Building the UK's national digital policing platform.
Single Online Home is the digital front door to policing across England and Wales: one service spanning 41 of 43 forces and roughly 94% of the population. CDS has built and run it for approaching a decade, through national re-architecture, a zero-downtime cloud migration, and the world's first public-sector Zero Trust deployment.
450M
41
200K
94%
Single Online Home: 10+ years of supporting national policing
SOH did not arrive fully formed. It grew from a single online form for Greater London into a national platform serving 41 forces: re-architected, re-hosted and re-secured along the way, without ever taking the public-facing service offline.
CDS has been the primary delivery partner for SOH since the contract was won, building the platform originally for the Metropolitan Police, re-architecting it for national multi-tenancy, and developing it continuously across a decade.
The work spans people, process, data and technology: a triage framework that captures legally admissible crime reports, a parallel programme onboarding 41 forces, a zero-downtime migration to Azure, and the world's first public-sector Cloudflare Zero Trust deployment.
Delivery runs as agile Scrum on two-week sprints with multi-functional teams, and CDS plays an active challenge function, ensuring the right problem is solved, not simply that requirements are met.
Client
Police Digital Service
Sector
Policing & Law Enforcement
Partnership
10+ years
At a glance
Built SOH from a single Met form (2015) into a 41-force national platform
Re-architected a live production system for multi-tenancy, mid-project
Migrated to Azure in ~3 months vs 6 estimated, zero downtime, £200k/yr saved
Deployed the world's first public-sector Cloudflare Zero Trust
Launched the National My Police Portal — two-way public-officer comms
Sustains 100% uptime for 3 years and ~500M security events mitigated/yr
ORGANISATION PROFILE
Single Online Home
STEWARD: Digital Policing Contact/NPCC
Origin: Initiated by the Metropolitcan Police service
REACH: 41 ouf of 43 forces + British Transport police
SCALE: 450M requests/month, ~300M annual page views
CDS ROLE: Front end, CMS, infrastructure, security, ongoing development and support
RELATIONSHIP: 10+ years
A nationally deployed digital policing platform, the digital front door to policing across England and Wales, enabling the public to report crime, access services, and interact with their local force online.
SOH handles online crime reporting across a wide range of crime types with intelligent triage and routing, service information, payments via GOV.UK Pay, live chat, image and document upload, and the National My Police Portal for two-way public-officer communication.
CDS is responsible for the platform front end, CMS, infrastructure, security, and ongoing development and support. It is one of programmes recognised as genuine successes in international policing.
It has been described as "the biggest change in policing since the 999 number."
The challenge
People
Inconvenient channels, divergent forces
Before SOH, the public was limited to inconvenient channels such as telephone or a physical visit, for anything non-emergency. Officers and staff across 43 forces worked in divergent, largely paper-based processes.
As the platform expanded nationally, the challenge shifted to scale. Engaging 43 forces, each with their own IT teams, communications function and culture, required a parallel onboarding programme running alongside continuous product development. Each force needed integrating and team training.
And as stakeholders turned over across a decade, trust had to be re-established continuously with each new contact.
Process
No national standardised processes
The pre-SOH processes were manual, paper-based, and regionally divergent across 43 forces. There was no national mechanism for consistent crime reporting, no standardised content framework, and no shared operational briefing capability.
Data
Legal quality data at five billion request a year
At launch, the data challenge was legal quality. Every crime report must meet the standard for admissibility, requiring careful triage logic, form design, and data architecture, not simply functional forms. This had to be right from the start.
As the platform scaled to 450 million requests per month, and approximately 300 million pages view annually, data integrity became an infrastructure challenge. Hosting on UK Cloud with Verizon as CDN was unreliable: UK Cloud was unstable and coming to end of life, Verizon could not distinguish legitimate from malicious traffic, the platform suffered repeated DDoS attacks, and at least one extended P1 incident occurred where root cause could not be identified internally.
Technology
Single tenant origins, national ambitions
The original platform was architected for the Metropolitan Police only. The decision to make it multi-tenanted and national came roughly 18 months into the project, requiring significant re-architecture of a live production system without downtime.
Before the Azure migration, infrastructure hosted on UK Cloud with Verizon was unreliable: UK Cloud showed signs of financial instability, Verizon didn't distinguish legitimate from malicious traffic and repeated DDoS attacks caused real downtime.
A conventional VPN was planned but CDS saw a fundamentally better architecture.
The objectives
01
A convenient digital front door
Give the public a way to report crime and access police services online, any time, in English or Welsh, on any device, removing the friction of phone and in-person channels.
02
One platform, every force
Replace 43 independent force websites with a single, centrally-managed, multi-tenanted platform; national content produced once and published everywhere.
03
Legally admissible by design
Capture every crime report to the legal standard for admissibility through deliberate triage logic, form design and data architecture, right from the start.
04
Create records that didn't exist
Build a nationally consistent digital record and auditable content versioning for use in legal and disciplinary proceedings.
05
A resilient, secure foundation
Move off failing infrastructure onto a stable, scalable, fully-protected environment, covering pre-production as well as live.
06
From one-way to two-way
Evolve the platform from crime reporting into a genuine two-way digital relationship between the public and their police force.
Our solution
CDS has been the primary delivery partner for SOH since the contract was won, building it for the Met, re-architecting it for national multi-tenancy, and developing it continuously across a decade. The current delivery model is agile Scrum on two-week sprints with multifunctional teams. Just as the challenge spanned people, process, data and technology, so does the solution.
People
Wholly integrated with the client team
CDS is wholly integrated with the client team, operating delivery squads aligned to individual product owners. CDS has a great partnership with SOH, with staff communicating regularly on their Teams channels and attending client offices.
The National My Police Portal - launched with South Yorkshire Police and targeting a further 5–6 forces initially - marks the transition from a one-way reporting platform to a two-way digital relationship. It enables asynchronous, recorded communication between the public and officers: both parties benefit from a written record rather than relying on memory, and the full audit log can be passed directly to the Crown Prosecution Service.
Process
Agile from day one, onboarding at scale
CDS introduced agile delivery to SOH from day one, with two-week sprints. Work flows through a triaged backlog managed with the client's Product Owners, drawing on Home Office grant-funded items, in-house change-management initiatives, and force customer requests. CDS plays an active challenge function throughout, ensuring scope is correct and problems are properly defined before development begins.
Force onboarding ran as a structured parallel programme: a 6–9 month process per force covering technical integration, training, content creation, marketing and media coordination, and go-live:
-
Two-week sprints with multifunctional teams: BAs, tech leads, UX.
-
A single triaged backlog across Home Office, programme and force requests.
-
25 forces onboarded within the first two years (against a target of 20).
Data
Legally admissible capture & new national records
CDS built and maintains the triage and form framework that captures legally admissible crime reports. Logic routes submissions to the appropriate form for each crime type, ensuring the right questions are asked and required information is captured completely and consistently.
The National My Police Portal introduces the first two-way data flow:
- Crime reference data and direct messaging between public and force
- Full audit log of all conversations, evidence requests and updates
- Authentication via GO.UK One login and all data interactions recorded in the force's records management system
Technology
Azure, Cloudflare Zero Trust, and DXP
The Azure migration - executed in roughly three months against a six-month estimate, with zero downtime - delivered an immediate £200,000-per-year saving and removed the platform from a failing infrastructure environment.
Cloudflare was then deployed in two phases: first replacing Verizon (genuine traffic discrimination, DDoS mitigation, SSL for SaaS across all 41 forces, a cloud load balancer), then extended to Cloudflare Zero Trust - the first public-sector Zero Trust deployment globally.
The Police UK native app was delivered under a different kind of pressure: a direct ministerial directive from the Home Office requiring a national standardised policing app. Active development took approximately two weeks in February 2024, with the app shipped to both stores on schedule.
The DXP migration now moves the platform from self-hosted Optimizely v11 to the cloud, removing the infrastructure burden, providing a cost-effective path to v12, and positioning the platform for future AI capability.
A custom workaround resolved an 'orange-to-orange' Cloudflare routing conflict between CDS and Optimizely.
-
Azure migration: 3 months vs 6, zero downtime, £200k/yr saved.
-
SSL for SaaS: a single certificate across all 41+ forces.
-
World-first public-sector Cloudflare Zero Trust, including pre-production.
The outcomes
01
Driving efficiency & productivity
A single centrally-managed platform replaced 43 independent force websites with national content produced once and published everywhere. At launch, 10% of all Greater London Road Traffic Incident reports came through digitally within six months, with zero advertising, and the NMPP directly addresses the 40% of 101 calls seeking crime-report updates.
15% The cost of a digital non-emergency report vs any other channel
02
Empowering & enabling people
94% of the public in England and Wales can now report crime or access services digitally, any time, in English or Welsh, on any device. Total crime reporting volumes increased as previously unreported crime surfaced. There's now nationally consistent digital record where none existed.
94% Of England & Wales now served by the platform
03
Visibility & control of risk
The Azure migration removed the platform from an unstable, DDoS-vulnerable environment, and Cloudflare Zero Trust provides coverage across all environments, including pre-production. Every crime report is captured to the legal standard for admissibility.
04
Accelerating modernisation
SOH won the Digital Impact Award 2019 and is cited as genuine success in national policing. CDS delivered the world's first public-sector Zero Trust deployment - a reference case used by Cloudflare globally. The platform has also migrated to a modern modern, supported DXP stack.
100% Uptime for three years against a 99.9% SLA.
The migration to the Azure platform was a great piece of collaborative work between CDS and the SOH National Digital Team, something that was delivered successfully in a very tight timeline. What I am really looking forward to now is leveraging the technical opportunities this move has opened up for us. We delivered the migration whilst continuing to serve the public and with minimal end user impact. Since migrating, we have experienced 100% service uptime which is key when hosting a national platform providing essential services to the UK public.
Head of Service – Single Online Home National Digital Team
Why CDS
The combination of proven Optimizely expertise, security credentials from CPNI and Met Police work, demonstrated delivery capability, and the ability to navigate a risk-averse public sector client through genuinely novel technical territory. Zero Trust on a global public-sector first, Azure migration under extreme time pressure, multi-tenanted national re-architecture mid-project, is not a profile easily replicated.
01
Proven Optimizely & security expertise
Deep Optimizely capability paired with security credentials earned through CPNI and Metropolitan Police work - the right foundation for infrastructure this sensitive.
02
Delivery in novel technical territory
Zero Trust on a public-sector first, Azure migration under extreme time pressure, multi-tenanted national re-architecture mid-project - a profile not easily replicated.
03
Navigating a risk-averse client
The ability to bring a zero-failure public sector organisation through genuinely novel change and demonstrable success at every step.
04
A decade of embedded partnership
Sustained through consistent delivery, deep product knowledge, honest and proactive advice, and operational integration within the client team itself.
Additional reading
Two optional sections for the technically curious and the delivery-minded. Skip them if you've got what you need!
Technical deep dive
Multi-tenanted CMS & front end, migrating to Optimizely DXP (cloud).
→ Microsoft Azure
Migrated with zero downtime from UK Cloud.
→ Cloudflare Zero Trust
Traffic discrimination, DDoS mitigation, SSL for SaaS, world-first public-sector Access.
→ GOV.UK One Login & Pay
Single government identity for NMPP; payments via GOV.UK Pay.
→ Azure DevOps
Task and sprint management across the multifunctional teams.
~ 4 min read · architecture & delivery
Platform architecture
SOH is a multi-tenanted national platform built on Optimizely (formerly EPiServer), hosted on Microsoft Azure. CDS is responsible for the platform front end, CMS, infrastructure, security, and ongoing development and support. We work alongside other suppliers who manage the backend data layer and integrations with forces' records management systems, plus the anonymised crime-data feed from data.police.uk. CDS also rebuilt the police.uk front end to be consistent with SOH, as a separate Home Office-funded workstream.
The security and performance layer is provided by Cloudflare, implemented in two phases: first as a replacement for Verizon — genuine traffic discrimination, DDoS mitigation, and a fully cloud-based load balancer — then extended to Cloudflare Zero Trust (Access), the first public-sector deployment globally. A critical detail: SSL for SaaS was implemented to onboard all 41+ forces under a single SSL certificate; without it, each force would have needed its own, making national rollout significantly more complex and expensive.
The Police UK native app is a thin native shell wrapping police.uk in a WebView. The Android app is Java-based; iOS is Swift with WKWebView. Both append PUK_NATIVE to the user agent string so police.uk can detect it is running inside the app. The implementation was the right choice for the context: reusing the full police.uk platform rather than duplicating it, delivering against the requirement at pace.
Azure DevOps is used for task and sprint management. The NMPP is built on Optimizely and authenticated via GOV.UK One Login, making it consistent with other government services such as HMRC, so citizens use a single government identity credential rather than a SOH-specific account.
Key delivery challenges, and how they were resolved
1 · Multi-tenancy re-architecture mid-project: The original platform was for the Met only; the decision to go national came 18 months in. A proof of concept with Thames Valley and Hampshire validated the multi-branded, single-engine model before national rollout, and CDS re-engineered the platform to support multiple force configurations without destabilising production.
2 · Azure migration under extreme time pressure: With UK Cloud approaching end of life, a six-month migration was executed in roughly three - tightly integrated with client architects and security teams - with zero downtime. Cloudflare, already deployed as a load balancer and security layer, enabled a controlled cutover. The migration saved £200,000 per year.
3 · Cloudflare Zero Trust on a globally unproven product: With the VPN proposal ready to sign, CDS identified Cloudflare Access (which was then in public beta) as superior. The VPN approach would have needed on-site installation per force, which COVID made impossible. CDS engaged Cloudflare directly to deliver it as a global first, covering all environments including previously pre-production.
4 · DXP migration with double Cloudflare conflict: Both CDS (for SOH) and Optimizely use Cloudflare; the expected 'orange-to-orange' routing did not function as anticipated, creating a significant go-live blocker. The cloud engineering team developed a custom workaround with Workers, to route traffic correctly through both Cloudflare instances.
Our ways of working
Home Office grant items, DPC change management, force customer requests.
The client's Product Owners triage all three before work reaches CDS squads.
CDS ensures the right problem is solved before development begins.
Multifunctional teams: BAs, tech leads, UX - managed in Azure DevOps.
WCAG 2.2 validation, security sign-off to a national police accreditor.
~ 3 min read · how the partnership runs
How work flows
CDS and DPC operate a continuous improvement partnership, with a 24/7 managed service running alongside parallel workstreams in platform development, content embedding, and infrastructure migration. Work originates through three routes: Home Office grant-funded items, in-house change-management initiatives from the DPC programme team, and force customer requests from the 41+ forces. All three are triaged by the client's Product Owners before reaching CDS delivery squads.
CDS plays an active challenge function throughout, ensuring the right problem is being solved and scope is correctly defined before development begins. Once agreed, work flows through a multifunctional sprint team of Product Owners, BAs, tech leads and UX, running on two-week sprints. Several of the client team's resources come from CDS or CDS partners - an embedded model. CDS staff are in client Teams channels, attend client premises, and work alongside the DPC national content team as a shared unit.
Governance & account structure
The account is governed through formal delivery structures and a relationship built on a decade of trust. An SLT engagement model provides clearer escalation paths and more consistent senior visibility. Decisions about new capabilities balance individual force requests against the needs of the national platform, with the client filtering requirements before they reach CDS. All releases are validated for accessibility to WCAG 2.2, and security sign-off feeds into a national police accreditor - a formal process reflecting the sensitivity of the infrastructure.
Managing a zero-failure environment
Policing is a zero-failure environment. The consequences of getting something wrong extend beyond a poor user experience: criminal cases could collapse, emergency channels could be overwhelmed, public trust in digital policing could be damaged. Convincing a risk-averse public sector client to embrace iterative, incremental delivery required sustained persuasion and demonstrable success at every step.
Internal championing in the early years - a serving officer who drove agile adoption and cleared internal blockers - was a critical enabler. As stakeholders have turned over across a decade, that trust has had to be re-established with each new contact; the current SLT engagement model is designed to provide more continuity than relying on individual relationships alone.
Running a critical service that can't afford downtime?
We'd be glad to talk about what good looks like, whether you're at the start of replacing a legacy platform, looking to modernise and innovate, navigating a regulatory deadline, or trying to bring a non-technical team along for the ride.
Tell us a little about you and we'll come back within one working day.