XMA Limited

XMA Salesforce - Configure, Price, Quote (CPQ) & Billing (Quote-to-Cash)

Enterprise services focused on configure, price, quote; billing; recurring revenue. Providing a robust, 100% native CPQ solution on Salesforce.com that reduces errors, streamlines processes, and improves direct and indirect sales productivity. SFDCX2020GC12


  • Guided Selling
  • Product Configuration & Bundling
  • Static & Dynamic Costing/Pricing
  • Configurable Workflow, Approval Processes, & Governance
  • Document Generation
  • Contract Management
  • No-code & Low-code declarative configuration, Open API integration, Training included.
  • Complex case-flow & Kanban, Citizen centric view, Chatbots, Engagement Timeline.
  • Social Collaboration, omni-channel engagement, Mobile ready, Knowledge base, Analytics, AI
  • Integration with eSignature, Tax Applications, & 3rd Party Apps


  • Eliminate errors in opportunities, configurations, quotes and contracts
  • Quickly create accurate quotes and proposals with premium branding
  • GDPR & CE+ compliant
  • Increase deal sizes with cross-sell and up-sell guidance
  • Easily handle volume discounts, contracted/customer pricing, channel/partner pricing
  • Enforce governance, compliance, and auditing for CPQ process
  • Split and manage clean orders as required with back-end integration
  • Automate add-on orders with co-terming and contract terms
  • Generate renewal quotes while applying price increases
  • Increase speed-to-market with point/click administration and updates


£3.22 a unit a month

  • Free trial available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@xma.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.


G-Cloud 12

Service ID

8 9 5 6 1 5 7 9 3 6 8 9 7 2 6


XMA Limited Nancy Clayton-Schofield
Telephone: 0115 846 4000
Email: bidteam@xma.co.uk

Service scope

Software add-on or extension
Yes, but can also be used as a standalone service
What software services is the service an extension to
Salesforce services are all modular and pre-integrated with AI from einstein built-in. Functionality can be expanded as needed. Typically customers extend by adding: Service Cloud for case management, Sales Cloud for CRM and 360degree information view, and Marketing Cloud for engagements and customer journeys. Further information here https://appexchange.salesforce.com/ and https://www.salesforce.com/uk/products/
Cloud deployment model
Public cloud
Service constraints
The solution is an add-on to the Salesforce Sales Cloud at a minimum.
Requires an internet connection
Requires a supported browser (Firefox, Chrome, Safari, IE, Edge)
System requirements
  • Connectivity to the Internet
  • Standard browser - desktop or mobile
  • Salesforce mobile app is available if preferred
  • Appropriate bandwidth, https://help.salesforce.com/articleView?id=000004958&type=1

User support

Email or online ticketing support
Email or online ticketing
Support response times
Every Salesforce service includes support as standard. The lowest level relies on the Salesforce user community for responses and has a response time of 2 business days, this can be reduced to 1 hour with the appropriate upgrade in your support plan.
User can manage status and priority of support tickets
Online ticketing support accessibility
None or don’t know
Phone support
Phone support availability
24 hours, 7 days a week
Web chat support
Web chat
Web chat support availability
24 hours, 7 days a week
Web chat support accessibility standard
None or don’t know
How the web chat support is accessible
Salesforce Web chat has not been specifically tested against usability standards; the Salesforce web chat Pre-Chat and Post-Chat forms are implemented through Salesforce's Visual Force Markup language, the presentation of which can be customised by the customer, giving them control over accessibility, including for example:
- providing text alternatives for any non-text content so that it can be changed into other forms people need, such as large print, braille, speech, symbols or simpler language. They can, for example, set Alt Tags on any images used on the forms or in the chat window.
- Ensuring that colour isn't the only means of conveying information and making contrast ratios between text and its background sufficient that it can be read by people with moderately low vision.
Web chat accessibility testing
Salesforce has not conducted usability studies to verify that the online chat function works effectively with screen reading and other assistive technology. However, existing customers have conducted extensive testing and, for example, the Driver and Vehicle Licensing Agency is successfully using the Salesforce Webchat capability in production
Onsite support
Yes, at extra cost
Support levels
Every Salesforce service includes community-based support. This can be enhanced with guaranteed response times through Premier and Premier+. For more critical applications we provide Signature Success which provides Salesforce staff with a knowledge of a specific customers applications and configurations and an initial response from your designated support team in as little as 15 minutes, with personalised updates every 30 minutes.
Support available to third parties

Onboarding and offboarding

Getting started
Salesforce provides an amazing immersive self-learning environment available called “Trailhead” for anyone who would like to have an engaging and interactive way of learning about salesforce. It is an online and free to use learning environment available here: https://trailhead.salesforce.com/

In addition, Salesforce's Customers for Life is designed to help customers be successful and get up and running quickly. A dedicated group is available for new customers to engage by asking questions, giving feedback, and sharing experiences. this also includes 'Getting Started Webinars', 'Getting started resources','Salesforce Tech-lounge for new customers' and 'getting started live Q&A' further detail available at https://www.salesforce.com/success-getting started/
Service documentation
Documentation formats
  • HTML
  • PDF
  • Other
Other documentation formats
  • Free online courses referred to as Trails
  • Dedicated website called Trailhead gives access to these Trails
  • Each designed with a specific purpose and skill in mind
  • Urther information on Trailhead can be found here https://trailhead.salesforce.com/en/trails
End-of-contract data extraction
There are a number of options available for customers to extract their data from the service, either during the contract or when the contract ends. We encourage customers to export their data during their contract on a periodic basis to maintain a local copy of their salesforce database, rather than wait until the end of the contract These options include: The Weekly Export Service – export data from the service on a periodic basis via a zip file containing .csv files over a TLS link. Export data over the API via an integration or middleware solution. A comprehensive Salesforce exit strategy paper is available on request.
End-of-contract process
After termination of all subscriptions associated with an environment, Customer Data submitted to the Covered Services is retained in inactive status within the Covered Services for 120 days, after which it is securely overwritten or deleted from production within 90 days, and from backups within 180 days.
Physical media on which Customer Data is stored during the contract term is not removed from the data centres that Salesforce uses to host Customer Data unless the media is at the end of its useful life or being deprovisioned, in which case the media is first sanitized before removal. This process is subject to applicable legal requirements.

Using the service

Web browser interface
Supported browsers
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
Application to install
Designed for use on mobile devices
Differences between the mobile and desktop service
The capability of Salesforce via a browser and on a mobile device, via either a browser or the native Salesforce1 App is broadly similar. However, there are some subtle differences as described here: https://help.salesforce.com/articleView?id=limits_mobile_sf1_data.htm&type=0

Note that the salesforce browser UI can also be accessed on many mobile devices.
Service interface
Description of service interface
The Salesforce interface is a modern and intuitive design, with help functions throughout. The interface can be configured as maybe required or left as default.
Accessibility standards
WCAG 2.1 AA or EN 301 549
Accessibility testing
Salesforce is committed to providing applications accessible to all. This includes users working with assistive technology, such as speech recognition software and screen readers. Salesforce follows international best practices in Section 508 of the Web Content Accessibility Guidelines (WCAG) 2.0 Level AA to the extent possible.

A third party has assessed and documented the accessibility status of Salesforce core products in the VPAT documents published here: https://www.salesforce.com/company/legal/508_accessibility.jsp

In addition, Salesforce includes an alternate user interface mode that lets users with assistive devices, such as speech recognition software and screen readers, work with Salesforce more effectively with detail here https://help.salesforce.com/articleView?id=accessibility_mode_enabled.htm&type=0
What users can and can't do using the API
Salesforce provides several simple, powerful, and secure APIs.
SOAP API to create, retrieve, update, or delete records, perform searches, etc. in real time in any language that supports web services. REST API REST-based web services interface for use with mobile applications and web projects.
Chatter REST API similar to feed APIs offered by Facebook/ Twitter. WAVE REST API access Wave Analytics assets, such as datasets, lenses and dashboards.
Bulk API based on REST principles optimised for loading or deleting large sets of data. Use it to handle many records asynchronously in batches.
Metadata API to retrieve, deploy, create, update, or delete customizations for your Salesforce instance. Migrate changes from testing to production. Intended for managing customizations and for building tools that can manage the metadata model, not the data itself.
Streaming API for notifications to be pushed from the server to the client, typically for applications that poll frequently.
Apex REST API & APEX SOAP API to expose Apex classes and methods so that external applications can access your code through REST or SOAP architecture, respectively.
Both support OAuth 2.0 and Session ID for authorization. Tooling API to integrate Salesforce metadata with other systems. REST and SOAP both supported.
API documentation
API documentation formats
  • HTML
  • PDF
API sandbox or test environment
Customisation available
Description of customisation
Point-and-click configuration: The Salesforce platform makes it easy to modify the functionality of Salesforce applications to meet your unique requirements. Working with the metadata framework and a series of simple point-and-click wizards, you can design custom user interfaces and modify the structure of the data model and the application’s business logic. Configuration enables organisations to modify objects, fields, validation rules, workflow, security settings, formulas, and much more without the need for code. Customise with code: Although point-and-click configuration with the Salesforce platform is the fastest and easiest way to customise, some functionality is beyond the constraints of a metadata framework. For such cases, developers can create needed functionality in open-ended development environments, using toolkits for most of the common programming languages, or Apex.


Independence of resources
The current daily transaction average for our platform is regularly 6 billion, consistently at sub 250ms response time within the Salesforce environment. Within each logical system, we use load balancers to distribute load among multiple web and application servers for additional scalability and redundancy. The multitenant application design, combined with the fastest servers and high-performance networking infrastructure available, guarantees fast performance. In addition to scaling for growth, Salesforce continually strives to improve the average response time of our services and to back up our claims, full details of transaction volumes and response times are publically reported in real-time at https://status.salesforce.com/


Service usage metrics
Metrics types
The service includes various metrics to monitor usage and adoption of the service, for example, last login, login duration etc. For Infrastructure detail metrics are available at https://trust.salesforce.com website provides performance and availability information for the entire service. For specific metric monitoring and for more in-depth detail customers can extend capability through the use of Event Monitoring. For example - which applications are being used, by whom, how are they being used, when, where from and are there performance issues? This data can be used to improve adoption, security and performance of the application.
Reporting types
  • API access
  • Real-time dashboards
  • Regular reports


Supplier type
Reseller providing extra features and support
Organisation whose services are being resold

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
  • EU-US Privacy Shield agreement locations
  • Other locations
User control over data storage and processing locations
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least every 6 months
Penetration testing approach
‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest
  • Physical access control, complying with CSA CCM v3.0
  • Scale, obfuscating techniques, or data storage sharding
  • Other
Other data at rest protection approach
Classic Encryption: native Salesforce application feature which can be used to encrypt specific custom fields. There is no additional cost for this, but it does impact some application functionality. More information here: http://sfdc.co/FieldEncryption Platform Encryption:

Platform Encryption allows customers to encrypt data stored through Salesforce such as: files and attachments, certain standard and custom fields, and use an advanced key management system. It uses native strong, standards-based encryption. Controls help to protect data, which include the use of derived data encryption keys and customer-controlled key rotation, generation, and destruction process. Available for an additional cost.
Data sanitisation process
Data sanitisation type
Deleted data can’t be directly accessed
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
Data can be exported via the API (e.g Weekly Export Service mentioned above) or for a more standard user, they can generate a report and export that report. There are features available that would enable an administrator to monitor, and in some cases prevent, the exporting of sensitive data in this regard.
Data export formats
  • CSV
  • Other
Other data export formats
  • API also support bulk export and upload
  • API export in open standards such as XML and OData
  • Out of The Box import via the open standard API
  • PDF
  • Pre-integrated ETL tools such as Mulesoft etc.
  • XLS
Data import formats
  • CSV
  • ODF
  • Other
Other data import formats
  • Out of The Box import via the open standard API
  • API imports in open standards such as XML and OData
  • API also support bulk export and upload
  • Pre-integrated ETL tools such as MuleSoft etc.
  • Salesforce can also store content in any flat file format.

Data-in-transit protection

Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • Other
Other protection between networks
By default, customers connect to the service over the public Internet with all transmissions between the user and the Salesforce Services secured using TLS 1.1 or higher and encrypted using 256 or 128-bit encryption. The Services use International/Global Step Up SSL certificates with 2048-bit Public Keys. Web Service callouts can be secured using TLS, as well as with two-way TLS, In addition, customers can partner with a selection of supported ISPs for a more direct connection to the Salesforce service. In the UK, BT are one such ISP. This service is known as Salesforce Express Connect.
Data protection within supplier network
  • IPsec or TLS VPN gateway
  • Other
Other protection within supplier network
Customer data is protected within the Salesforce service through a mature, standards-based defence in depth security architecture. Logical and physical access is strictly controlled and monitored and the controls used are in scope for the various security certifications the company has, and audited regularly by third parties. Controls such as firewalls, intrusion detection, anti-malware, file integrity monitoring are augmented with extensive monitoring to provide a robust prevention, detection and response model. Internal and external, as well as third-party vulnerability scanning and application penetration testing are also in place.

Availability and resilience

Guaranteed availability
The Salesforce Services are designed with the concept of continuous improvement and Trust (e.g. Availability, Performance and Security) in the infrastructure. Salesforce uses commercially reasonable efforts to make its on-demand services available to its customers 24/7, except for (minimal) planned downtime, for which Salesforce gives customers prior notice, and force majeure events. Excellent availability statistics (historically 99.9%) are critical to Salesforce's customers’ success and to the success of Salesforce as a company. Salesforce generally does not focus on a specific percentage, as we do not believe our job on availability will ever be “complete”. Live and historical statistics on Salesforce system performance are publicly published at: https://trust.salesforce.com/en/#systemStatus, and further detail can be shared upon request and NDA.
Approach to resilience
To maximise availability, the service is delivered using a world-class data centre infrastructure consisting of a primary production data centre, a full capacity secondary data centre for hosting the service provided to customers.The infrastructure utilises carrier-class components designed to support millions of users. Extensive use of high availability servers and network technologies, and a carrier-neutral network strategy, help to minimise the risk of single points of failure, and provide a highly resilient environment with maximum uptime and performance.
Outage reporting
Outage escalation policies are established and maintained as Salesforce's goal is to rapidly restore service. In the event of an extended outage, periodic updates are provided in near real time to customers via the trust.salesforce.com dashboard site and in addition, service notifications are provided to nominated contacts via various channels such as email. Update frequency for notifications is dependent on the customer support service plan.

Identity and authentication

User authentication needed
User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
  • Other
Other user authentication
Salesforce has a very comprehensive set of authentication mechanisms that customers can chose from. These include the inherent username and password option, Single Sign-on, Social Sign-on through another application, such as google, integration with existing identity management systems a customer may have, 2 Factor Authentication, and the application can also act as a Service Provider or Identity Provider for SSO integration using SAML.
Access restrictions in management interfaces and support channels
Management access for service support and delivery is done through multiple layers of controls including, but not limited to, multiple 2-factor authentication, bastion host and proxy control and segregation of duties. These controls are in scope for SSAE-18 auditing and evidences through the SOC 2/ISAE3402 report. Access to the management interface for the customer to configure their salesforce environment is configured by the customer themselves. The options are outlined in the above response. Robust application design and testing ensures that users without administrative access rights cannot access more sensitive areas of the application.
Access restriction testing frequency
At least every 6 months
Management access authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
Access to supplier activity audit information
Users have access to real-time audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
At least 12 months

Standards and certifications

ISO/IEC 27001 certification
Who accredited the ISO/IEC 27001
Schellman & Company, LLC (Formerly BrightLine)
ISO/IEC 27001 accreditation date
What the ISO/IEC 27001 doesn’t cover
The only ISO27001 control not included in our Statement of Applicability is A.14.2.7 - Outsourced Development. This is not covered as Salesforce does not perform outsourced system development.
ISO 28000:2007 certification
CSA STAR certification
CSA STAR accreditation date
CSA STAR certification level
Level 1: CSA STAR Self-Assessment
What the CSA STAR doesn’t cover
The available CSA STAR self-assessment covers all points in the latest CCM; version 3.01.
PCI certification
Who accredited the PCI DSS certification
Online Enterprises Inc
PCI DSS accreditation date
What the PCI DSS doesn’t cover
This service is PCI DSS compliant. All controls for PCI DSS are in scope for this service, there is nothing not covered.
Other security certifications
Any other security certifications
  • Cyber Essentials Plus
  • ISO: 27018 & ISO27001
  • DAIS
  • Binding Corporate Rules
  • NCSC Cloud Principle Response
  • SOC 1,2,3 Reports,
  • TUV
  • Privacy shield
  • Various Geographic credentials available on request

Security governance

Named board-level person responsible for service security
Security governance certified
Security governance standards
  • CSA CCM version 3.0
  • ISO/IEC 27001
  • Other
Other security governance standards
ISO/IEC 27001
ISO/IEC 27018
UK Cyber Essentials Plus
Information security policies and processes
Salesforce's Information Security Management System (ISMS) and information security policies are based on the ISO 27002 framework of best practices and are ISO 27001 certified. As required by this certification, the ISMS is endorsed by Senior Management. The EVP of Security has responsibility for the information security policies and ISMS. The Trust Strategy Alignment (TSA) Committee approves/authorizes all changes to the policies, the Statement of Applicability (SoA), the information security manual, and any separate policy statements. During the ISO 27001 audit process (as well as other audits such as SOX and SSAE 16 SOC 1), Senior Management for various departments are involved in verifying that policies and procedures are in place and adhered to. Policies are reviewed/approved at least annually.

Operational security

Configuration and change management standard
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach
Salesforce has formal processes for placing a system into production. This procedure includes a build checklist, server hardening checklist and pre-production testing. Baseline configurations for servers, network devices, and databases are consistent with industry-accepted CIS (Center for Internet Security) system hardening guidelines. Change control procedures are required by the company’s Change Management Policy and include steps for testing, review, authorization, communication, verification, and back-out procedures. All changes to the infrastructure components are tested in a dedicated environment using production class equipment before being deployed into production. Changes are reviewed and approved by Technical Operations management prior to deployment to production.
Vulnerability management type
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach
Salesforce has various vulnerability management processes in place around internal scanning, external scanning & vendor patch release management. Technical operations and security personnel monitor vulnerability alerts and patch release notifications from vendors and other sources. There are associated evaluation and deployment processes in place. Salesforce also regularly performs self-vulnerability assessments using various tools and techniques, such as Qualys. In addition, Salesforce uses external service providers to perform an application vulnerability assessment after each major release (three times annually) and network vulnerability assessments quarterly. There is also an on-going external application scanning service used. further detail on responsible disclosure here https://trust.salesforce.com/en/security/responsible-disclosure-policy/
Protective monitoring type
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach
Salesforce's Computer Security Incident Response Team (CSIRT) uses a security event logging and management system to manage the alerts and logs generated by devices on our network and provide protective monitoring. The system consists of a central database, management server, and distributed agents. The distributed agents receive events from network devices and systems (firewalls, IDS, routers, switches, hosts, file integrity, and database monitoring) on the network, then compress, encrypt, and transmit the data to the management server and database for processing. Correlated events are configured to generate alerts and logs which are monitored on a 24/7 basis.
Incident management type
Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach
Salesforce has a formal Incident Management Process that guides the Salesforce Computer Security Incident Response team in investigation, management, communication, and resolution activities. Salesforce will promptly notify the customer in the event of any security breach of the Service resulting in an actual or reasonably suspected unauthorised disclosure of Customer Data. Notification may include phone contact by Salesforce support, email to customer's administrator and Security Contact and public posting on trust.salesforce.com. Salesforce.com is a member of the prestigious Forum of Incident Response and Security Teams (FIRST) and complies with the FIRST framework and best practices for incident response.

Secure development

Approach to secure software development best practice
Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks


£3.22 a unit a month
Discount for educational organisations
Free trial available
Description of free trial
Complete version limited by time only
Link to free trial
Please contact us for a current trial link

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@xma.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.