Do we need new cameras or vans?

No. CityTriage is software. A resident can file a report from the browser today, and a buyer can open the desk, log a case, and export it. Reading a live camera feed is still in build.

Is the vision model actually scoring my photo?

Not yet. On the report form, a photo stays on your device. Confidence figures on the sample desk are placeholders so you can see the layout. They are not measurements from a city.

What happens when I press pay?

Prices are in pounds, before VAT. Household checkout on this site records a demo receipt until card payments are fully wired for your account. Council contracts are invoiced. CityTriage does not create live charges from this marketing site.

Can I report a problem if my council has not bought this?

Yes. You still get a tracking id. If the council database is not connected, the report is kept in this browser and the tracker on the same page can find it. It does not land in a council queue until that council is on CityTriage and the database is connected.

Where does data live?

Cases you log on the desk, and reports you file, stay in this browser unless Supabase is configured and the civic_cases table exists. The public report form writes to Supabase when those keys are set. We do not claim a data-centre region we have not switched on, and we do not sell the contents of a report.

A demo receipt is not a subscription. When card checkout is enabled for your pilot, cancellation lives in the billing portal for that account. There is no live subscription to cancel from this demo site.

How do councils and households pay?

Residents report free. The 90-day pilot is £2,500 one-off. Monthly desks are £799, £2,499, and £7,499. Annual packages are Basic £15,000/yr, Pro £50,000/yr, and Enterprise by quote. £9.99 a month is the optional household plan. All figures are GBP before VAT.

Monthly prices are before VAT. An annual council quote shows VAT at the UK standard rate of 20% on its own line. That quote is not a tax invoice. The invoice confirms the treatment.

Are the meters on the desk real?

No. The queue and the round meters are samples, so you can see the instrument. They are not city measurements, and they are not results we are claiming.

On this demo, what you type stays in your browser. CityTriage does not sell personal data. A council deployment needs a data-processing agreement and a lawful basis the council chooses. A DPA is not published on this site yet. Write to Yusuf if you need one.

Can a council buy this through procurement?

There is no framework listing and no security questionnaire pack on this site. A pilot is a conversation plus the desk you can open here. A council purchase is a contract Yusuf writes with you. Pressing a checkout button does not bind a council.

What does it integrate with?

The desk, map, reports, crew board, and public tracker work in the browser with no other system. The map on the new desk is drawn in the page and does not need Mapbox. Supabase, when set, can store cases and already receives the public report form. There is no live connector to a council case system, a weighbridge, or email. Those are in build.

Yusuf Choudhury, in London. The only public address is Yusuf@yusuf-choudhury.com. If the mail list is not connected, the form keeps your note in this browser and opens your email app with the note filled in.

Do you have customers, logos, or a user count?

No. We will not show testimonials, customer logos, or user counts we do not have.

What is still being built?

Signed-in organisations after payment, live camera inference, maps that need a Mapbox token, weighbridge feeds, carbon-credit settlement, the bulky-waste marketplace, and email sent from this site.

Councils · buyer pack

What a council can check before it buys.

Security, data protection, accessibility, an SLA outline, and how procurement actually works. CityTriage is not on a framework. It holds no ISO, Cyber Essentials, or SOC 2 certificate. Those sentences are the point of this page.

Download the buyer pack Build a quote

Security overview

CityTriage is a web application. The public site, the desk, and the quote are served by Next.js. Case rows on the demo stay in the browser. When Supabase is configured, resident reports go to the hazards table and the desk can mirror cases to civic_cases.

Secrets stay on the server. Stripe, Supabase service role, and Brevo keys are not prefixed for the browser. The anon Supabase key is public by design and is limited by row-level security.

CityTriage does not hold ISO 27001, Cyber Essentials, Cyber Essentials Plus, or SOC 2. No penetration test report is published. A council can ask for one during a pilot. We will not invent a certificate to win the page.

Data protection and GDPR

A council that buys CityTriage is the controller for resident reports and officer casework. Yusuf Choudhury, as supplier, would be the processor once a contract says so. No data-processing agreement is signed by using this website. A DPA is written with the council, not downloaded as a finished contract.

This page is not a completed DPIA. The template below is a blank the council’s DPO can fill. We do not know the council’s lawful basis. Common bases officers discuss are public task and, where a resident writes in, the steps needed to handle their report. That is a conversation, not a decision we make for you.

DPIA template

Copy this into the council’s own DPIA form. Empty fields are empty on purpose.

Controller: [council name]. Processor: Yusuf Choudhury, trading as CityTriage, London. Contact: Yusuf@yusuf-choudhury.com.
Processing: receive a street report (place, category, optional note), show it on a desk, assign it, record a status, keep a tracking id.
People affected: residents who report, and officers who use the desk. [Add categories the council actually processes.]
Data: place description, category, free-text note, status, assignee name, tracking id. Photos on the public form are not uploaded. A small crew photo can stay in the officer’s browser on the demo.
Lawful basis: [council to complete].
Retention: [council to complete]. The supplier default below is a proposal, not the council’s policy.
Recipients: Supabase (database, if contracted), Brevo (buyer enquiries, if the lead key is set), Stripe (only if a card checkout is used; council contracts are invoiced). [Add the council’s own case system when one is connected. None is connected now.]
Transfers: [state the region once the Supabase project region is contracted]. It is not stated here because this repository does not fix a region.
Risks the council should score: a public tracking id guessed or shared, an officer account shared, a free-text note that includes more personal data than the form asks for.
Measures: row-level security on database tables, server-only secrets, rate limits on forms, no card charge on the council order form.

Data map

What exists today, and where it sits.

Browser, this device: desk cases, module trials, entitlements, and a copy of a lead if Brevo is not configured. Cleared when the person clears site data.
Supabase, if keys are set: hazards from the public report form, aimed at the anonymous intake organisation. civic_cases only if that table is migrated. Region: not fixed in this repo.
Brevo, if BREVO_API_KEY is set: buyer name, email, organisation, role, borough, use case, budget window, procurement timeline, decision-makers. Added to the list CityTriage Leads.
Card checkout may be offered for household plans. Council annual quotes are invoices.
Email: this site does not run its own mail server. Without Brevo, the form opens the sender’s email app to Yusuf@yusuf-choudhury.com.
Not connected: council case management, a weighbridge, cameras, DVLA, a marketing list of residents.

Retention

Proposed supplier default, for a contract to adopt or replace: keep a closed case for 24 months, then delete or return it; keep a buyer enquiry for 24 months after the last reply; keep an invoice record for 6 years because UK tax rules expect that of the supplier. The council’s retention schedule wins where it is stricter or more specific.

The demo in the browser has no automatic deletion. The person using the desk can clear cases in settings.

UK hosting

CityTriage does not claim that data is hosted in the United Kingdom. A Supabase project’s region is chosen in that project, and this repository does not record one. Brevo and Stripe process data in the regions those companies publish for the account Yusuf opens. Until a contract names a region, do not tell a committee the data is in the UK.

If a council needs a UK region, that is a condition of the order, written on the quote before signature. It is not a feature already switched on.

Accessibility statement

Target: WCAG 2.2 level AA. That is a build target, not a certificate. No external accessibility audit has been commissioned, and none is claimed.

Pages use text labels on controls, visible keyboard focus, and a skip link on the public site. Motion is reduced when the visitor asks the browser for reduced motion. The order form is a document that can be printed.

We do not know every failure against 2.2 AA. A council audit during the pilot is welcome, and the findings can be a success criterion the council writes down. Contact Yusuf@yusuf-choudhury.com about a barrier.

Service agreement and SLA outline

This is the outline we are willing to put in a service agreement. It is not a measured uptime history. There is no public status page and no past incident report.

Support hours in the outline: 09:00–17:30 UK time, Monday to Friday, excluding England and Wales bank holidays. A priority incident is acknowledged the same working day if it arrives before 15:00, otherwise the next working day. A target availability of 99.5% in a calendar month excludes maintenance agreed in writing at least five working days ahead.

The remedy in the outline is service credit on the next invoice, not a statement that this has ever been paid. The signed agreement, not this page, is the contract. Governing law proposed: England and Wales. Courts: England and Wales.

Procurement routes

CityTriage is not listed on G-Cloud, Digital Marketplace, or any other public framework. There is no call-off. A page that reads like a service definition is not a listing.

A direct award can be lawful for a below-threshold contract, and many councils also follow their own standing orders and contract procedure rules. The Procurement Act 2023 changed the wider regime. This page does not state a threshold in pounds. Those figures are set in law and they change. The council’s procurement team decides whether the quote is below threshold, whether a direct award is allowed, and whether a competition is required.

What we can hand a buyer is this pack, a quote with VAT shown separately, and a pilot with criteria the council writes. What we cannot hand them is a framework number.