Ixis IT Limited

Dedicated Drupal Managed Cloud Hosting

A fully managed Drupal Acquia CMS hosting service covering the software stack operating systems, web servers and database. This solution is ideal for small to medium sized websites providing the room to grow and host multiple sites on a single dedicated server.


  • 99.95% uptime with a 30 min Response SLA
  • High Security Levels, ISO 27001 & Cyber Essentials Certified
  • Dedicated isolated environments not shared with any other clients
  • Production and Staging environments for each domain being hosted
  • Linux operating system management including security patching
  • Fully hosted and managed Git version control
  • Fully managed backup with minimum 2 week retention
  • Support beyond the LAMP stack: reverse proxy Varnish, MySQL replication
  • Amazon Web Services (AWS) Partner
  • 24/7 Support and Monitoring via our UK Service Desk


  • Single point of contact for all hosting requirements
  • Proactive performance troubleshooting and optimisation
  • 24/7 Uptime monitoring and reporting
  • Management of firewall, load balancer and related services
  • Drupal specific support over and above traditional hosting providers
  • Scalability to increase and decrease as required
  • Continual development and evergreening of the cloud hosting service


£6000 to £9000 per unit per year

  • Education pricing available

Service documents

G-Cloud 10


Ixis IT Limited

Dan Pala



Service scope

Service scope
Service constraints Linux based Open Source Applications (PHP, Node)
System requirements
  • Must run in a Linux based environment
  • Code will be managed in Git version control

User support

User support
Email or online ticketing support Email or online ticketing
Support response times Infrastructure support is provided 24/7

P1 Emergency - Acknowledge immediately - 30 Minute response time -
Restore service in 2 hours.

P2 High - Respond within 2 hours - Restore service / best efforts fix in 4 hours.

P3 Normal - Respond within 4 hours - Restore service in 2 normal working days.

P4 Low - Respond within 2 working days - Resolve to be discussed.

P5 Feature Request - To be discussed on calls.
User can manage status and priority of support tickets Yes
Online ticketing support accessibility None or don’t know
Phone support Yes
Phone support availability 24 hours, 7 days a week
Web chat support No
Onsite support No
Support levels Single support level from a dedicated cloud support engineers for support queries, on-boarding and any business changes requested.
Support available to third parties Yes

Onboarding and offboarding

Onboarding and offboarding
Getting started Fully managed service provided as standard.

Self Service online documentation is provided.
Service documentation Yes
Documentation formats
  • HTML
  • ODF
  • PDF
End-of-contract data extraction Data can be extracted and supplied to users in any way they prefer.
We are flexible to client requirements.
End-of-contract process We manage the transition to and from our service ensuring an uninterrupted experience.

There are no expected off-boarding costs to be incurred unless specific consultancy is required.

Off boarding is covered under support time.

Using the service

Using the service
Web browser interface Yes
Using the web interface Deployments to production and non-production environments via an optional self service web interface.

Management of the source code repository through an optional self service web interface.

Raise tickets by Service Desk for support and change requests.
Web interface accessibility standard None or don’t know
How the web interface is accessible Via a URL and Web browser
Web interface accessibility testing N/A
What users can and can't do using the API Our deployment system offers an API to allow you to view your deployments and create new ones.
API automation tools
  • Ansible
  • Chef
  • Puppet
  • Other
Other API automation tools Basic HTTP
API documentation Yes
API documentation formats HTML
Command line interface Yes
Command line interface compatibility
  • Linux or Unix
  • Windows
  • MacOS
Using the command line interface You'll need Ruby installed on your system to be able to use the deployment CLI.


Scaling available No
Independence of resources As part of our ISO 27001 no sharing of infrastructure or networking takes place unless agreed with the user (eg, hosting of multiple web services on the same server). This prevents the actions of users from impacting another service.
Usage notifications Yes
Usage reporting
  • Email
  • Other


Infrastructure or application metrics Yes
Metrics types
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
Reporting types
  • Real-time dashboards
  • Reports on request


Supplier type Reseller providing extra features and support
Organisation whose services are being resold Amazon Web Services

Staff security

Staff security
Staff security clearance Other security clearance
Government security clearance Up to Developed Vetting (DV)

Asset protection

Asset protection
Knowledge of data storage and processing locations Yes
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
User control over data storage and processing locations Yes
Datacentre security standards Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency At least every 6 months
Penetration testing approach In-house
Protecting data at rest
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
Data sanitisation process Yes
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
  • Hardware containing data is completely destroyed
Equipment disposal approach Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

Backup and recovery
Backup and recovery Yes
What’s backed up
  • Virtual machine
  • Database
  • File assets
Backup controls The service is fully managed by the supplier.
Datacentre setup
  • Multiple datacentres with disaster recovery
  • Multiple datacentres
Scheduling backups Supplier controls the whole backup schedule
Backup recovery Users contact the support team

Data-in-transit protection

Data-in-transit protection
Data protection between buyer and supplier networks TLS (version 1.2 or above)
Data protection within supplier network TLS (version 1.2 or above)

Availability and resilience

Availability and resilience
Guaranteed availability 99.5% uptime SLA on Standard Dedicated Server
24/7 Support and Monitoring via our UK Service Desk
Dedicated isolated environments not shared with any other clients
Production and Staging environments for each domain being hosted
Linux operating system management including security patching
Fully hosted and managed GIT version control
Fully hosted and managed GIT version control
Fully managed backup with minimum 2 week retention
Support beyond the LAMP stack: reverse proxy Varnish, MySQL replication
Amazon Web Services (AWS) Consulting Partner

On a case by case basis we can offer service credits which are discussed as part of the contract process
Approach to resilience Datacentre contingency plans and incident response playbooks are maintained and updated to reflect emerging continuity risks and lessons learned from past incidents. Plans are tested and updated through the due course of business (at least monthly) and the Resiliency plan is reviewed and approved by senior leadership annually. Services are continuously monitored.

The datacentre operator continuously monitors service usage to project infrastructure needs to support availability commitments and requirements. They maintain a capacity planning model to assess infrastructure usage and demands at least monthly, and usually more frequently (e.g., weekly). In addition, the capacity planning model supports the planning of future demands to acquire and implement additional resources based upon current resources and forecasted requirements.

The service itself (the "stack", running on the infrastructure) is designed to be as resilient and self-healing as possible, with continuous monitoring of running services and automated systems to attempt recovery and mitigation in the event of software error.
Outage reporting Incidents (high error rates, unusual resource usage, etc) and outages (service failure, web site unavailable, etc) are reported directly to responsible parties via e-mail and/or pager system, as well as being reported to our internal chat system where teams can coordinate and resolve issues.

An API and public/private dashboard is available upon request.

Identity and authentication

Identity and authentication
User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Dedicated link (for example VPN)
  • Username or password
Access restrictions in management interfaces and support channels A username and password pair and 2FA is required to access the deployment system.

An SSH publickey is required to associate with a username and password pair for Git code access.
Access restriction testing frequency At least once a year
Management access authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Dedicated link (for example VPN)
  • Username or password
Devices users manage the service through Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

Audit information for users
Access to user activity audit information Users contact the support team to get audit information
How long user audit data is stored for Between 1 month and 6 months
Access to supplier activity audit information Users contact the support team to get audit information
How long supplier audit data is stored for Between 1 month and 6 months
How long system logs are stored for Between 1 month and 6 months

Standards and certifications

Standards and certifications
ISO/IEC 27001 certification Yes
Who accredited the ISO/IEC 27001 Alcumus ISOQAR
ISO/IEC 27001 accreditation date 27/04/2018
What the ISO/IEC 27001 doesn’t cover Working in secure areas (11.1.5)
ISO 28000:2007 certification No
CSA STAR certification Yes
CSA STAR accreditation date 01/01/2017
CSA STAR certification level Level 2: CSA STAR Attestation
What the CSA STAR doesn’t cover N/A
PCI certification Yes
Who accredited the PCI DSS certification Coal Fire Systems Inc
PCI DSS accreditation date 25/01/2018
What the PCI DSS doesn’t cover N/A
Other security certifications Yes
Any other security certifications Cyber Essentials

Security governance

Security governance
Named board-level person responsible for service security Yes
Security governance certified Yes
Security governance standards ISO/IEC 27001
Information security policies and processes We are certified against the ISO 27001: 2013 and have an established Integrated Management System (IMS) that sets out our procedures and policies to ensure that we adhere to the standard at all times. We are also aware of and adhere to our obligations concerning the Data Protection Act, and GDPR, which is also governed within the IMS.

Operational security

Operational security
Configuration and change management standard Supplier-defined controls
Configuration and change management approach Our service desk is ITIL certified, and we follow the processes and guidelines laid out by this framework to manage the service and all changes. Changes are assessed for their impact and risk, and a process of continual identification, monitoring and review of the levels of IT services specified in the SLA ensure that quality is maintained. All changes are implemented through a version-controlled configuration management system and progress through a series of automated and manual testing steps before being applied to the 'live' infrastructure. This systematic approach ensures that changes to services are reviewed, tested, approved and communicated.
Vulnerability management type Supplier-defined controls
Vulnerability management approach The vulnerability management sub-principle and related processes within the datacentre and cloud services are subject to audit at least annually under ISO 27001:2013, AICPA SOC 1, SOC 2, SOC 3 and PCI-DSS certification programs. These certifications are recognised by ENISA under the Cloud Certification Schemes.

The "stack" (operating system, software, and applications) receives automated security patching for all software directly from the OS maintainers, with security patches applied as soon as they are available and have been tested on pre-production environments. Alerts and newsletters are available from the maintainer, and staff monitor a number of respected advisory services for news.
Protective monitoring type Supplier-defined controls
Protective monitoring approach Systems within the datacentre are extensively instrumented to monitor key operational and security metrics. Alarms are configured to automatically notify operations and management personnel when early warning thresholds are crossed on key metrics. When a threshold is crossed, the incident response process is initiated. The Incident Response team employs industry-standard diagnostic procedures to drive resolution during business-impacting events.

Security monitoring tools help identify several types of denial of service
(DoS) attacks, including distributed, flooding, and software/logic attacks. When DoS attacks are identified, the incident response process is initiated. In addition to the DoS prevention tools, redundant network capacity is available.
Incident management type Supplier-defined controls
Incident management approach Policies exist that describe our response process for common events, with coordination and escalation available for non-standard incidents. Users report incidents through our ITIL service desk, and are kept updated with the progress and state of the incident throughout the event. Full incident reports are provided in the event of serious incidents (for example, extended outages or security events).

Secure development

Secure development
Approach to secure software development best practice Supplier-defined process

Separation between users

Separation between users
Virtualisation technology used to keep applications and users sharing the same infrastructure apart Yes
Who implements virtualisation Supplier
Virtualisation technologies used Other
Other virtualisation technology used Xen hypervisor
How shared infrastructure is kept separate Customer instances have no access to raw disk devices, but instead are presented with virtualized disks. The disk virtualization layer automatically erases every block of storage before making it available for use, which protects one customer’s data from being unintentionally exposed to another. Encryption is supported.

A mandatory firewall is enabled in a default deny-all mode and ports must be explicitly opened to allow inbound traffic. Each client is hosted within an isolated Virtual Private Cloud, preventing network connections from any other systems. "Sniffing" of network traffic is prevented at the hypervisor and interface level.

Energy efficiency

Energy efficiency
Energy-efficient datacentres No


Price £6000 to £9000 per unit per year
Discount for educational organisations Yes
Free trial available No


Pricing document View uploaded document
Terms and conditions document View uploaded document
Return to top ↑