Software232 Limited

Cloud Software Development

Software232 can provide custom Cloud System development, support for the whole development lifecycle. Ongoing support can also be provided once the project has ended and the support period starts.

Features

  • Functional and Non Functional Requirements development
  • Architectural analysis of the existing landscape to identify potential reuse
  • Perform an assessment and evaluation of the potential solution options
  • Specify the advantages and disadvantages of each opti
  • Develop a roadmap for the recommended option
  • Work with the client to agree a recommended solution
  • Develop the Solution Definition Document across all core domains

Benefits

  • Efficient, trusted and lean approach used by over 20 companies
  • USP is ability to establish self funded benefit led opportunities
  • Independently informed as to options assessing pros and cons
  • Support the Solution Definition through a structured method and approach
  • Experts at enterprise, domain and cloud solution architecture
  • Certified TOGAF professional services provider and contributor

Pricing

£500 to £1500 per person per day

  • Free trial available

Service documents

Framework

G-Cloud 11

Service ID

5 7 6 9 1 4 7 4 8 7 9 7 3 4 6

Contact

Software232 Limited

Vinay Patel

07429901298

vinay@software232.com

Service scope

Service constraints
No concerns specifically.
System requirements
  • Cloud Effeciency
  • Technology enabling us to work with the cloud
  • Security Standards If possible

User support

Email or online ticketing support
Email or online ticketing
Support response times
We provide support dependant on the SLA's negotiated at the time of contract.
User can manage status and priority of support tickets
Yes
Online ticketing support accessibility
WCAG 2.1 AAA
Phone support
Yes
Phone support availability
24 hours, 7 days a week
Web chat support
No
Onsite support
Yes, at extra cost
Support levels
We would provide a technical account manager if required with a support team in place which would include engineers, scrum masters, technology all the way to PMO if required.
Support available to third parties
No

Onboarding and offboarding

Getting started
We do provide onsite training and online training currently with supporting documentation.
Service documentation
Yes
Documentation formats
  • PDF
  • Other
Other documentation formats
Word Format
End-of-contract data extraction
User can extract all of their data via xml or json format.
End-of-contract process
Included in the price is time and material consultancy and additional cost if bespoke development time that is factored in at the time of contract negotiation.

Using the service

Web browser interface
Yes
Using the web interface
The users can use the web interface with limited levels of training.

They can make simple edits to the interface without affecting the core business processes.

The changes in some instances may need to go through an approval process.
Web interface accessibility standard
WCAG 2.1 AAA
Web interface accessibility testing
We have run automated testing in a devOps environment using Selenium to test for this.
API
Yes
What users can and can't do using the API
The API can allows developers to develop custom code against the products.

Also external products can have read/write access to data (once secured) to enhance the application.
API automation tools
  • Ansible
  • Chef
  • SaltStack
  • Terraform
  • Puppet
  • Other
Other API automation tools
  • Docker
  • Kubernetes
  • Ansible
  • Chef
  • Selenium
API documentation
Yes
API documentation formats
  • PDF
  • Other
Command line interface
No

Scaling

Scaling available
Yes
Scaling type
Automatic
Independence of resources
We use DevOps automation techniques in the cloud which use clever AI to understand when to scale on demand. This can be demonstrated or discussed.
Usage notifications
Yes
Usage reporting
Email

Analytics

Infrastructure or application metrics
Yes
Metrics types
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
Reporting types
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

Supplier type
Not a reseller

Staff security

Staff security clearance
Conforms to BS7858:2012
Government security clearance
Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
  • EU-US Privacy Shield agreement locations
User control over data storage and processing locations
Yes
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least every 6 months
Penetration testing approach
Another external penetration testing organisation
Protecting data at rest
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
Data sanitisation process
Yes
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
Equipment disposal approach
A third-party destruction service

Backup and recovery

Backup and recovery
Yes
What’s backed up
  • Virtual Machine
  • Databases
  • Content Management Systems
  • Containers
  • Code
Backup controls
Data is backed up asynchronously every 24 hours.
Datacentre setup
  • Multiple datacentres with disaster recovery
  • Multiple datacentres
Scheduling backups
Supplier controls the whole backup schedule
Backup recovery
Users contact the support team

Data-in-transit protection

Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Bonded fibre optic connections
  • Legacy SSL and TLS (under version 1.2)
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)

Availability and resilience

Guaranteed availability
We guarantee availability of any applications and services. However, we can discuss how refunds will be made should any unplanned downtime occur.
Approach to resilience
Available on request
Outage reporting
A private dashboard currently which requires a login and email alert to subscribers (authorised)

Identity and authentication

User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
Access restrictions in management interfaces and support channels
We restrict access via username and password login only that must also be linked to any support accounts within a cloud hosted AD environment.
Access restriction testing frequency
At least every 6 months
Management access authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
Devices users manage the service through
  • Dedicated device on a segregated network (providers own provision)
  • Dedicated device on a government network (for example PSN)
  • Dedicated device over multiple services or networks
  • Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)
  • Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

Access to user activity audit information
Users contact the support team to get audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users receive audit information on a regular basis
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
At least 12 months

Standards and certifications

ISO/IEC 27001 certification
No
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Other security certifications
No

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
ISO/IEC 27001
Information security policies and processes
We can discuss security policies, however, can upload them to public cloud space.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
We currently have a gated process for components of our services and security impact is assessed on an automated and manual basis.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
We work in the cloud environment therefore patching is handled by the cloud provider and threat detection is managed by the supplier and the automation service that we have deployed and business processes adopted.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
We identify any potential via a reporting portal and will respond to any incident within an SLA of 1 day.
Incident management type
Supplier-defined controls
Incident management approach
We use JIRA to manage our incident management processes with current clients and work with their business process.

Secure development

Approach to secure software development best practice
Conforms to a recognised standard, but self-assessed

Separation between users

Virtualisation technology used to keep applications and users sharing the same infrastructure apart
Yes
Who implements virtualisation
Third-party
Third-party virtualisation provider
Azure or AWS
How shared infrastructure is kept separate
We can discuss this when the project requirements are discussing however currently a variety of techniques are using including VPN to VPN private tunnels, secured api's and database sharing techniques.

Energy efficiency

Energy-efficient datacentres
Yes
Description of energy efficient datacentres
We ask Microsoft and AWS

Pricing

Price
£500 to £1500 per person per day
Discount for educational organisations
No
Free trial available
Yes
Description of free trial
The free trial can last one week.

Service documents

Return to top ↑