SMAX Managed Service

SMAX is Micro Focus' next generation Service Management unified platform and portal. An analytics-driven service management automation solution for managing the entire service portfolio and service lifecycle within and beyond IT. SMAX enables automation, accelerates agent productivity, reduces ticket volumes and time to resolution whilst increasing user adoption and satisfaction.


  • Service desk built upon analytics and machine learning
  • Service portal including mobile support
  • Modern user experience for automated enterprise applications
  • Codeless configuration
  • Seamless upgrades
  • ChatOps
  • Fully Managed Cloud Service
  • Extendable platform and API integrations
  • UK hosted private cloud
  • DevOps enablement


  • Fast responsive service desk for improved user satisfaction and productivity
  • Self-service for increased user self-sufficiency and lower ticket volumes
  • Automation for increased service quality and service levels
  • Better staff utilization reduced TCO and quicker time-to-value
  • Reduced IT asset costs and improved compliance
  • Subscription model to reduce capital outlay
  • Managed Service removes operational costs and burden


£300 per instance per month

  • Free trial available

Service documents

G-Cloud 10



Mick Morey



Service scope

Service scope
Software add-on or extension No
Cloud deployment model Private cloud
Service constraints Weekly 2 hour maintenance is part of agreement - if service affecting then customers will be notified in advance
System requirements
  • Modern Web Browser (IE, Chrome, Firefox, Safari)
  • Internet access for users

User support

User support
Email or online ticketing support Email or online ticketing
Support response times Support response times
Severity4-1BusinessDay or as per service catalog
User can manage status and priority of support tickets Yes
Online ticketing support accessibility None or don’t know
Phone support Yes
Phone support availability 9 to 5 (UK time), Monday to Friday
Web chat support No
Onsite support Yes, at extra cost
Support levels The Managed Cloud Service is fully supported by EOH’s 24/7 Service Desk providing a single point of access for all incidents and requests. The service is available via telephone, email or EOH SMAX portal. Responses are prioritised and addressed in line with the service levels detailed in the Service Level Agreement document.
All engagements have a named Service Manager for engagement and escalations with a Technical Service Manager who attend service review meetings.
Support available to third parties Yes

Onboarding and offboarding

Onboarding and offboarding
Getting started Onsite or online training is available for the solution and a Getting started full set of documentation is provided with an online Help
Service documentation Yes
Documentation formats
  • HTML
  • PDF
End-of-contract data extraction The SMAX solution is designed to allow the full export of data from the application. Data extracts can be requested at any time during the contract and will be provided via an agreed FTP site. The data extract can be requested via a service request.
End-of-contract process The customer has 30 days from the end of contract to download their data from the agreed FTP site. If required data can be stored for longer on a month to month contract for an additional cost.

Using the service

Using the service
Web browser interface Yes
Supported browsers
  • Internet Explorer 10
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
Application to install No
Designed for use on mobile devices Yes
Differences between the mobile and desktop service The solution provides a IOS and Android app to support End Users interacting with IT. Features include logging and tracking support tickets, searching knowledge and news items, requesting and tracking services from the catalogue and approving requests.
Accessibility standards None or don’t know
Description of accessibility Via Web Browser and mobile apps
Accessibility testing Compatible and tested with JAWS Software
What users can and can't do using the API The solution has a REpresentational State Transfer (REST) API which enables users with the proper role to perform Create/Read/Update operations on records and manage records or consume REST services.
API documentation Yes
API documentation formats
  • HTML
  • PDF
API sandbox or test environment Yes
Customisation available Yes
Description of customisation Configuration and tailoring of the solution is achieved via SMAX Studio a graphical codeless configuration tool. This allows the creation and editing of flows, graphical forms and tables. Modifications to workflows, tasks, and business rules can be done without any programming.


Independence of resources The EOH Cloud and SMAX platform is high availability by design with 24x7 monitoring to identify any event driven impacts on end user service whilst allowing on demand scaling of compute resources.


Service usage metrics Yes
Metrics types Standard 'Help desk' metrics are provided e.g. No of tickets closed within SLA. Tickets open by agent etc
Reporting types
  • Regular reports
  • Reports on request


Supplier type Reseller providing extra features and support
Organisation whose services are being resold Micro Focus Software

Staff security

Staff security
Staff security clearance Conforms to BS7858:2012
Government security clearance Up to Baseline Personnel Security Standard (BPSS)

Asset protection

Asset protection
Knowledge of data storage and processing locations Yes
Data storage and processing locations United Kingdom
User control over data storage and processing locations Yes
Datacentre security standards Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency At least once a year
Penetration testing approach Another external penetration testing organisation
Protecting data at rest
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
  • Scale, obfuscating techniques, or data storage sharding
  • Other
Other data at rest protection approach The application has been built to vendor requirements, as such there is no OS or DB level encryption beyond user / password access. The application has obfuscated passwords within the databases. There are options available for encryption of data on DB and OS level, though these come with not insignificant performance hits so we would have to consider increasing resource and cost if this was needed e.g.
PostgresSQL - CyberTec Instance Level Encryption
Centos NFS - Encrypted File System
Data sanitisation process Yes
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
Equipment disposal approach In-house destruction process

Data importing and exporting

Data importing and exporting
Data export approach Data can be exported from the solution in a number of ways:
- .csv or .xls formats.
- via REST API
- via a Business Intelligence (BI) integration module.
Data export formats
  • CSV
  • Other
Other data export formats
  • XML
  • XLS
Data import formats
  • CSV
  • Other
Other data import formats XML

Data-in-transit protection

Data-in-transit protection
Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
Data protection within supplier network Other
Other protection within supplier network Client-to-Site (SSL) VPN connectivity that allows the customer’s administrators to access the private IP addresses of the Workloads through a secure, encrypted tunnel.
Built into the Virtual Cloud Management application. Full network and firewall segregation achieved with Virtualization, Network and security controls.
The application is multi-tenanted. There is a back office management layer where tenants and users are setup. A back office admin user does not by default have access to a tenant. The tenant admin has access to report on any action taken within their own tenant.

Availability and resilience

Availability and resilience
Guaranteed availability SLA - 99.9% availability. If EOH service fails to meet this key objective in a given calendar month, 5% of prorated monthly cloud service fee will be refunded directly to the customer account within 30 days.
Approach to resilience Data Centre has a high resilience setup:
• Highly secure, Tier 4 data centre environment
• Dual power circuits with UPS
• Backup power generators
• Constant environmental monitoring
• Dual network and redundant data fabric
• Software-defined storage services
• Converged and hyper-converged infrastructure
• On-going capacity planning
Application is built upon a containerised architecture. This is able to redeploy services on available hardware if it senses that an issue has occurred.
Outage reporting Dependent on customer requirements, outages can be accessed via Public URL, or notified by telephone and/or email alerts .

Identity and authentication

Identity and authentication
User authentication needed Yes
User authentication
  • Username or password
  • Other
Other user authentication SAML OATH 2.0 via Customer ADFS server
Access restrictions in management interfaces and support channels The application is multi-tenanted. There is a back office management layer where tenants and users are setup. Application back office administrators are named and limited in number. A back office admin user does not by default have access to a tenant. By adding themselves to a tenant, this account only has very basic permissions to raise new requests and view your own requests only. The tenant admin has access to report on any action taken within their own tenant.
Access restriction testing frequency At least once a year
Management access authentication Username or password

Audit information for users

Audit information for users
Access to user activity audit information Users have access to real-time audit information
How long user audit data is stored for User-defined
Access to supplier activity audit information Users contact the support team to get audit information
How long supplier audit data is stored for User-defined
How long system logs are stored for Between 1 month and 6 months

Standards and certifications

Standards and certifications
ISO/IEC 27001 certification No
ISO 28000:2007 certification No
CSA STAR certification No
PCI certification No
Other security certifications Yes
Any other security certifications INFORMATION SECURITY MANAGEMENT SYSTEM ISO/IEC 27001:2013 for the Datacentre

Security governance

Security governance
Named board-level person responsible for service security No
Security governance certified Yes
Security governance standards ISO/IEC 27001
Information security policies and processes Security is managed at three levels: Infrastructure, Environment, Customer. EOH Cloud team are wholly responsible for Infrastructure security, governing DC / Hardware, Network and Security devices. EOH Application Management team is responsible for managing the environment where the application is running - for example building and hardening the application to vendor recommendations. Customer is responsible for in-application security.(e.g. user role access) and the security of on-premise components that maybe required for integration purposes.

Operational security

Operational security
Configuration and change management standard Supplier-defined controls
Configuration and change management approach The change management processes follow ISO27001 A.12.1.2 controlled mechanism for making changes to operational environments.
Vulnerability management type Supplier-defined controls
Vulnerability management approach We subscribe to multiple vendor provided vulnerability
notification services. All vulnerabilities are reviewed and applicable patches are administered through the change control process . Mitigation measures will always be considered first, with critical patches targeted for resolution within 30 days.
Protective monitoring type Supplier-defined controls
Protective monitoring approach Denial of Service is applied on all Internet links , with Intrusion detection\protection available to customers on request. All security events are logged\notified based on severity. Any attempted platform security compromises are dealt with 24/7 by security engineers. The responsibility remains with the customer to ensure detected intrusions are re-mediated where customershavecontrol,permission,oraccesstomodifytheir service. EOH recommends that customers follow security best practices including, but not limited to: • Maintaining effective firewall rules • Limiting the communication ports to only the necessary, for conducting business • Locking down access
Incident management type Supplier-defined controls
Incident management approach The incident response process complies with industry standards for legally admissible chain-of-custody and forensic data collection management processes and controls. Response standards, procedures, and methods are implemented based on the severity level of an incident. Incident reports are produced as part of standard post incident process and provided to customers on request.

Secure development

Secure development
Approach to secure software development best practice Supplier-defined process

Public sector networks

Public sector networks
Connection to public sector networks No


Price £300 per instance per month
Discount for educational organisations No
Free trial available Yes
Description of free trial 60 day free trial available for 10 concurrent users.
Integrations into the trial may not be supported and could be subject to a cost. This can be discussed with the prospective customer.


Pricing document View uploaded document
Service definition document View uploaded document
Terms and conditions document View uploaded document
Return to top ↑