Castle Computer Services Ltd

Sunsystems Finance & Accounting Solution

Sunsystems Finance & Accounting solution combines the latest innovation and usability with a depth of functionality that has been achieved through decades of practical application.
Sunsystems is a comprehensive, global financial management and accounting system that delivers real-time financial, operational, and reporting analysis with unparalleled adaptability.


  • Unified Ledger
  • Budget and Commitment management
  • Purchase to Pay
  • Bank Management
  • Fixed Assets
  • Mobile working
  • Reporting
  • Multi Company & Multi Currency & Multi Language
  • Project Accounting
  • Business systems integration


  • Simple and intuitive interface
  • Realtime access to data
  • Cloud ready accessibility on Mobile, Tablet and Desktop.
  • Implement best practise locally and globally
  • Access In-Context business intelligence
  • Integrate key business systems providing deeper analysis through finance
  • Enable cross application process flows
  • Improve compliance readiness and data security
  • Meets local & regulatory reporting in over 190 countries
  • Meeting Accounting requirements of different industries locally & globally


£150 per user per month

  • Education pricing available

Service documents


G-Cloud 11

Service ID

7 0 4 6 1 0 9 4 0 9 8 9 6 5 6


Castle Computer Services Ltd

Paul Sutherland

01698 844600

Service scope

Software add-on or extension
Cloud deployment model
  • Private cloud
  • Hybrid cloud
Service constraints
No constraints
System requirements

User support

Email or online ticketing support
Email or online ticketing
Support response times
Email support request response times are fully detailed in out Service Level Agreement with the customer, and are based on level of support priority
User can manage status and priority of support tickets
Online ticketing support accessibility
None or don’t know
Phone support
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
Onsite support
Yes, at extra cost
Support levels
Castle’s support model is based around ITIL (IT Infrastructure Library) best practice. ITIL is a best practice framework developed by the Office of Government Commerce and is rapidly becoming the worldwide de facto standard for the delivery of IT support to businesses.
Castle’s ITIL based Support methodology will then be used to ensure that the highest quality, proactive and responsive support service is provided to you.
We adhere carefully to IT industry best practice, and follow the ITIL standards (IT Infrastructure Library). Our support function is provided via our dedicated helpdesk in Strathclyde Business Park, Bellshill from where we provide high quality support to over 500 customers
We use a number of leading edge systems and software applications to help maximize our service to customers, such as:
• Cherwell service management call handling software
ITIL accredited software for handling, monitoring and reporting Castle’s service against agreed SLA’s
• Network streaming software
This allows us to take control (remote control) of any PC or server that can connect to our web site .
• And our innovative myCastle self service support portal
Support available to third parties

Onboarding and offboarding

Getting started
A range of On-Boarding services are available including - Project Scoping, planning and deployment. Project Management and on-site training services
Service documentation
Documentation formats
End-of-contract data extraction
Data extraction services are part of the solution we offer, ensuring clients can de-couple from the solution and retain all of their data
End-of-contract process
The contract incorporates the licences to use the Sunsystems Finance solution. Additional/Optional services and costs are The Professional Quality Implementation Services (PQIS) . These include Training consultancy, deployment consultancy, design consultancy, integration consultancy, data migration consultancy and Project Management

Using the service

Web browser interface
Supported browsers
  • Internet Explorer 11
  • Microsoft Edge
  • Chrome
Application to install
Compatible operating systems
Designed for use on mobile devices
Service interface
Customisation available


Independence of resources
Dedicated application servers can be issued to minimise other user impact on services


Service usage metrics


Supplier type
Reseller providing extra features and support
Organisation whose services are being resold

Staff security

Staff security clearance
Conforms to BS7858:2012
Government security clearance

Asset protection

Knowledge of data storage and processing locations
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least once a year
Penetration testing approach
Another external penetration testing organisation
Protecting data at rest
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
Data sanitisation process
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
Sunsystems incorporates Transfer Desk - a dedicated solution within the system for exporting data
Data export formats
Data import formats
  • CSV
  • ODF

Data-in-transit protection

Data protection between buyer and supplier networks
Private network or public sector network
Data protection within supplier network
Other protection within supplier network

Availability and resilience

Guaranteed availability
The Service is available 24/7 365 days per year and has an uptime average of 99% over the past 9 years. From time to time planned outages are agreed with customers for the implementation if upgrades etc.. Typically these are once a quarter and are implemented outside office hours.
Approach to resilience
The platform has been implemented with a redundant and fault-tolerant High Availability Architecture (HAA) to ensure that no single point of failure can affect the availability of the overall solution (the concept of duality is applied to all aspects components of the architecture).

The Network has been designed to be multi-zone separated by firewalls. Security has been implemented across the applications and uses industry standard authentication.
Outage reporting
If outages or part outages occur it is Castle's policy to transparently discuss this with our customers. Castle has also implemented the following ways to communicate outages to our customers:-
1. As soon as an outage occurs Castle will email all relevant customer contacts
2. Castle will post a status update page that will be updated with any developments and this page is accessible by all customers.
3. If the problem is ongoing Castle will email all end users directly and send text messages to affected users
4. When the outage is over Castle will update all users impacted by the outage via email and text message
5. Castle provides each impacted customer with a detailed outage report that includes a detailed description of the problem that occurred and a plan to ensure that the problem does not occur again.

Identity and authentication

User authentication needed
User authentication
Username or password
Access restrictions in management interfaces and support channels
Management Interfaces are restricted based on Group membership. Company Administrator access is limited to views of a company's data and all access if restricted via 2-factor authentication.
System level access is restricted to the Castle help desk operation leaders.
Access restriction testing frequency
At least once a year
Management access authentication
  • 2-factor authentication
  • Username or password

Audit information for users

Access to user activity audit information
You control when users can access audit information
How long user audit data is stored for
Access to supplier activity audit information
You control when users can access audit information
How long supplier audit data is stored for
How long system logs are stored for

Standards and certifications

ISO/IEC 27001 certification
ISO 28000:2007 certification
CSA STAR certification
PCI certification
Other security certifications

Security governance

Named board-level person responsible for service security
Security governance certified
Security governance standards
CSA CCM version 3.0
Information security policies and processes
Within the company, we have an acceptable usage policy for all IT equipment. This covers, any office technology extensively, in regards to it's security, software on the devices and the usage of the software/hardware. It is designed so that adherence to the DPA is vital and always present.

Technologies such as Active Directory Services, and Group Policy are in place to make sure that company wide administration is present and no preventative measures can be made to disable Anti-Virus, firewalls, HIPS, Anti-Phishing, Email-protection etc.

Operational security

Configuration and change management standard
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach
All system changes have to formally documented, fully regression tested to ensure no application conflicts.

Changes applied to a test environment first

Customer UAT is required before transfer to a live system
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
With both the head office and the private cloud, we deploy a unified threat management system, which helps monitor all information going in and out of each location. The UTMs is equipped with firewall, intrusion prevention, utm management and advanced threat protection technologies.

We run regular patching to our platforms through WSUS, and application specific software releases. We usually deploy these in waves, so that if a patch was to break a service it would break a small amount of our private cloud and not the entire cloud. This is to help prevent any outages.
Protective monitoring type
Protective monitoring approach
We regularly carry out tests to ensure that code injections and other similar attacks (OWASP A1,
A2 and A5 classes). In addition we use 3rd parties to test and ensure no access to restricted information using direct object and URL
references (A4 and A8).
Incident management type
Supplier-defined controls
Incident management approach
All incidents reported via the Castle ITIL support services desk. Routes to support include Telephone, Email and Web

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks


£150 per user per month
Discount for educational organisations
Free trial available

Service documents

Return to top ↑