Blue Lights Digital

Blue Lights Discovery - Digital Forensics, Investigation & Intelligence

Limitless forensic scalability combined with OSINT. Cloud data source collection from tools (G Suite and Microsoft Teams). Limitless forensic processing power combined with simplified forensic review on a single platform. Scale up and reduce processing time from days to hours. Automate tasks from evidence acquisition to evidence review and export.


  • Limitless scalability and forensic processing power
  • Quality assured standards and qualitative workflows
  • Near-native review of chat data and all document types
  • Near-instant rapid review where documents load in small batches
  • Reviewers only see data that is relevant/assigned to them
  • Collect live endpoint data remote, off-network and cloud data
  • Reduce processing time from days to hours
  • Collaborative reviewers with transparency on progress throughout forensic reviews
  • Hot keys and AI image labelling to eliminate repetitive tasks
  • Automate tasks from evidence acquisition to evidence review and export


  • Pre-built workflows & configuration for rapid deployment
  • Experienced DFU and Investigations team saving time on education
  • Network, Cloud tenancy & infrastructure, support desk
  • Platform access granted by authorisation, necessity or time orientated
  • Identity Access Management is built in for increased security posture
  • Parse registry files and Windows system information files
  • Collect, process and analyse Apple file systems, encrypted, compressed, deleted
  • Explore EXIF data, capture images or video
  • Attribute OSINT timelines, cluster graphs, pie charts and geolocations.
  • Collect, process and analyse datasets from multiple tools


£350.00 to £15,000 a unit

  • Free trial available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Tell them what format you need. It will help if you say what assistive technology you use.


G-Cloud 12

Service ID

2 2 0 8 4 7 3 9 5 5 0 6 1 3 3


Blue Lights Digital Claire Stanley
Telephone: 07847258384

Service scope

Software add-on or extension
Cloud deployment model
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
Service constraints
Available as a web service in Azure. Any white label requests will need an azure tenancy.
System requirements
  • Enterprise edition requires subscription
  • IP Addressing and Identity Access permissions
  • Desktop browser for Web Services

User support

Email or online ticketing support
Yes, at extra cost
Support response times
Toolset is Fresh Service.

SLA's available are 1 hr - 8hr - next business day response.

We have dedicated e-mail and chat channels available 24/7.

Service options include 24/7 human support available Service Desk or remote.

- Mon - Fri 9-5 Service Desk or remote support

- Automated bot support available on chat channels only
User can manage status and priority of support tickets
Online ticketing support accessibility
None or don’t know
Phone support
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
Onsite support
Yes, at extra cost
Support levels
Support is on a reasonable endeavour basis and is included in our pricing.
Dedicated 'operational' support can be provided under our standard day rates for an investigating officer.

Technical developers can be provided to assist with data modelling, Data integration, Data Parsing, Data migration, API build, software integration, Network integration and automation under our standard day rates.
Support available to third parties

Onboarding and offboarding

Getting started
Training is provided by the app itself. The UI and UX are designed for self provisioning. Content is navigated by breadcrumbs and visual pointers. The app has been UX tested for systems usability. With all versions of Discovery the 'About Discovery' module will demonstrate how to use the system.

Training can be provided for Administration purposes where administrators are required to manage cohorts, manage reporting metrics, report on currency and compliance and award credentials.

Training can be provided in design, build and operation of discover modules.
Service documentation
Documentation formats
End-of-contract data extraction
Data is deleted by Blue Lights Digital only. Note that any data downloaded to a container on a mobile device will remain at rest on that device. Therefore, clients are recommended to use MDM to manage access to the enterprise edition of the Discover App.
End-of-contract process
A subscription will lapse and no further updates will be provided to that user. Access to the web service will also be denied. The app, its content and workflow will remain at rest until deleted by the user or via an MDM function.

Using the service

Web browser interface
Supported browsers
  • Internet Explorer 7
  • Internet Explorer 8
  • Internet Explorer 9
  • Internet Explorer 10
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
  • Opera
Application to install
Designed for use on mobile devices
Service interface
Customisation available
Description of customisation
Modules can be updated through admin access portal by Web Services only. Access is via HTTPS with Identity Access Management applied.

Customer managed content can be updated and published to web and mobile users.


Independence of resources
Load balancing, Clients can be allocated reserved instances for on demand scaling.


Service usage metrics
Metrics types
Transaction by user, client to domain.
Reporting types
Reports on request


Supplier type
Not a reseller

Staff security

Staff security clearance
Conforms to BS7858:2012
Government security clearance
Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least once a year
Penetration testing approach
Protecting data at rest
Scale, obfuscating techniques, or data storage sharding
Data sanitisation process
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
Any data that is managed on behalf of the client can be extracted and sent to the client in a format of there choosing.
Data export formats
  • CSV
  • ODF
  • Other
Data import formats
  • CSV
  • ODF
  • Other

Data-in-transit protection

Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability
Availability of less than 99.95% but equal to or greater than 99.0% is guaranteed by a 10% service credit for failure to meet SLA.

Availability less than 99.0% is guaranteed by a 30% service credit for failure to meet SLA.
Approach to resilience
We utilise elastic load balancing, computing clusters, autoscaling and cloud flaring (DNS obfuscation) to add resilience to our cloud environments.
Outage reporting
Email alerts to users.

Identity and authentication

User authentication needed
User authentication
  • 2-factor authentication
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
Access restrictions in management interfaces and support channels
Access to the Decypher system is limited by identity Access Management to known and vetted users only. Three factor authentication is required via a RSA key, Password and Username.
Access restriction testing frequency
At least every 6 months
Management access authentication
  • 2-factor authentication
  • Username or password
  • Other
Description of management access authentication
IP White Listing

Audit information for users

Access to user activity audit information
You control when users can access audit information
How long user audit data is stored for
Access to supplier activity audit information
You control when users can access audit information
How long supplier audit data is stored for
How long system logs are stored for

Standards and certifications

ISO/IEC 27001 certification
ISO 28000:2007 certification
CSA STAR certification
PCI certification
Other security certifications
Any other security certifications
Cyber Essentials

Security governance

Named board-level person responsible for service security
Security governance certified
Security governance approach
Through Cyber Essentials and NCSC cloud principles.
Information security policies and processes
We use a shared responsibility model between customers and Blue Lights Digital. We operate, manage, and control the components at the operating system layer down to the physical security of the servers in which the services are provided (including updates and security patches), other associated application software, as well as the configuration of firewalls. ,

It is possible to enhance security and/or meet more stringent compliance requirements by leveraging technology such as host-based firewalls, host-based intrusion detection/ prevention, and encryption which can be requested by our clients at additional charges.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Any changes to our systems are first managed by impact and risk assessment. Any changes to architecture, software or network access is tested within a development environment before release to production. A production snapshot is available for roll back.

Security assessment is managed through in house pentesting an testing procedures. External pen testing is subject to additional charges.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
As part of our Cyber Essentials programme we practice identifying, classifying, remediating, and mitigating vulnerabilities.

We use vulnerability scanners to identify known vulnerabilities, such as open ports, insecure software configuration, and susceptibility to malware. For unknown vulnerabilities, such as a zero-day attacks we relay on updates to our vulnerability scanners such as OWASP ZAP. Vulnerability testing is also part of our test automation processes.

Correcting vulnerabilities involves the installation of a patch, a change in network security policy, reconfiguration of software, or educating users about social engineering.

We are active members of OWASP, CISP and Black Hat communities.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
We license SiteLock TrueCode Static Application Security Testing (SAST) for source code analysis. Also known as "white-box" testing, TrueCode finds common vulnerabilities by analysing 100% of the source code in our applications without actually executing them, and adds critical layer of security by protecting our web applications.

Our SAST is automated to send alerts if a breach or malware is detected.
Incident management type
Supplier-defined controls
Incident management approach
The activities within our incident management process include:
Incident detection and recording
Classification and initial support based upon known errors and new events
Investigation and analysis
Resolution and record
Incident ownership, monitoring, tracking and communication

We report on incidents with a full disclosure policy to ensure any impact can be contained and a resolution is satisfactory to the end user.

Incident reports are provided by e-mail to the end user.

Secure development

Approach to secure software development best practice
Conforms to a recognised standard, but self-assessed

Public sector networks

Connection to public sector networks
Connected networks
Police National Network (PNN)


£350.00 to £15,000 a unit
Discount for educational organisations
Free trial available
Description of free trial
30 days usage personal or organisational.
Trial assessments.
No data retention or analytics provided.

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Tell them what format you need. It will help if you say what assistive technology you use.