Software232 Limited

Cloud Software Development

Software232 can provide custom Cloud System development, support for the whole development lifecycle. Ongoing support can also be provided once the project has ended and the support period starts.


  • Functional and Non Functional Requirements development
  • Architectural analysis of the existing landscape to identify potential reuse
  • Perform an assessment and evaluation of the potential solution options
  • Specify the advantages and disadvantages of each opti
  • Develop a roadmap for the recommended option
  • Work with the client to agree a recommended solution
  • Develop the Solution Definition Document across all core domains


  • Efficient, trusted and lean approach used by over 20 companies
  • USP is ability to establish self funded benefit led opportunities
  • Independently informed as to options assessing pros and cons
  • Support the Solution Definition through a structured method and approach
  • Experts at enterprise, domain and cloud solution architecture
  • Certified TOGAF professional services provider and contributor


£500 to £1500 per person per day

  • Free trial available

Service documents

G-Cloud 11


Software232 Limited

Vinay Patel


Service scope

Service scope
Service constraints No concerns specifically.
System requirements
  • Cloud Effeciency
  • Technology enabling us to work with the cloud
  • Security Standards If possible

User support

User support
Email or online ticketing support Email or online ticketing
Support response times We provide support dependant on the SLA's negotiated at the time of contract.
User can manage status and priority of support tickets Yes
Online ticketing support accessibility WCAG 2.1 AAA
Phone support Yes
Phone support availability 24 hours, 7 days a week
Web chat support No
Onsite support Yes, at extra cost
Support levels We would provide a technical account manager if required with a support team in place which would include engineers, scrum masters, technology all the way to PMO if required.
Support available to third parties No

Onboarding and offboarding

Onboarding and offboarding
Getting started We do provide onsite training and online training currently with supporting documentation.
Service documentation Yes
Documentation formats
  • PDF
  • Other
Other documentation formats Word Format
End-of-contract data extraction User can extract all of their data via xml or json format.
End-of-contract process Included in the price is time and material consultancy and additional cost if bespoke development time that is factored in at the time of contract negotiation.

Using the service

Using the service
Web browser interface Yes
Using the web interface The users can use the web interface with limited levels of training.

They can make simple edits to the interface without affecting the core business processes.

The changes in some instances may need to go through an approval process.
Web interface accessibility standard WCAG 2.1 AAA
Web interface accessibility testing We have run automated testing in a devOps environment using Selenium to test for this.
What users can and can't do using the API The API can allows developers to develop custom code against the products.

Also external products can have read/write access to data (once secured) to enhance the application.
API automation tools
  • Ansible
  • Chef
  • SaltStack
  • Terraform
  • Puppet
  • Other
Other API automation tools
  • Docker
  • Kubernetes
  • Ansible
  • Chef
  • Selenium
API documentation Yes
API documentation formats
  • PDF
  • Other
Command line interface No


Scaling available Yes
Scaling type Automatic
Independence of resources We use DevOps automation techniques in the cloud which use clever AI to understand when to scale on demand. This can be demonstrated or discussed.
Usage notifications Yes
Usage reporting Email


Infrastructure or application metrics Yes
Metrics types
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
Reporting types
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request


Supplier type Not a reseller

Staff security

Staff security
Staff security clearance Conforms to BS7858:2012
Government security clearance Up to Developed Vetting (DV)

Asset protection

Asset protection
Knowledge of data storage and processing locations Yes
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
  • EU-US Privacy Shield agreement locations
User control over data storage and processing locations Yes
Datacentre security standards Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency At least every 6 months
Penetration testing approach Another external penetration testing organisation
Protecting data at rest
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
Data sanitisation process Yes
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
Equipment disposal approach A third-party destruction service

Backup and recovery

Backup and recovery
Backup and recovery Yes
What’s backed up
  • Virtual Machine
  • Databases
  • Content Management Systems
  • Containers
  • Code
Backup controls Data is backed up asynchronously every 24 hours.
Datacentre setup
  • Multiple datacentres with disaster recovery
  • Multiple datacentres
Scheduling backups Supplier controls the whole backup schedule
Backup recovery Users contact the support team

Data-in-transit protection

Data-in-transit protection
Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Bonded fibre optic connections
  • Legacy SSL and TLS (under version 1.2)
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)

Availability and resilience

Availability and resilience
Guaranteed availability We guarantee availability of any applications and services. However, we can discuss how refunds will be made should any unplanned downtime occur.
Approach to resilience Available on request
Outage reporting A private dashboard currently which requires a login and email alert to subscribers (authorised)

Identity and authentication

Identity and authentication
User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
Access restrictions in management interfaces and support channels We restrict access via username and password login only that must also be linked to any support accounts within a cloud hosted AD environment.
Access restriction testing frequency At least every 6 months
Management access authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
Devices users manage the service through
  • Dedicated device on a segregated network (providers own provision)
  • Dedicated device on a government network (for example PSN)
  • Dedicated device over multiple services or networks
  • Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)
  • Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

Audit information for users
Access to user activity audit information Users contact the support team to get audit information
How long user audit data is stored for At least 12 months
Access to supplier activity audit information Users receive audit information on a regular basis
How long supplier audit data is stored for At least 12 months
How long system logs are stored for At least 12 months

Standards and certifications

Standards and certifications
ISO/IEC 27001 certification No
ISO 28000:2007 certification No
CSA STAR certification No
PCI certification No
Other security certifications No

Security governance

Security governance
Named board-level person responsible for service security Yes
Security governance certified Yes
Security governance standards ISO/IEC 27001
Information security policies and processes We can discuss security policies, however, can upload them to public cloud space.

Operational security

Operational security
Configuration and change management standard Supplier-defined controls
Configuration and change management approach We currently have a gated process for components of our services and security impact is assessed on an automated and manual basis.
Vulnerability management type Supplier-defined controls
Vulnerability management approach We work in the cloud environment therefore patching is handled by the cloud provider and threat detection is managed by the supplier and the automation service that we have deployed and business processes adopted.
Protective monitoring type Supplier-defined controls
Protective monitoring approach We identify any potential via a reporting portal and will respond to any incident within an SLA of 1 day.
Incident management type Supplier-defined controls
Incident management approach We use JIRA to manage our incident management processes with current clients and work with their business process.

Secure development

Secure development
Approach to secure software development best practice Conforms to a recognised standard, but self-assessed

Separation between users

Separation between users
Virtualisation technology used to keep applications and users sharing the same infrastructure apart Yes
Who implements virtualisation Third-party
Third-party virtualisation provider Azure or AWS
How shared infrastructure is kept separate We can discuss this when the project requirements are discussing however currently a variety of techniques are using including VPN to VPN private tunnels, secured api's and database sharing techniques.

Energy efficiency

Energy efficiency
Energy-efficient datacentres Yes
Description of energy efficient datacentres We ask Microsoft and AWS


Price £500 to £1500 per person per day
Discount for educational organisations No
Free trial available Yes
Description of free trial The free trial can last one week.

Service documents

pdf document: Pricing document pdf document: Service definition document pdf document: Terms and conditions
Service documents
Return to top ↑