G7 Business Solutions Ltd

Unit4 Business World (Agresso) Cloud Hosting & Managed Service / Support

G7's independent Unit4 Business World (Agresso) Cloud Hosted Solution, provided through QuickThink Cloud, allows organisations to offload the considerable cost of in-house hosting / technical support of the U4BW Agresso system (and associated technologies), delivering a fast, reliable, secure, highly available, dedicated and robust system to users.


  • 99.9% availability, backed by service credits
  • Maximum security, backed by impressive accreditations
  • Fully automated 24/7 monitoring for pro-active support
  • Cutting edge platform, with VPN and MPLS links as standard
  • Agile deployments; new systems provisioned within 48 hours
  • Unlimited U4BW (Agresso) restores / environment refreshes
  • Advanced Disaster Recovery services
  • Unlimited OS, RDBMS & Agresso updates, upgrades and patching
  • Fully Security Cleared (SC) support team
  • Lightning fast performance on ERP-optimised hardware


  • Low total cost of ownership & cost effective solution
  • Expert Agresso Technical Managed Service Support
  • Massive scalability - no system to big or too small
  • Database and system performance tuning as standard
  • Continuous knowledge-share with in-house teams
  • Accessible via web browser, desktop PC or mobile devices
  • Unlimited off-site backups for 'bulletproof' audit accountability
  • Exceptional business continuity cover for total service coverage
  • Hosting of Agresso / non-Agresso systems wherever necessary
  • Enterprise SLA's backed by service credits.


£10000 per unit per year

  • Education pricing available
  • Free trial available

Service documents

G-Cloud 9


G7 Business Solutions Ltd

Julie Munt

01275 844650


Service scope

Service scope
Service constraints Unit4 Business World, SQL Server is the only supported RDBMS in this cloud solution. Oracle is not supported.
System requirements
  • A modern PC with internet connectivity is required
  • Desktop users will require the Citrix Receiver client
  • VPN's (if required) require customer firewall
  • Power users will require Excel on their desktop machine

User support

User support
Email or online ticketing support Email or online ticketing
Support response times Our response time is advertised as 1 hour for urgent incident priorities, 2 hours for high priority and medium priority incidents and 4 hours for low. However, we consistently respond significantly faster than the advertised SLA's (typically within 30 minutes across all incident priorities).
User can manage status and priority of support tickets Yes
Online ticketing support accessibility None or don’t know
Phone support Yes
Phone support availability 24 hours, 7 days a week
Web chat support Web chat
Web chat support availability 9 to 5 (UK time), Monday to Friday
Web chat support accessibility standard WCAG 2.0 A
Web chat accessibility testing Uses can chat to the support team, provide screen share capabilities and upload files securely.
Onsite support Yes, at extra cost
Support levels All our cloud hosting solutions come with full managed service support. The support levels are calculated based on the size of the system and its complexity, but there are gradual increases depending on the number of users, complexity, etc. as might be expected. These are documented in the associated documentation. All contracts include Technical Project Management, Account Management & Cloud Support as standard.
Support available to third parties Yes

Onboarding and offboarding

Onboarding and offboarding
Getting started A bespoke customer system reference document is provided. This details all the resources available to users, the URL's and how to access and use them. It also includes training for in-house IT teams to support users (which is delivered via distance training; telephone or online tools).
Service documentation Yes
Documentation formats PDF
End-of-contract data extraction This is entirely up to the users, but we support full database backups, full SFTP transfer of files / resources or the user can simply export their data directly from the system using web services or other online tools that we provide.
End-of-contract process All end of contract off-boarding exercises are covered under the contract. The data will ultimately be destroyed, but if it is still required it can be provided to a third-party or to the customer directly via database backup, SFTP file transfer or any other method required. The data can also be obtained on a self-service basis by the customer directly if they utilise the web API's.

Using the service

Using the service
Web browser interface Yes
Using the web interface The web interfaces are developed by Unit4 (for Unit4 Business World) and Citrix (for Citrix web interface). Users can log into the application(s) and can access all the functionality available to them via these web interfaces.
Web interface accessibility standard None or don’t know
How the web interface is accessible UNIT4 has developed a product reading list in braille for the blind and visually impaired, which sits in front of the user’s keyboard and mirrors the user’s screen text line by line. Text to speech function is available making it easy and quick to listen to the text that’s written on the screen. For the visually impaired, the text has been adapted to provide enhanced readability through stronger contrasts and increased size.
Web interface accessibility testing Unit4 (the software vendor for Unit4 Business World software) has been awarded a European CSR award for its work with Blindeforbundet, the Norwegian Association for the Blind and Partially Sighted (NABP) to make its Enterprise Resource Planning (ERP) software available to blind and partially sighted people.
What users can and can't do using the API The API's allow changes to be made to the core application, such as adding, deleting or viewing users, projects, purchase orders, invoices, etc. Users need programming skills to utilise these API's. The API's are built into the Unit4 Business World product. These are published to users that need to utilise them.
API automation tools
  • Ansible
  • Chef
  • OpenStack
  • SaltStack
  • Terraform
  • Puppet
  • Other
Other API automation tools The API's are open to use through any automation software
API documentation Yes
API documentation formats Other
Command line interface No


Scaling available Yes
Scaling type
  • Automatic
  • Manual
Independence of resources CAS(t) accreditation to OFFICIAL (IL2). This is required to provide secure networking and hosting services to the UK Government and public sector organisations. These are as follows: CESG CAS(t) IL 2-2-4 CESG Assured Service (Telecoms) Scheme – Impact Level 2-2-4 525 CESG CAS(t) IL 2-2-4 CESG Assured Service (Telecoms) Scheme – Impact Level 2-2-4 Encryption Overlay Service Slice for Off-Net Services 526 CPU / disk contention is also kept to a minimum (and throttled), with all customers enjoying dedicated RAM.
Usage notifications Yes
Usage reporting
  • Email
  • Other


Infrastructure or application metrics Yes
Metrics types
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
  • Other
Other metrics
  • Core user numbers
  • Custom application metrics
Reporting types
  • Regular reports
  • Reports on request


Supplier type Reseller providing extra features and support
Organisation whose services are being resold QuickThink Cloud Hosting and Technical Managed Service

Staff security

Staff security
Staff security clearance Other security clearance
Government security clearance Up to Developed Vetting (DV)

Asset protection

Asset protection
Knowledge of data storage and processing locations Yes
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
  • EU-US Privacy Shield agreement locations
  • Other locations
User control over data storage and processing locations Yes
Datacentre security standards Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency At least once a year
Penetration testing approach ‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest Physical access control, complying with SSAE-16 / ISAE 3402
Data sanitisation process Yes
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Hardware containing data is completely destroyed
Equipment disposal approach Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

Backup and recovery
Backup and recovery Yes
What’s backed up
  • Virtual machines
  • SQL server databases
  • Oracle databases
  • Files & Folders
  • System States
Backup controls Users identify what they would like to back up (along with a consultant) and the backups are setup with the relevant schedule.
Datacentre setup
  • Multiple datacentres with disaster recovery
  • Multiple datacentres
  • Single datacentre with multiple copies
  • Single datacentre
Scheduling backups Supplier controls the whole backup schedule
Backup recovery Users can recover backups themselves, for example through a web interface

Data-in-transit protection

Data-in-transit protection
Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
Data protection within supplier network IPsec or TLS VPN gateway

Availability and resilience

Availability and resilience
Guaranteed availability Guarantees the functioning of all cloud server hosts including the hypervisor, with a 99.9% availability for all hosted systems. In the unlikely event of host failure, HA will automatically restart the affected VM onto a healthy host. If the service fails to meet any of these availability commitments, the Customer shall be entitled to service credits.
Approach to resilience Available on request.
Outage reporting Service outages are reported via email and also via the customer's online portal.

Identity and authentication

Identity and authentication
User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google apps)
  • Dedicated link (for example VPN)
  • Username or password
Access restrictions in management interfaces and support channels Access to management interfaces is strictly controlled and does not include any user access. Only SC security cleared staff have access to management interfaces. Support channels are opened to named users within the organisation. Their access / viewing options will vary depending on their role.
Access restriction testing frequency At least every 6 months
Management access authentication 2-factor authentication
Devices users manage the service through Dedicated device on a segregated network (providers own provision)

Audit information for users

Audit information for users
Access to user activity audit information Users have access to real-time audit information
How long user audit data is stored for User-defined
Access to supplier activity audit information Users contact the support team to get audit information
How long supplier audit data is stored for User-defined
How long system logs are stored for User-defined

Standards and certifications

Standards and certifications
ISO/IEC 27001 certification No
ISO 28000:2007 certification No
CSA STAR certification No
PCI certification No
Other security accreditations Yes
Any other security accreditations
  • Cyber Essentials
  • In process for ISO 9001: 2015
  • In process for ISO27001

Security governance

Security governance
Named board-level person responsible for service security Yes
Security governance accreditation No
Security governance approach Currently ISO27001 in progress with QMS International. Therefore, security governance is built on the principals of ISO27001.
Cyber Essentials accreditation.
Information security policies and processes Information security policies are fully documented and available to all members of staff. Updates are communicated to the organisation, with new starters undergoing a specific session that covers the security policy and invites them to ask questions. Typical policies and processes include blocking the use of USB devices, password changes, fully documented change control, subscribing to security news letters from our CHECK accredited security partners, etc

Operational security

Operational security
Configuration and change management standard Supplier-defined controls
Configuration and change management approach All change management is tracked on our customer portal, with full visibility to customers. Changes are requested, agreed upon and advertised, documented and delivered via this medium. Every change is subject to CAB approval which happens once a week (or can be put forward for an emergency change if required).
Vulnerability management type Undisclosed
Vulnerability management approach A detailed account of this information is available upon request. However, at a high level the threats to our services are both managed, monitored and neutralised via our IDS / IPS systems, we deploy patches regularly in a controlled manner using industry standard deployment tools and our information about potential threats comes from our CHECK certified security provider and datacentre partners.
Protective monitoring type Undisclosed
Protective monitoring approach This information is available upon request, but at a high-level potential compromises are identified using an industry standard IDS system, our response includes our own security procedures and includes our CHECK accredited security partner and any such threats / compromises are classified as URGENT and are investigated immediately under the highest possible SLA.
Incident management type Supplier-defined controls
Incident management approach Our incident management is tightly interwoven with our service desk system. Users can report incidents via email, internet portal or telephone. Uses can run their own incident reports via this system, but these are also available upon request. We have pre-defined processes for common events (environment refreshes, etc.) and these are documented on the portal knowledge-base where appropriate.

Secure development

Secure development
Approach to secure software development best practice Supplier-defined process

Separation between users

Separation between users
Virtualisation technology used to keep applications and users sharing the same infrastructure apart Yes
Who implements virtualisation Third-party
Third-party virtualisation provider Various - all with the necessary accreditation.
How shared infrastructure is kept separate CAS(t) accreditation to OFFICIAL (IL2). This is required to provide secure networking and hosting services to the UK Government and public sector organisations.

Energy efficiency

Energy efficiency
Energy-efficient datacentres Yes


Price £10000 per unit per year
Discount for educational organisations Yes
Free trial available Yes
Description of free trial 30-day free trial is offered. This includes 1 full system with relevant infrastructure and support.


Pricing document View uploaded document
Service definition document View uploaded document
Terms and conditions document View uploaded document
Return to top ↑