Malcolm! is a set of easy to use tools that lets your users service, interact & engage with you online.


  • User Workflows
  • FAQs and Knowledge Base
  • Embeds, Widgets, Overlays & Plugins
  • Hosted Hub
  • Integrations with third party apps & services
  • API
  • Comprehensive Control Panel
  • Full control of look and feel
  • Analytics


  • For customers, staff, suppliers, students, residents, brokers, affiliates, patrons etc
  • Let your users self service 24/7/365
  • Drive operational efficiency
  • Improve user experience
  • Easily plug into other systems and tools you use
  • Track & manage with oversight of all user activity.
  • Automate your processes.
  • Scale what you do with no people related bottlenecks.


£30 to £199 an instance a month

Service documents


G-Cloud 12

Service ID

8 4 9 3 8 9 4 4 9 2 0 6 4 5 9


Telephone: 02076556542

Service scope

Software add-on or extension
Yes, but can also be used as a standalone service
What software services is the service an extension to
Malcolm! integrates with thousands of other third party applications via Integrations and can also interact with your internal systems via Webhooks or our API.
Cloud deployment model
  • Public cloud
  • Private cloud
  • Hybrid cloud
Service constraints
Malcolm! is a fully hosted service - we don't currently offer on site deploys (but can offer private & locked down bespoke hosting arrangements)
System requirements
You just need a web browser and an internet connection

User support

Email or online ticketing support
Email or online ticketing
Support response times
Usually within a couple of hours
User can manage status and priority of support tickets
Phone support
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
Onsite support
Yes, at extra cost
Support levels
Email support is included in our regular plans.

Phone support, 1-2-1 training (in person or via video conference) and named account and technical contacts are options in our Enterprise plans.
Support available to third parties

Onboarding and offboarding

Getting started
Customers on our regular plans can sign up 24/7/365 and begin setting up Malcolm! themselves - the process is fully automated and we also have a very comprehensive online Support Centre. Assistance is also available via our Support Desk.
Customers on our Enterprise plans can also have 1-2-1 training face to face or via video conference.
Service documentation
Documentation formats
End-of-contract data extraction
Either via self service within the Malcolm! software or they can request exports via our Support Centre.
End-of-contract process
All our regular plans are fully inclusive of the described features, quotas and email support.

Enterprise plans are custom to each customer and can include training, 24/7/365 support, custom integrations, bespoke design or development, content creation services etc.

Using the service

Web browser interface
Supported browsers
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
  • Opera
Application to install
Designed for use on mobile devices
Differences between the mobile and desktop service
All the screens your end users will see and interact with are fully mobile optimised.

The control panel which your team use to set up and configure Malcolm! is designed to work on desktop devices only.
Service interface
Description of service interface
There is a comprehensive control panel and dashboard called MyMalcolm
Accessibility standards
WCAG 2.1 AA or EN 301 549
Accessibility testing
We have customers who use assistive technology. Internally we follow various accessibility processes as part of our design and development process and make use of testing tools.
What users can and can't do using the API
All customers on our regular plans can use Integrations and Webhooks.
Enterprise customers can have full programatic access to every aspect of Malcolm! via our comprehensive API.
API documentation
API documentation formats
API sandbox or test environment
Customisation available
Description of customisation
Numerous aspects of Malcolm! can be customised out of the box.
This includes full look and feel control, use of your own domain, all front end text and lots of granular level controls over all aspects of Malcolm!
Enterprise customers can also access bespoke development / integration services.


Independence of resources
We have comprehensive resource management practices and procedures in place. Customers on our Enterprise plans can also benefit from dedicated hosting if required.


Service usage metrics
Metrics types
A large number of service metrics are available in our comprehensive control panel / dashboard. This includes both end user activity and activity by members of your own team who administer Malcolm!
Reporting types
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request


Supplier type
Not a reseller

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
User control over data storage and processing locations
Datacentre security standards
Managed by a third party
Penetration testing frequency
At least every 6 months
Penetration testing approach
Another external penetration testing organisation
Protecting data at rest
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
Data sanitisation process
Data sanitisation type
Deleted data can’t be directly accessed
Equipment disposal approach
A third-party destruction service

Data importing and exporting

Data export approach
Via self service within the Malcolm! software or via opening a ticket with our Support Centre.
Data export formats
Data import formats
Other data import formats
Many formats are supported - open ticket for more info

Data-in-transit protection

Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Bonded fibre optic connections
  • Legacy SSL and TLS (under version 1.2)
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability
We target 99.9 service availability but don't contractually guarantee this for customers on our regular plans. We are able to offer various SLAs to our Enterprise Customers - these are negotiated individually.
Approach to resilience
We host in Amazon Web Services (AWS) and make use of the various resilience options available to us via their service.
Outage reporting
We have a public status dashboard. Enterprise customers are also able to specify how they wish to be notified of outages.

Identity and authentication

User authentication needed
User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
Access restrictions in management interfaces and support channels
Access is restricted by username and password. In addition to this various additional restrictions can be added for our Enterprise customers for example Two Factor, network restrictions, integration with single sign on / federated systems, time of day access etc
Access restriction testing frequency
At least every 6 months
Management access authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users have access to real-time audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
At least 12 months

Standards and certifications

ISO/IEC 27001 certification
ISO 28000:2007 certification
CSA STAR certification
PCI certification
Other security certifications

Security governance

Named board-level person responsible for service security
Security governance certified
Security governance approach
We have an information security policy available on request.
Information security policies and processes
We have an information security policy available on request.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Configuration and changes are managed through our internal processes which include comprehensive internal standards and guidelines. Proposed changes are peer reviewed by a human and are also subject to automated tests both pre and post deploy.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
We use a variety of methods to asses and stay aware of potential vulnerabilities. This includes our own analysis of network traffic, third party automated services, mailing lists and industry specific forums (both online and in person). Available patches are reviewed and assessed on a case by case basis. If they are assessed to be urgent they are deployed immediately.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
We use a variety of our in-house tools and third party services to monitor our services. Any issues are managed via our internal processes which ranks and assigns a priority to any incident.
Incident management type
Supplier-defined controls
Incident management approach
We have various processes and procedures in place for common events. End users can report incidents via our Support Centre.
Incident reports are provided to Enterprise Customers within the agreed format and timelines.

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks


£30 to £199 an instance a month
Discount for educational organisations
Free trial available
Description of free trial
All features are included.
You are limited to 5 FAQs
You are limited to 1 Workflow
Your file uploads are limited to a total of 50MB.
The trial is 14 days long.
Link to free trial

Service documents