For a formal process

The answers your procurement process needs

Everything a board paper or a tender response has to cover, in the order it usually gets asked. Written to be lifted rather than paraphrased. Where a question needs a commitment in writing, ask and we will put it in the agreement.

Draft: 16 answers still to be written

The questions and the structure are settled. Anything marked "To confirm" is a commitment that has to be decided before this page goes live, not copy to be polished.

The company behind it

You are buying from an independent New Zealand company built around early learning and nothing else. That focus is why you deal directly with the people who make the decisions, and a board is still right to ask about the company behind the software. Both deserve a straight answer.

Who are we buying from?

Oversite is built and run in New Zealand, for New Zealand early learning. The people who write the software and the people who answer your questions are the same dedicated team, in the same country and time zone as you.

To confirm

Registered company name, NZBN and registered address.

How long have you been operating, and who else uses it?

We can name reference customers of comparable size and put you in touch with them directly. Talking to somebody already running it is worth more than anything we write here.

To confirm

Trading since, current customer count, total centres under management.

What insurance do you carry?

To confirm

Professional indemnity, cyber liability and public liability, with cover levels and insurer. Certificates of currency on request.

If Oversite stopped trading

The question every board asks of an independent supplier, and the one most vendors answer badly. We would rather answer it well. What a customer needs is not our source code. It is their data, and enough time to move.

What happens to our records?

They are yours. You can export your data at any time, in full, without asking and without a fee. That is true on an ordinary Tuesday, not only in a crisis, which is what makes it a real answer rather than a promise.

How much notice and access would we get?

To confirm

A committed notice period and a minimum window of continued access after any wind-down, written into the agreement. Thirty to ninety days is the usual ask.

Is the code held with an independent third party?

This arrangement is called software escrow, and it is worth being clear about what it buys you. Almost no early learning organisation could host and run this software from its source code, so escrow on its own is largely ceremonial. Continued access to your own data, and enough time to move, is the protection that changes your position.

To confirm

Whether you will offer a source or SaaS escrow arrangement, and with which provider. Software Escrow (NZ), a New Zealand Computer Society subsidiary, is the local option procurement advisers tend to name.

Can exit terms go in the contract?

Yes. Export rights, notice, assistance and a deletion commitment can all be written into the agreement rather than left to a policy page we could change.

Data, privacy and sovereignty

Covered in plainer language on the security page. These are the same commitments phrased for a procurement form.

Where is our data held, and is it separate from other organisations?

Each organisation's records are kept separate from every other organisation using Oversite. Data is held on established enterprise cloud infrastructure. We do not publish the specifics of where or how it runs, and will provide them under your procurement process.

Does any of it leave New Zealand?

Some infrastructure sits outside New Zealand, which makes this a cross-border disclosure under the Privacy Act 2020. It is held in a jurisdiction with comparable privacy safeguards, under our instructions, and is not used for any other purpose. Your obligations under the Act follow the data regardless of where it sits, which is why we will give you the specifics in writing.

How do you handle Māori data sovereignty?

Records about tamariki and whānau are yours to govern, not ours. We do not use them for any purpose other than running the service for you, we do not sell or share them, and we do not train anything on them. Where your organisation has its own data governance obligations or a relationship with iwi, we will work to them rather than expect you to work to us.

To confirm

Whether you want a firmer commitment here, because some associations will ask for one in the agreement.

Who else touches our data?

To confirm

The sub-processor list: email delivery, payments, accounting integration, error monitoring, and anything else that sees customer data. Buyers expect a named list with what each one does and where it operates.

How long is data kept, and can we have it deleted?

The Ministry of Education's Funding Handbook requires attendance and funding records to be kept for seven years, and that retention is part of the price rather than a paid tier. Deleting something in the product generally removes it from view without destroying the audit trail behind it, so an accident is recoverable. Deletion of your organisation's data on exit can be committed to in writing.

Will you sign a data processing agreement?

Yes. If you need particular terms, such as a specific retention or deletion commitment, breach notification wording or an audit right, ask and we will talk about it rather than pointing at a policy page.

What happens if there is a privacy breach?

To confirm

Your notifiable privacy breach process under the Privacy Act 2020: who assesses it, who we tell, and within what timeframe. Also the named privacy officer.

Availability and support

What uptime do you commit to?

To confirm

An availability target, how it is measured, planned maintenance windows and how they are notified.

How quickly do you respond when something is wrong?

Support is a conversation with the people who build the software, not a ticket queue routed offshore. You can ask from inside the product, on the screen the question is about.

To confirm

Response targets by severity, and support hours.

How will we know about an outage?

To confirm

How incidents are communicated, and whether there is a status page.

What does onboarding involve, and what does it cost?

Migration from your current system is part of moving across rather than a separate line item, and we do the work. The migration page sets out what gets moved, how long it takes and what your team has to do.

Security assurance

Stated as commitments rather than as a description of how the system is built. A detailed architecture is useful to somebody probing it and tells a buyer nothing they can act on.

Who inside our organisation can see what?

Access is permission-based and granular. Someone who should see attendance figures does not automatically see payroll detail, and the sensitive parts of a staff record are gated separately again. Sites are scoped, so a centre manager sees their own centres.

Who at your end can see our data?

Support access is limited to what is needed to answer the question in front of us, and it is logged. We do not browse customer records, and we do not use your data to train anything.

Do you hold SOC 2, ISO 27001 or equivalent?

To confirm

An honest answer here is better than a vague one. If the answer is no, say so and say what you do instead. A buyer who asks this can tell the difference, and an independent New Zealand vendor is judged on what it does rather than on a badge.

Is the system independently tested?

To confirm

Penetration testing cadence and who performs it, vulnerability management, and whether a summary report can be shared.

What about your own people?

To confirm

Whether your team is police vetted and background checked. It is a fair question from an organisation whose records are about children, and a strong answer if it is yes.

The agreement

What are the commercial terms?

A twelve-month agreement, billed monthly with nothing upfront. Site count is recalculated monthly, so an organisation that grows moves into a better rate automatically rather than at renewal. Pricing is published through twenty-five sites.

How does the price change over time?

To confirm

Price review mechanism at renewal, any cap, and the notice given.

Are there add-on fees?

No. Every module, every report, migration, training and support are included. There is no per-licence retention charge and no hourly training rate.

Can we run a trial or a pilot?

Yes. A single centre or a small group is the usual way in, and it is the honest way to test the claims on the rest of this site against your own data.

To confirm

Pilot terms: length, cost, and what happens to the data if you do not proceed.

What we can send you

Rather than making you assemble it from a website, ask and we will send a single pack covering the above, with anything your process needs added to it.

  • Completed vendor questionnaire, including the Cloud Risk Discovery questions if your process uses them
  • Data processing agreement, and a sub-processor list
  • Certificates of currency for our insurance
  • Reference customers of comparable size, to talk to directly
  • Draft agreement, so your lawyer sees it before you are committed

If something on this page is not enough for your process, say what you need and we will answer it properly. A supplier who treats procurement as an obstacle is telling you something about how the rest of the relationship will go.

Still want to talk it through?

Book a demo and ask whatever you need to. You'll hear back within one working day.

Book a demo