FlyingBinary Ltd

Analytics Private Data Vault

Built on Commvault Content Store, Analytics Private Data Vault integrates a consolidated repository of enterprise data, documents and email with inituitive analytics and comprehensive search. Residing in the FlyingBinary big data analytics suite, demonstrating GDPR compliance and audit requirements. it can be flexed to include overall data and service strategy.

Features

• Consolidate databases, documents, spreadsheets and email in one vault
• Metadata and item attributes automatically loaded into analytic dashboards
• All data, email and document content is fully indexed
• Demonstrate GDPR compliance via dashboards and search
• Fully automated backup to cloud vault
• Automatic item and block deduplication
• Full range of connectors embraces all operating systems and applications
• Scalable, secure cloud provision
• Desktop and mobile browser access
• Recover, retrieve data at any time for GDPR audit compliance

Benefits

• Single vault facilitates enterprise-wide analytics, audit and compliance reporting
• Integrated dashboards provide analytic insight to consolidated vault data
• Full indexing ensures rapid and comprehensive discovery
• Regulatory focus the precursor for demonstrating GDPR compliance
• Automated backup ensures critical data is safeguarded, no intervention needed
• Deduplication ensures minimum storage cost
• On-premise, cloud or legacy hosting data are equally accessible
• Cloud provision simplifies integration with existing infrastructure
• Desktop and mobile capability puts big data analytics where needed
• Full data retrieval facilitates system recovery following outage

£2,800 a terabyte a month

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

• Modern Slavery statement

  PDF

Framework

G-Cloud 12

Service ID

244984897992601

Contact

Dr Jacqui Taylor
+44 77 899 668 02
jacqui.taylor@flyingbinary.com

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: Source servers must have an agent installed in order to transfer data to the vault. Agent installation is self-managed by client administrators, does not need supplier involvement. Data is transferred via HTTPS (TLS v1.2) and the network port must be open to allow the transfer.
• System requirements:
  • Source servers must have an agent installed
  • HTTPS port must be open for data transfer

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: We respond to all questions within 8 business hours. Normal business hours are 0800-1800 Mon-Fri excluding UK holidays. We regularly respond to questions within 4 business hours, and we triage all inbound questions to establish urgency and set appropriate priorities.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Our standard support service is by email 0800-1800 Mon-Fri excluding UK holidays and we respond to all questions within 8 business hours. We regularly respond to questions within 4 business hours, and we triage all inbound questions to establish urgency and set appropriate priorities. We can offer several extensions to the standard service at extra cost: extended hours support at 10x7 or 24x7; 4 business hour response; phone support; web chat support; onsite support. The support service is provided for issues, incidents and service requests. We will also respond to questions about how to use the service, but we reserve the right to direct clients to our training services if users are clearly not equipped to use the service competently.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: There are four types of onboarding help available, which may be used in combination: online help; key contact getting started assistance; additional onboarding assistance; service training courses. Key contact getting started assistance is included within the cost of the service. It is usually conducted as an interactive web screenshare session, but may also be provided as a pre-recorded video session with a follow up teleconference, or as an onsite session. Onsite sessions outside the M25 area will incur an additional cost. Online help is available to all client users of the service and is included within the cost. Additional onboarding assistance and service training courses are both provided via the companion Cloud Support service.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: The service has built-in tools that allow user data extraction. These tools are available at any time, not just at contract end, and may be used for any data extraction purpose required. There are no restrictions: all user data may be extracted from the service for any reason, at any time. User data extraction does not require supplier intervention, but clients may choose to limit this functionality to client super users or administrators. There is no limit to the number or size of data extractions performed, but the service is priced on a "fair use" basis for network charges. Excessively large or very frequent data extractions may incur an additional cost or bandwidth limits. Alternatively, the companion Cloud Support service offers assistance with data extraction, at an additional cost.
• End-of-contract process: Prior to the end of contract/contract renewal date, we discuss the forward plan with the client key contact. In the event of contract end, we work with the key contact to ensure that all user data and collateral is retrieved or extracted before the contract end date. Although there are standard data extraction tools built in to the service, there may be a requirement for special data migration to the client's chosen new service. In that instance, we can work with the new supplier to migrate data to maximum benefit for the client, such work would be performed within the companion Cloud Support service and incur an additional charge. In the event that the client is unable to extract all required data before the contract end date, it is often possible to extend the duration of the data extraction features of the service for an additional period; or to extend the full service for an additional period; so that the client does not suffer unnecessary unavailability.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
  • Opera
• Application to install: Yes
• Compatible operating systems:
  • Linux or Unix
  • MacOS
  • Windows
  • Other
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: All standard features of the desktop service are available on mobile devices. The presentation and navigation of features is reformatted to provide a mobile-friendly experience for smaller screen sizes. Some design and administration features may be more difficult, or not available on mobile devices. Services may be configured for access over the public internet, or restricted to public sector networks. Mobile devices must be able to access services via the same network routes as desktop or laptop devices.
• Service interface: Yes
• Description of service interface: The service employs a modern, simple, browser-based, easy-to-use interface to provide a unified approach for users to interact with the service. Choosing browser-based over an installed application simplifies security, enterprise deployment and ensures that the service is evergreen without costly software upgrades. See answers to other questions concerning browser specifics. All standard user features are available via desktop or mobile web browsers. Mobile browsers are optimised to work with touch input, while desktop browsers support accessibility tools and software. Note that a small group of client super users still require an installed application to perform advanced design and administration tasks.
• Accessibility standards: WCAG 2.1 AA or EN 301 549
• Accessibility testing: All parts of the service interface are tested using both standard input and assistive technologies, including keyboard navigation and screen readers. In addition to in-house testing, the public beta programme is open to users of assistive technologies. The product toolbars are now Double A conformant including Custom Views, Subscribe and Alerts.
• API: No
• Customisation available: No

Scaling

• Independence of resources: Our testing tells us the lower and upper levels of cloud resource required to maintain performance for normal levels of demand. We reserve and dedicate the lower level of cloud resources to each client, so that no client user can impact the performance of any other client. As client demand increases, we monitor performance and ensure that additional cloud resources are available to maintain performance, to the upper level. The service is priced on a "fair use" basis, so exceeding the upper level of demand means either reduced performance, or request further cloud resources, at additional cost.

Analytics

• Service usage metrics: Yes
• Metrics types: Metrics are available showing user activity, traffic to views, traffic to data sources, performance of views and actions by users. These metrics are presented in real time dashboards and are available to client super users on request.
• Reporting types: Real-time dashboards

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2012
• Government security clearance: Up to Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Physical access control, complying with SSAE-16 / ISAE 3402
• Data sanitisation process: Yes
• Data sanitisation type: Explicit overwriting of storage before reallocation
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: There are tools built in to the service that allow users to export their data. User data export does not require supplier intervention, but clients may choose to limit this functionality to client super users or administrators. Users may specifiy any subset, or all, of the data that is relevent to the current export requirement. Once the data subset has been selected, invoking the export function creates a CSV file corresponding to the selection. This CSV file is then downloaded to the user computer for the required purpose.
• Data export formats:
  • CSV
  • Other
• Other data export formats: Backed up data can be retrieved in original format
• Data import formats:
  • CSV
  • Other
• Other data import formats: Data can be backed up in original format

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: Other
• Other protection within supplier network: The internal local network supporting the service is segregated from external networks using both firewalls and internal VLAN configuration. For reasons of operational effectiveness and performance, traffic within the VLAN is not encrypted. Traffic that passes from one cloud service to another is encrypted using TLS v1.2 as it traverses the VLAN boundaries and firewalls. If your use case requires internal network encryption, we can discuss alternate cloud deployments and architectures, at additional cost.

Availability and resilience

• Guaranteed availability: We guarantee the service will be available 99% of the time during business hours. Measured over the last two years, we have comfortably exceeded 99.5% availability. For use cases requiring higher availablity guarantees, we can discuss alternate cloud deployments and architectures, at additional cost. No financial recompense is offered for a single failure to meet service level within a year. In the event there are two or more failures in successive months, then a discount equal to one twelfth of the annual cost will be offered for renewals at the next anniversary.
• Approach to resilience: All cloud resources are virtualised, so there is no dependency on any single hardware component. The underlying infrastructure is 99.999% available. As standard, all service components are deployed in a single availability zone to minimise service costs. All client deployments are managed as separate cloud instances, ensuring that performance-affecting activity occurring in one client deployment cannot impact any others. All client data is backed up daily for additional protection against service outage, data corruption or other potential losses. In addition to the single zone service, there is also the option of dual zone service, where all service components are replicated at a second site, at additional cost. The dual availability zone option provides geographic resilience, in addition to providing an alternate source of service provision in the case of some outage that affects multiple hardware components, or a whole data centre or geographic location. As standard, primary or single zone hosting is located in the UK, while secondary zone hosting is located in the EEA.
• Outage reporting: Service affecting incidents are reported to client key contacts by email. Service affecting incidents include any observation of diminished service performance, reduced or missing functionality and not just observation of service outage. Initial emails may include only a report of the observation. Follow up emails will include notification of full service restoration, or estimated time to restoration, or additional details of mitigations or workarounds. Client key contacts may also request further details or additional help, as the emails are issued by a client support team, capable of responding to requests for additional information; the emails are not issued by "no-reply" mailboxes.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Username or password
• Access restrictions in management interfaces and support channels: There are two type of management access, for client super users and for supplier administrators. Client management access is limited to designated user accounts that have super user or admin status. Supplier management access is limited to designated user accounts. Supplier management user accounts have very strong passwords stored in password management vaults, to which only authorised users have access. Some supplier management actions require direct cloud resource management and this is performed via whitelisted or other restricted network access links.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Other security certifications: Yes
• Any other security certifications: Cyber Essentials

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: Our security governance is meshed with our corporate governance, with our CEO having final responsibility for G-Cloud services and governance policies and our CTO having day-to-day responsibility for policy implementation. Our policies cover people, processes, technology and information assets, at board, management and operational levels. We review our policies and update our practices in light of new regulation, standards and best practice to ensure we are able to counter current and emerging threats.
• Information security policies and processes: Our information security policy follows guidance in ISO27001, is owned by our CEO and implemented by our CTO. The top level Information Security Policy is supported by Architecture, Operations and Client Access policies. The policy states security objectives and establishes principles to ensure current and continued adherance and continual improvement. The policy set is integral to staff induction and all staff are required to agree and accept that information security governance is a core working principle. Operational checklists enforce security practices at the day to day level, and activities cannot be signed off without verified completion. The checklists also contain sections for feedback and challenge so that we actively improve. All staff are expected to challenge, because if we don't, bad actors will. Standard reporting flows from operational analyst or team lead to manager to CTO, but any staff member can invoke exceptional reporting directly to management or board, to ensure that important issues receive appropriate attention. Internal reviews ensure that all information security processes are working smoothly and as designed. If exceptions are found, we perform root cause analysis to understand if/how we need to change working practice to support our information security objectives.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Service hardware components are managed by our data centre suppliers. Component lifecycle management is accredited to ISO27001, including storage overwrite and secure destruction. Service software is assembled from existing software components (proprietary and open source), is obtained only from the official repository, and security checked before use. No custom software is used. The service deployment checklist records all versions and change dates. Planned infrastructure or software changes are reviewed for new or changed features or capabilities, and internal software library dependencies. If needed, configurations are changed to disable unnecessary new features or mitigate any additional security exposure.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We monitor vulnerability feeds, vendor and security researcher blogs to understand emerging threats. We then make an assessment to confirm any potential to affect service, and if so, determine severity and likelihood. Based on our assessments, we create a mitigation plan that may include a change to operation practice, a planned upgrade or an emergency upgrade. Operational changes and emergency upgrades are carried out as soon as reasonably practical following assessment and planning. Planned upgrades are accommodated within the normal upgrade or patching cycle.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: System event monitoring is used to facilitate the identification, classification and analysis of potential security incidents. Any security-related incident is classified as a severely service affecting incident, is escalated accordingly and actioned immediately. Different techniques and processes are employed to mitigate and recover service integrity, depending on the nature of the incursion. Further details are available on request.
• Incident management type: Supplier-defined controls
• Incident management approach: All service incidents follow a standard process. A triage step classifies to: common event not service affecting; service affecting; severely service affecting. Common events are handled by following a routine process. Events affecting service severely are immediately escalated to acquire necessary resource and management support. All other incidents are handled by the respective support team. Clients can report incidents by email to the support team. Update reports and communications are issued for all client-reported and service affecting incidents. When service affecting incidents are resolved, root cause analysis is performed to determine mitigating actions.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: Yes
• Connected networks: Joint Academic Network (JANET)

Pricing

• Price: £2,800 a terabyte a month
• Discount for educational organisations: No
• Free trial available: No

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

• Modern Slavery statement

  PDF