Vault lets your teams easily collaborate on OFFICIAL information, whilst retaining audit controls. Vault provides secure file sharing, real-time collaborative document editing, backup, remote file server access, and cloud storage. It is UK sovereign, hosted in accredited UK data centres, with end-to-end encryption protecting data at rest and in transit.
- Real-time file syncing and backup, for desktops and servers
- Protect work, with unlimited version history and global file lockin
- Data protection at all levels, with transparent end-to-end cryptography
- Easy to deploy SaaS, with system and application integration
- Online team file preview and edit, for instant results
- External sharing, with free password protected and audited accounts
- Outlook plugin, reducing email system administration and storage overheads
- Active Directory (AD) / LDAP authentication, for domain integration
- Team collaboration folders, making working on documents together easy
- Organisation dashboard, providing administrator tools and detailed reporting
- Collaborating securely; files and teams protected by military strength cryptography
- Accessing files remotely; without compromising security or privacy
- Retaining audit control; validate proper use of Departmental data
- Comprehensive auditing and tracking; with exportable logs of user activity
- Safe sharing; ensure files are shared with only authorised people
- Consolidated repository; create a hybrid cloud of current file servers
- Easily create backups; from folder to whole machines
- Unlimited versioning; retain a historical archive of your files
- Global file locking; prevent changes from being overwritten
- Familiarity; similar to public cloud services e.g. Dropbox, OneDrive, Box
£10 to £30 per user per month
|Software add-on or extension||No|
|Cloud deployment model||Public cloud|
|Service constraints||The platforms listed on the 'Supported Operating Systems' Knowledge Base article have been tested for support with the Nimbox Vault service, and whilst other compatibilities may exist, they are not officially supported. You may access the article here: http://support.nimbox.co.uk/knowledge_base/topics/supported-operating-systems|
|Email or online ticketing support||Email or online ticketing|
|Support response times||Our support team is here to help from 9am to 5pm GMT, Monday to Friday. We aim to reply within a couple of hours, but during peak times it can take a little bit longer.|
|User can manage status and priority of support tickets||No|
|Phone support availability||9 to 5 (UK time), Monday to Friday|
|Web chat support||No|
|Onsite support||Yes, at extra cost|
If you purchase a 'Standard' subscription, we'll handle your support request via email. Support is included in the subscription.
If you purchase a 'Premium' user account subscription, we'll handle your support request via telephone or email. Support is included in the subscription.
On-site support may be arranged by contacting our support team, however this will be charged at our standard consultancy rates.
We provide access to a team of remote support engineers, and also a Customer Service Manager.
|Support available to third parties||Yes|
Onboarding and offboarding
|Getting started||Getting started with Nimbox Vault is simple, and we'll work with you to deploy the service across your teams. Nimbox will provide easy to follow documentation, user training, and on-site support (subject to an additional charge). Plus, our support and engineering team is on hand to ensure the deployment is trouble free.|
|End-of-contract data extraction||Users can simply download all the data they store within Nimbox Vault, in a 'ZIP' folder. The user doesn't need to interact with us, as this process can be initiated, and completed, from within the user's online dashboard.|
|End-of-contract process||When the contract has ended, and if you don't want to extend your use of the Nimbox service, we'll give you thirty days to download your files and data. This process is initiated, and completed, by the buyer.|
Using the service
|Web browser interface||Yes|
|Application to install||Yes|
|Compatible operating systems||
|Designed for use on mobile devices||Yes|
|Differences between the mobile and desktop service||None|
|Accessibility standards||WCAG 2.0 AAA|
We place special importance in making our user interfaces accessible, and conduct regular usability testing.
In cases where application or user content is not available in a suitable format (such as content within documents that another user has uploaded to Nimbox Vault, and presented using our Web Editing feature), we provide easy pathways for seeking help from our support team.
|What users can and can't do using the API||
Nimbox API connectivity is available for all subscribers, but does have a fair usage limit of 2000 requests per hour (this can be increased if you contact us).
Getting started with the Nimbox API is simple, and our support team can walk you through the initial process.
The Nimbox API is organised around REST. Our API is designed to have predictable, resource-oriented URLs, and to use HTTP response codes to indicate API errors. We use built-in HTTP features, like HTTP authentication and HTTP verbs, which can be understood by off-the-shelf HTTP clients. JSON will be returned in all responses from the API, including errors.
The API includes, provisioning, user & device management, and storage management.
|API documentation formats||HTML|
|API sandbox or test environment||Yes|
|Description of customisation||As part of the 'Premium' plan's features, subscribers may configure custom branding within their service. This branding will show for all users, both internal, and for external users. It is present on the web, desktop, and mobile applications.|
|Independence of resources||Nimbox hard-provisions storage space for users, based on the amount allocated to their subscription plan. We also host on an elastic virtual hosting platform, which allows us to add resource quickly to cope with sudden increases in resource demand.|
|Service usage metrics||Yes|
|Metrics types||Administrators are provided with real-time information dashboards, and configurable reports, showing: storage overviews (including consumption over time, usage by file type); file and user activity; bandwidth usage; device status and health; and, details of accounts, admins, machines, roots, files, and revisions; plus, many additional metrics.|
|Supplier type||Not a reseller|
|Staff security clearance||Conforms to BS7858:2012|
|Government security clearance||Up to Security Clearance (SC)|
|Knowledge of data storage and processing locations||Yes|
|Data storage and processing locations||United Kingdom|
|User control over data storage and processing locations||No|
|Datacentre security standards||Complies with a recognised standard (for example CSA CCM version 3.0)|
|Penetration testing frequency||At least every 6 months|
|Penetration testing approach||Another external penetration testing organisation|
|Protecting data at rest||
|Data sanitisation process||Yes|
|Data sanitisation type||
|Equipment disposal approach||Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001|
Data importing and exporting
|Data export approach||Users can simply download all the data they store within Nimbox Vault, in a 'ZIP' folder. The user doesn't need to interact with us, as this process can be initiated, and completed, from within the user's online dashboard.|
|Data export formats||
|Other data export formats||
|Data import formats||
|Other data import formats||
|Data protection between buyer and supplier networks||
|Data protection within supplier network||
Availability and resilience
|Guaranteed availability||Nimbox strives, as part of our design, to always be available. And, whilst no specific service level is assured, we have been operating at over 99.99% availability since we started in 2012. You can find more details about our refund policy in our Subscriber Agreement.|
|Approach to resilience||
Vault is hosted in Tier 3+, ISO27001:2013 certified data centres, which have 24x7x365 on-site security, zonal swipe card entry, CCTV systems, perimeter fencing with controlled access, fire suppression systems, in-rack early warning temperature sensors and fire detection in all rooms, ceilings and below raised floors, N+1 UPS, and N+1 generators with a minimum 48 hours of fuel.
Our solution is powered by VMware technologies, and utilises automatic replication and failover. We test our failover procedures regularly.
Our platform is also monitored 24x7x365 from our system centre, and by Pingdom AB. Our platform is monitored for availability, reliability, and speed. A comprehensive external security testing programme is run each week to ensure that our service is secure from known exploits, new vulnerabilities, and targeted attacks.
We’re always monitoring the Nimbox platform. If there are any interruptions to your service, we’ll post details on our public status page, https://status.nimbox.co.uk, where users can subscribe to live incident updates.
You can subscribe to alerts via email.
Identity and authentication
|User authentication needed||Yes|
|Access restrictions in management interfaces and support channels||Whilst Nimbox accepts support requests from any Nimbox user, we only action user or service-impacting requests when authorisation has been provided by named organisation administrators. Currently this authorisation comes via a telephone call placed to a department number that is known to be safe.|
|Access restriction testing frequency||At least every 6 months|
|Management access authentication||
Audit information for users
|Access to user activity audit information||Users have access to real-time audit information|
|How long user audit data is stored for||At least 12 months|
|Access to supplier activity audit information||Users have access to real-time audit information|
|How long supplier audit data is stored for||At least 12 months|
|How long system logs are stored for||Less than 1 month|
Standards and certifications
|ISO/IEC 27001 certification||Yes|
|Who accredited the ISO/IEC 27001||British Standards Institute|
|ISO/IEC 27001 accreditation date||13/07/2015|
|What the ISO/IEC 27001 doesn’t cover||All aspects of our service are accredited.|
|ISO 28000:2007 certification||No|
|CSA STAR certification||No|
|Other security certifications||Yes|
|Any other security certifications||Certificate of Assurance from the Cyber Essentials Scheme|
|Named board-level person responsible for service security||Yes|
|Security governance certified||No|
|Security governance approach||
We operate our infrastructure exclusively in ISO27001:2013 certified data centres, and your service is provisioned and maintained by an ISO27001:2013 certified team.
Our service and software is fully compliant with HMG’s Cloud Security Principles, and aligned with CESG’s Good Practice Guides. We have built our service around the technical and policy controls that are suggested by these programmes. As such, our service can host information that is classified up to OFFICIAL under the UK Government Protective Marking Scheme.
We hold a Certificate of Assurance that testifies to our compliance with the requirements of the UK Government Cyber Essentials Scheme.
|Information security policies and processes||
The information Nimbox manages, in both electronic and hard copy, is appropriately secured to protect against the consequences of breaches of confidentiality, failures of integrity or interruptions to the availability of that information.
In deploying a robust Information Security Management System (ISMS), Nimbox aims to reduce the risk of incidents to an acceptable level.
Nimbox’s Information Security Officer has direct responsibility for maintaining Security Policy and providing advice and guidance on its implementation. It is the responsibility of all employees and 3rd Parties working within the scope of this Information Security Management System to comply with security policy at all times and report weakness or incidents that contravene or may contravene policy to the Information Security Officer.
All management are directly responsible for implementing security policy and supporting procedures within their business area, and for adherence by their staff.
|Configuration and change management standard||Supplier-defined controls|
|Configuration and change management approach||Nimbox follows a structured change control process that provides for the tracking of assets throughout their lifetime. Our change control process follows an industry-standard methodology of: 1, identifying a requirement for change; 2, defining an implementation plan; 3, raising a change request on our change application; 4, approval by a technical manager; 5, implementation of the change on a development environment; 6, testing of the change on that development environment; 7, implementation of the change on the production environment; 8, testing of the change on that production environment; 9, completing the change documentation, and post change report.|
|Vulnerability management type||Supplier-defined controls|
|Vulnerability management approach||We thoroughly investigate all reported security vulnerabilities, and aim to make this process as transparent as possible. Our security programme includes our platform, public web assets, and third party services (but only where the attack can exploit our customers directly). We aim to respond to all vulnerability reports within 24 hours. The Security Team reviews all reported vulnerabilities and takes steps to validate and reproduce them. Once the review is complete, and the vulnerability has been confirmed, the vulnerability will be fixed, and public disclosure arranged. You may read more about our vulnerability reporting programme here on our website, https://www.nimbox.co.uk/technology-security/#vulnerabilityreporting.|
|Protective monitoring type||Supplier-defined controls|
|Protective monitoring approach||
Nimbox's protective monitoring approach is compliant with HMG’s Cloud Security Principles and aligns with CESG’s Good Practice Guides.
We analyse service component heuristics for 'normal' baseline application behaviour, and notify system administrators on exception for analysis.
If we discover a breach of Customer Information, we shall inform our regulator (the Information Commissioner) within 72 hours of the discovery, and our Customers within 7 days. Notification to users may be sent via email, postal mail, or telephone.
|Incident management type||Supplier-defined controls|
|Incident management approach||
Nimbox's incident management approach is compliant with HMG’s Cloud Security Principles and aligns with CESG’s Good Practice Guides.
Our in-house monitoring system raises issue tickets via email with our servicedesk for incidents which require human review. Users and administrators are able to submit issues using our support ticket system as a unified process, and these incidents are responded to and escalated as needed by the support team, in writing within the system.
|Approach to secure software development best practice||Conforms to a recognised standard, but self-assessed|
Public sector networks
|Connection to public sector networks||No|
|Price||£10 to £30 per user per month|
|Discount for educational organisations||No|
|Free trial available||Yes|
|Description of free trial||We provide all customers with a 14 day free trial, which is fully-featured, and extendable on a case-by-case basis.|
|Link to free trial||https://www.nimbox.co.uk/pricing/#Trial|
|Pricing document||View uploaded document|
|Skills Framework for the Information Age rate card||View uploaded document|
|Service definition document||View uploaded document|
|Terms and conditions document||View uploaded document|