It answers the questions we are most often asked, in one place, so you can complete your own forms quickly and we can point you straight to the relevant detail.

It also sets out clearly what is in scope for an assessment of AdviceAid, and what is out of scope. AdviceAid is a simple, browser-based service that holds almost no personal data, so many standard supplier questions do not apply to it. Knowing that up front saves everyone time.

What AdviceAid is

AdviceAid is a homelessness-prevention tool from Neatlines Ltd. It helps council teams and the people they support find clear, accurate housing, welfare, benefits and debt advice. It has two main parts:

  • Compose is the back-office tool your staff use to write and manage advice content.

  • SelfServ is the public-facing advice experience. Members of the public read advice in their browser. They do not create accounts and they do not sign in.

AdviceAid is reached through a web browser. There is nothing to install on staff or public devices.

How AdviceAid is delivered

  • Software as a Service (SaaS). AdviceAid is fully hosted by Neatlines. There is no on-premise version and nothing to run on your own servers.

  • Hosted in the UK on Microsoft Azure. All council data is stored within the UK. Data at rest is protected with Azure Transparent Data Encryption.

  • Accessed over HTTPS. All connections use HTTPS on port 443, with TLS 1.2 or higher.

  • Multi-tenant. Each customer's data is separated at application level by a unique organisation ID. Users only ever see data belonging to their own organisation, or data that has been explicitly shared with them.

  • Outbound email (for example, sending an advice sheet) is delivered through Amazon Simple Email Service in the AWS Europe (London) region.

What data AdviceAid processes

This is the most important point for an assessment. AdviceAid processes a very small amount of personal data:

  • Staff names and email addresses. These are used to sign your team members in and to show who wrote a piece of advice. Passwords, where used, are encrypted.

  • Recipient email addresses, for delivery only. Where one of your advisers emails an advice sheet to someone, that person's email address is processed to deliver the message. The content of the message is not retained.

AdviceAid does not do the following:

  • It does not hold case records, citizen records or any resident personal data from SelfServ browsing.

  • It does not process special category (sensitive) personal data.

  • It does not take payments, so no card or financial data is involved.

The advice content your team writes belongs to you. You can export it as a Word document at any time, including at the end of the contract.

Who is the controller and who is the processor

For the staff names and email addresses described above, your council is the data controller and Neatlines Ltd is the data processor. Neatlines is registered with the Information Commissioner's Office (ICO), registration number ZA225641.

What is in scope for your assessment

The following are covered in the articles in this set:

  • Hosting, data location, encryption and data return.

  • Access, authentication and single sign-on.

  • Assurance: penetration testing, vulnerability management, secure development, and our position on certifications.

  • Resilience and incident management: backup, disaster recovery, business continuity, and how we handle and report incidents.

  • Accessibility.

What is out of scope, and why

Because AdviceAid is a simple SaaS product that holds almost no personal data, several common supplier questions do not apply. We set them out here so you can mark them as not applicable with confidence:

  • On-premise deployment. AdviceAid is SaaS only. There is no local install or council-hosted option.

  • Use of council equipment or on-site staff. We use neither.

  • Resident logins and resident multi-factor authentication. SelfServ is open. The public read advice without accounts or sign-in, so questions about citizen authentication do not apply.

  • Your network perimeter, end-user devices and device management (MDM/Intune). AdviceAid runs in a browser and does not connect into your network or run on your devices.

  • PCI DSS. AdviceAid takes no payments.

  • Citizen-record retention, archiving and disposal tooling. AdviceAid holds no citizen records to retain or dispose of.

  • The G-Cloud data protection checklist. AdviceAid is not sold through G-Cloud.

  • File-upload malware screening. AdviceAid accepts no file uploads from users.

How to use these articles

If your council uses its own supplier questionnaire, read the article that matches each section of your form and copy the relevant answers across. If your council uses the NCSC Cloud Security Principles, see Completing your questionnaire, DPIA or DPA, which maps our responses to all 14 principles.

The other articles in this set:

Who to contact

For security and procurement questions about AdviceAid, contact Peter McGuire at peter.mcguire@adviceaid.uk