MuleSoft Inc.

MuleSoft Anypoint Platform (Public Cloud)

MuleSoft’s Anypoint Platform™ is a leading solution for API-led connectivity that creates an application network of apps, data, and devices, both on-premises and in the cloud. This hybrid integration platform includes iPaaS, ESB, and a unified solution for API management, design and publishing.

Features

  • Connectivity to over 120 leading SaaS and on-premise applications
  • Operational control from a central web based portal
  • High availability. Ensures zero message loss reliability
  • Graphical integration custom code out of data mapping and transformation.
  • Hardened with thousands of automated tests and bug fixes
  • API Management and Analytics
  • EDI/B2B Integration
  • Batch Integration
  • Real time integration
  • Premium Connectors for SAP, Oracle, Epic, HL7

Benefits

  • Re-architect SOA infrastructure from legacy systems to create business agility.
  • Hybrid environment, connecting SaaS and on premise systems seamlessly
  • Create a seamless Application Network of apps, data & devices
  • Unified connectivity, design, run, analyse on a single platform
  • Lowest Friction, compose not code with reusable building blocks
  • Future Proof, Anypoints' flexibility evolves as you do
  • Quickly design, build & manage the entire API lifecycle
  • Promote reusability, modularity & collaboration, increasing developer productivity & speed
  • A platform for speed, innovation & growth

Pricing

£71029 per unit per year

Service documents

G-Cloud 9

321844732414731

MuleSoft Inc.

Simon Goddard

+44 207 593 3490

G-Cloud@mulesoft.com

Service scope

Service scope
Service constraints MuleSoft will use commercially reasonable efforts to make the Cloud Offerings available 24 hours a day, 7 days a week, except for: (a) scheduled downtime of the management console (b) any unavailability caused by Force Majeure.

You can read full details at: https://www.mulesoft.com/legal/support-maintenance-terms
System requirements
  • MuleSoft has no specific requirements
  • If state persisted, customer responsible for prerequisites and licenses

User support

User support
Email or online ticketing support Email or online ticketing
Support response times There are two levels of support:

GOLD: 1 Business Day.

PLATINUM:

Response times are defined by the severity of the issue being reported.
S1 - 2 hours;
S2 - 4 Business Hours;
S3-S4 - 8 Business Hours. Full details and definitions can be found here: https://www.mulesoft.com/legal/support-maintenance-terms
User can manage status and priority of support tickets No
Phone support Yes
Phone support availability 24 hours, 7 days a week
Web chat support No
Onsite support No
Support levels MuleSoft support is staffed by expert developers and support issues will be escalated to core Mule developers if that is required.

Two levels of support offered, Gold and Platinum.

Gold provides UK office hours support, 8x5 and twenty support incidents.

Platinum provides 24x7 support and includes unlimited incidents.

MuleSoft also has a customer success organisation that provides advice and best practice as part of a customers subscription. Our Customer Success team and customers work to mutually agreed goals to ensure success with MuleSoft. Equally they may organise the correct resources within MuleSoft be that cloud infrastructure, Infosec, engineering or cloud operations as examples when customers have support issues that require additional focus.

MuleSoft licensing is a subscription, support is not a separate charge it is included in the chosen subscription type.
Support available to third parties Yes

Onboarding and offboarding

Onboarding and offboarding
Getting started The MuleSoft customer success organisation will provide a welcome pack and onboarding guide, our services team will provide roles-based training and professional services engagements to ensure customer has the tools and knowledge to drive their business outcomes.
Service documentation Yes
Documentation formats HTML
End-of-contract data extraction Depending on the specific nature of the implementation of the user's application, there may be work required to migrate data away from MuleSoft to other integration platforms. MuleSoft will work with users on a case-by-case basis to put an exit plan into effect.
End-of-contract process At the end of the contracted period the license will expire and there will be no further access to the service. There is nothing further in the contract that commits MuleSoft to any work to support or assist with off boarding. MuleSoft's Professional Services would be willing to work with you to assist with off boarding should that be necessary at your cost.

Using the service

Using the service
Web browser interface Yes
Using the web interface Anypoint Platform is the primary user interface for both the management and design capabilities of our CloudHub and Mule runtimes when deployed in private clouds or on premise. The main areas are listed below:

Anypoint Design Center:
Design and test APIs, implement data and application integration flows.
Anypoint Management Center:
Administer all aspects of Anypoint Platform on-premise and in the cloud. Manage API users, analyse traffic, monitor SLAs, troubleshoot underlying integration flows.
Anypoint Exchange:
Complete listing of connectors, templates, examples and APIs. Vital to enabling reuse along with developer portals that can be generated and then customised from API designs.
Web interface accessibility standard None or don’t know
How the web interface is accessible N/A
Web interface accessibility testing MuleSoft strives toward developing accessible technologies that can be leveraged by all users, including people with disabilities. For a detailed assessment of how products support those with accessibility needs refer to https://www.mulesoft.com/accessibility
API Yes
What users can and can't do using the API The CloudHub REST API provides access to most operations you can perform with the management user interface. You can:

Create an application on CloudHub;

Change the application properties, including, worker numbers and environment variables;

Deploy a new version of your application;

Delete your application;

Get statistics about your application;

Create CloudHub notifications;

Create email alerts triggered by your applications.
API automation tools
  • Ansible
  • Chef
  • SaltStack
  • Puppet
  • Other
Other API automation tools
  • Maven
  • Jenkins
  • Git/GitHub
API documentation Yes
API documentation formats
  • HTML
  • Other
Command line interface Yes
Command line interface compatibility
  • Linux or Unix
  • Windows
  • MacOS
  • Other
Using the command line interface Anypoint Platform provides you a command line tool to interact with:

Your applications on CloudHub, when deployed on-premise or on private clouds.

Cloudhub load balancers

API Manager (Except Analytics)

Runtime Manager - Application management and log access.

Through both interactive shell and standard CLI modes for both our CloudHub and runtimes deployed on-premise.

The installation requires node.js.

Where the Mule runtime is deployed anywhere other than CloudHub the following restrictions apply:

You can not:
Remove server from disk;
Automatically add a new server.

You can:
Access the credentials to add new servers;
Delete your server from the management interface;
Get statistics about your application;
Create CloudHub notifications;
Create email alerts triggered by your applications.

Scaling

Scaling
Scaling available Yes
Scaling type Manual
Independence of resources Applications are run by one or more instances of Mule, called workers. These workers have:

Capacity: Each worker has a specific amount of capacity to process data, customers select when deploying.

Isolation: Each worker runs in a separate container from every other application.

Manageability: Each worker is deployed and monitored independently by our cloud infrastructure.

Each worker is a dedicated instance of Mule that runs your integration application. Further customers are logically segregated from other customers and they are guaranteed resource allocation. MuleSoft's Director of Cloud Operations is responsible for monitoring the use of assets and for planning required capacity.
Usage notifications Yes
Usage reporting
  • API
  • Email
  • Other

Analytics

Analytics
Infrastructure or application metrics Yes
Metrics types
  • CPU
  • HTTP request and response status
  • Memory
  • Number of active instances
  • Other
Other metrics
  • Configurable alerts
  • Business Insights
  • Cloud worker status
  • API Analytics
  • Logs
  • Application Data (if configured)
  • Queues (Anypoint MQ)
  • Schedules
  • Deployment settings
Reporting types
  • API access
  • Real-time dashboards
  • Reports on request

Resellers

Resellers
Supplier type Not a reseller

Staff security

Staff security
Staff security clearance Other security clearance
Government security clearance Up to Security Clearance (SC)

Asset protection

Asset protection
Knowledge of data storage and processing locations Yes
Data storage and processing locations
  • European Economic Area (EEA)
  • Other locations
User control over data storage and processing locations Yes
Datacentre security standards Managed by a third party
Penetration testing frequency At least once a year
Penetration testing approach Another external penetration testing organisation
Protecting data at rest Other
Other data at rest protection approach MuleSoft runtimes are designed to be stateless. Where customers choose to save application data in databases or object stores the features of our Enterprise Security are often used:
• Secure Token Service Oauth 2.0 Provider
• Credentials Vault
• Message Encryption Processor
• Digital Signature Processor
• Mule Filter Processor
• Mule CRC32 Processor
MuleSoft is highly extensible, you can augment with your own implementations.
MuleSoft does not save customer data. The customer Mule developer could provide a method to temporarily cache customer data, but all data is transient and no data is stored persistently.
Data sanitisation process Yes
Data sanitisation type Deleted data can’t be directly accessed
Equipment disposal approach In-house destruction process

Backup and recovery

Backup and recovery
Backup and recovery Yes
What’s backed up Environment backups are controlled by MuleSoft less application data
Backup controls Environment backups for CloudHub are controlled by MuleSoft. Anypoint Platform is designed to be stateless. Stateful application data can be persisted in databases or object stores for example and customers are responsible for that data. MuleSoft does not backup customer data. Where applications are deployed to runtimes anywhere other than CloudHub the customer takes on responsibility for backup and recovery of those runtimes.
Datacentre setup Multiple datacentres with disaster recovery
Scheduling backups Supplier controls the whole backup schedule
Backup recovery Users contact the support team

Data-in-transit protection

Data-in-transit protection
Data protection between buyer and supplier networks
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
  • Other
Other protection between networks VPC's and VPN's can be used to isolate and protect networks. A VPC increases the isolation of your Mule runtimes while the VPN is used for securing the network connection.

Anypoint Enterprise Security is a collection of security features that enforces secure access to information in Mule applications.

These security features provide security to Service-Oriented Architecture implementations and Web services. The following bridge gaps between trust boundaries in applications:

Secure Token Service Oauth 2.0 Provider
Credentials Vault
Message Encryption Processor
Digital Signature Processor
Mule Filter Processor
Mule CRC32 Processor.
Data protection within supplier network
  • TLS (version 1.2 or above)
  • Legacy SSL and TLS (under version 1.2)
  • Other
Other protection within supplier network Anypoint Enterprise Security is a collection of security features that enforces secure access to information in Mule applications.

These security features provide security to Service-Oriented Architecture implementations and Web services. The following bridge gaps between trust boundaries in applications:

Secure Token Service Oauth 2.0 Provider;
Credentials Vault;
Message Encryption Processor;
Digital Signature Processor;
Mule Filter Processor;
Mule CRC32 Processor.

Availability and resilience

Availability and resilience
Guaranteed availability CloudHub builds upon the capabilities provided by AWS to deliver 99.99% availability each calendar month.

CloudHub is designed to be highly available and scalable through redundancy, intelligent healing, and zero downtime updates.

CloudHub services have at least one layer of redundancy; are available in multiple data centres, monitors workers and self-heals from problems.

See https://www.mulesoft.com/legal/support-maintenance-terms, which discusses MuleSoft performance commitments. The customers can view the live status and detailed service history for the Runtime Manager console, CloudHub platform services, and the CloudHub worker cloud on status.mulesoft.com.
Approach to resilience Available on request.

See https://www.mulesoft.com/legal/support-maintenance-terms, which discusses MuleSoft performance commitments. The customers can view the live status and detailed service history for the Runtime Manager console, CloudHub platform services, and the CloudHub worker cloud on status.mulesoft.com.
Outage reporting There is a status portal where users can review the current systems status and optionally subscribe for email or SMS. An ATOM or RSS feed is also provided.

Identity and authentication

Identity and authentication
User authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google apps)
  • Dedicated link (for example VPN)
  • Username or password
  • Other
Other user authentication There are several common authentication protocols that APIs generally use. In most cases, you can implement at least one authentication method in your Anypoint Connector.

Below are the choices:
Basic Authentication;
OAuth 1.0 & 2.0;
HTTP Basic Authentication;
SAML;
Kerberos;
NTLM;
LDAP.

Connector Developer Kit Authentication Methods:

Basic Authentication;
OAuth 1.0;
OAuth 2.0;
HTTP Basic Authentication;
SAML;
Kerberos;
NTLM;
LDAP.
Access restrictions in management interfaces and support channels Our IT infrastructure and production environment are separated. Only MuleSoft support and MuleSoft devops has access to the production environment. DevOps has access to production because they build and maintain the cloud environments. Support has access in order to help customers solve issues. Support has a process in which the customer has to provide permission for support to access a customer’s worker. It is important to note that all access is audited and monitored, and customer data is not persisted on systems.
Access restriction testing frequency At least every 6 months
Management access authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
Devices users manage the service through Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)

Audit information for users

Audit information for users
Access to user activity audit information Users have access to real-time audit information
How long user audit data is stored for Between 6 months and 12 months
Access to supplier activity audit information Users have access to real-time audit information
How long supplier audit data is stored for Between 6 months and 12 months
How long system logs are stored for Between 6 months and 12 months

Standards and certifications

Standards and certifications
ISO/IEC 27001 certification Yes
Who accredited the ISO/IEC 27001 A-lign
ISO/IEC 27001 accreditation date 05/10/2016
What the ISO/IEC 27001 doesn’t cover MuleSoft's Statement of Applicability is available for customer review under NDA. If there are additional questions about our ISO 27001 certification, please schedule a call with MuleSoft Information Security.
ISO 28000:2007 certification No
CSA STAR certification No
PCI certification Yes
Who accredited the PCI DSS certification A-lign
PCI DSS accreditation date 26/10/2016
What the PCI DSS doesn’t cover Our PCI report is available for customer review under NDA. If you have an additional questions, please schedule a call with MuleSoft Information Security.
Other security accreditations Yes
Any other security accreditations MuleSoft is assessed for SOC 2 annually

Security governance

Security governance
Named board-level person responsible for service security Yes
Security governance accreditation Yes
Security governance standards ISO/IEC 27001
Information security policies and processes The Information Security Management System was built and certified in accordance with ISO 27001. We have policies and processes to address all associated items.

Information Security is run by the Head of Information Security and Compliance whom reports to the MuleSoft CTO. The Information Security team uses a mix of preventive, detective and corrective security controls in an effort to prevent or encourage the prevention of security issues, but also there a measures in place to detect violations and respond to them.

Operational security

Operational security
Configuration and change management standard Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach Each change to operational or production systems must be made in the following way: (1) change may be proposed by any service or engineering function, (2) change must be authorized and assigned by the Director of Cloud Operations, who must assess its justification and potential negative security impacts, (3) emergency changes must be approved by Director, (4) changes must be implemented by Cloud Operations Team, (5) Director is responsible for checking that the change has been implemented, (6) The Director is responsible for testing and verifying the system's stability, and (7) implementation of changes must be reported.
Vulnerability management type Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach MuleSoft remediates critical vulnerabilities in 30 days, and remediates highs and medium within 90 days. The information security department evaluates vulnerabilities, and we have a JIRA system to track vulnerabilities and remediation.
Protective monitoring type Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach MuleSoft uses a number of different methods to monitor threats. Our environment is continuously monitored. All security related logs for all systems in the MuleSoft environment must be configured so that they are turned on, available for at least 3 months online, and 1 year offline. Logs are centralized and shipped off to a MSS, which admins cannot modify. Logs are collated and continuously analyzed. MuleSoft is alerted as necessary. Threat Stack to perform Host Based IDS, and File Integrity Monitoring. We regularly monitor external security advisory lists, such as CERT, FD, Bugtraq and SANS.
Incident management type Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach MuleSoft has an Incident Response Plan that has been approved by management. There is an 8 step process for handling incidents. MuleSoft's Incident Response Policy / Plan is available for customer review under NDA. The general guidance is: (1) Get the Facts and Don't Panic, (2) Establish the Source of Notification, (3) – Understand what Happened, (4) Validate the Incident, (5) Contain and Correct the Problem (6) Eradicate the Threat and Restore Operational Status, (7) Investigate, and (8) Plan for the Future (“Lessons Learned”)

Secure development

Secure development
Approach to secure software development best practice Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Separation between users

Separation between users
Virtualisation technology used to keep applications and users sharing the same infrastructure apart Yes
Who implements virtualisation Third-party
Third-party virtualisation provider Amazon Web Services (AWS)
How shared infrastructure is kept separate Separation of customer runtimes and applications are controlled through VPCs. Each customer is logically contained in a separate VPC running on separate systems with a firewall that controls access specific to each customer VPC.

Energy efficiency

Energy efficiency
Energy-efficient datacentres Yes

Pricing

Pricing
Price £71029 per unit per year
Discount for educational organisations No
Free trial available Yes
Description of free trial A thirty day fully functional trial is available.

Including:
API Designer;
API Manager;
API Analytics ;
Runtime Manager;
Anypoint Exchange: Access connectors, templates, examples and best practices;
Anypoint Studio: Our development tool.
Link to free trial https://www.mulesoft.com/platform/enterprise-integration

Documents

Documents
Pricing document View uploaded document
Skills Framework for the Information Age rate card View uploaded document
Service definition document View uploaded document
Terms and conditions document View uploaded document
Return to top ↑