trial A free trial is provided covering software, service desk and hosting. This is suitable for non-secure trial usage. More secure trial environments can be provided although this is likely to involve some up front costs. Please contact i2N to discuss security requirements for a trial.

Service documents

pdf document: Pricing document pdf document: Skills Framework for the Information Age rate card pdf document: Service definition document pdf document: Terms and conditions
Service documents
Return to top ↑