Infonetica Ltd

Ethics RM

Ethics RM is a cloud-based Research Ethics Review management solution used by research intensive universities, hospitals, ethics committees, Institutional Review Boards and government bodies. The platform facilitates researchers to collaborate and submit ethics applications, ethics committees and reviewers to review applications and research managers to manage an organisation's ethics portfolio.

Features

  • Create and configure interactive forms and workflows
  • Applicants can collaborate with researchers and supervisors to develop applications
  • Facilitate committee reviewers to collaborate on review of submitted applications
  • Automated application classification, routing and assignment
  • Automated alerts for deadlines and milestones
  • Standard communication templates
  • Documentation repository
  • Role based dashboards
  • Reporting on portfolio status and KPIs
  • Audit trail on all activity

Benefits

  • Eliminate paper and email correspondence
  • Create significant cost savings to organisations
  • Provide time savings to Research Managers, Reviewers and Secretaries
  • Reduce workflow complexities
  • Reduce missed deadlines and information
  • Have easy access to all documentation and updates
  • Easily generate reports and track performance
  • Update workflow and forms at any time

Pricing

£15,000 a licence a year

  • Education pricing available
  • Free trial available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Russell.Pridmore@infonetica.net. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 12

Service ID

4 4 1 3 3 4 2 2 3 2 1 9 1 3 2

Contact

Infonetica Ltd Russell Pridmore
Telephone: 0208 334 6900
Email: Russell.Pridmore@infonetica.net

Service scope

Software add-on or extension
No
Cloud deployment model
Private cloud
Service constraints
None
System requirements
  • Internet
  • Web browser

User support

Email or online ticketing support
Email or online ticketing
Support response times
Tickets are classified into 4 groups depending on the nature of a ticket and the severity of the incident. The response rate is dependent on the severity. A table detailing response rates and escalation routes is included in the contract.
User can manage status and priority of support tickets
No
Phone support
Yes
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
No
Onsite support
No
Support levels
We provide training to system administrators to build forms and workflows as well as to manage and use the system. These training sessions are provided at the start of the service and subsequently on a needs basis.
The system has been very intuitive that users have not needed any training to use the system.
In addition, we offer telephone, email and support via an Online Jira platform for any system related queries or issues.
Clients would also have a single point of technical contact as further support.
Support available to third parties
Yes

Onboarding and offboarding

Getting started
We train system administrators to set up the system for optimal use. We train them to create and amend forms, workflows and templates. Training is provided onsite or online. We also provide user documentation.
Service documentation
Yes
Documentation formats
  • PDF
  • Other
Other documentation formats
DOC
End-of-contract data extraction
We extract and provide customers with their data in the native format.
End-of-contract process
An extract of customer data in a native format in the timescales provided in the contract is included in the price of the contract. Any change to format (where possible) and timescales incur an additional cost.

Using the service

Web browser interface
Yes
Supported browsers
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
Application to install
No
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
None
Service interface
No
API
Yes
What users can and can't do using the API
Using the API, users can export data to and import data from other systems. The API can consume as well as output in XML or JSON data.
API documentation
Yes
API documentation formats
  • PDF
  • Other
API sandbox or test environment
Yes
Customisation available
Yes
Description of customisation
System administrators can customise forms, workflows and branding. They can also customise screens and dashboards for various user types. Applicants and reviewers can customise their personal work area.

Scaling

Independence of resources
All customers run in their own resource pool. While the system is capable of utilising excess resources if required, we can also clamp the resources to ensure a single customer does not impact other users.

Analytics

Service usage metrics
Yes
Metrics types
Applications, users, reviewers and storage.
Reporting types
Reports on request

Resellers

Supplier type
Not a reseller

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Baseline Personnel Security Standard (BPSS)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
User control over data storage and processing locations
No
Datacentre security standards
Managed by a third party
Penetration testing frequency
At least once a year
Penetration testing approach
‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
Protecting data at rest
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
Data sanitisation process
Yes
Data sanitisation type
Explicit overwriting of storage before reallocation
Equipment disposal approach
A third-party destruction service

Data importing and exporting

Data export approach
Users are be able to download their applications which include data they submit. At the end of the contract, clients would receive an extract of their data in the native format.
Data export formats
  • CSV
  • Other
Other data export formats
  • DOC
  • PDF
  • JSON
  • XML
  • HTML
Data import formats
  • CSV
  • Other
Other data import formats
  • XML
  • JSON

Data-in-transit protection

Data protection between buyer and supplier networks
TLS (version 1.2 or above)
Data protection within supplier network
TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability
Service level agreement (SLA) for availability is included as part of the contract terms and conditions, which also includes details of refunds if guaranteed levels of availability are not met.
Approach to resilience
All servers are virtualised and clustered. It is designed to be self healing so a working server will always take over from a failed server. We maintain a second facility that keeps a realtime copy of the Data and ensures the whole service is resilient from any hardware failure right through to entire data centre failure. Hourly backups with 90 day retention ensure partial data can be restored from a partial corruption or error.
Outage reporting
A customer dashboard displays overall SLA levels for the past 12 months.

Identity and authentication

User authentication needed
Yes
User authentication
  • Username or password
  • Other
Other user authentication
Ethics RM supports standard forms authentication out-of-the-box.It also supports various forms of Single Sign-on including ADFS, Azure and Shibboleth. Ethics RM also supports authentication directly through LDAP. We also offer dual authentication for institutions who have chosen a single sign-on system. This will allow both internal and external reviewers to access the system.
Access restrictions in management interfaces and support channels
We have tightly controlled privileged account access. Support require permission from clients to access their account through the management interface of the site.

Support have no direct access to backend systems and data. Direct management of internal systems controlling the data is tightly controlled by 2 senior employees.
Access restriction testing frequency
At least every 6 months
Management access authentication
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users contact the support team to get audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
Between 6 months and 12 months

Standards and certifications

ISO/IEC 27001 certification
No
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Other security certifications
Yes
Any other security certifications
  • CyberEssentials (CyberEssentials+ is being finalised)
  • DataCentres are ISO27001
  • We are PCI DSS compliant through self assessment.

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
Other
Other security governance standards
CyberEssentials+
Our DataCentres are ISO27001
Information security policies and processes
We have a full ISMS set of policies and processes covering all aspects of our Security and operations. This can be provided on request.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
We maintain a fully secured source control and change management system. All changes are peer reviewed before committing. Deployment of change is only possible from a committed change. We work on lots of small changes rather than significant bulk updates. If we make a substantial change to the solution security, this would trigger a fresh penetration test.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Aside from regular penetration testing, we operate enterprise grade Malware and intrusion detection. This analyses our logs and services looking for vulnerabilities that match criteria supplied from common threat notification services. These services include IBM, Cylance & Alienvault OTX reports.

Patch management systems are in place to ensure critical updates are immediately deployed with Bi-Weekly patch reviews of non critical updates.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
Both our Malware detection and Security Management systems detect threat activities from application behaviour or logged events. If a potential compromise is detected, both are capable of tracing back the source of the compromise which helps identify what that compromise had access up to it's prevention or termination.

Potential compromises are investigated as a top priority and we have a full Incident response process to ensure we respond internally and notify users of any breach within the the ICO guidelines.
Incident management type
Supplier-defined controls
Incident management approach
We have a full incident management process detailing incident grading and response times. This can be provided on request.

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks
No

Pricing

Price
£15,000 a licence a year
Discount for educational organisations
Yes
Free trial available
Yes
Description of free trial
A free instance of the service with limited users and user roles for a period of 3 months. Set-up support and customisation may be charged depending on complexity.

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Russell.Pridmore@infonetica.net. Tell them what format you need. It will help if you say what assistive technology you use.