Helyx Secure Information Systems Ltd

Helyx Secure GEOINT Managed Service on Microsoft Azure Elevated OFFICIAL

Helyx's Secure GEOINT Managed Cloud Service incorporates UKCloud’s Crown hosting datacentres and Azure's public platform, to provide a secure hybrid-cloud solution. We provide an environment to manage and exploit your geospatial and information holdings, using the latest Esri capabilities, to improve the speed, accuracy and versatility of your GEOINT capability.


  • Range of service levels, Azure Stack VM sizes and licencing
  • Build and configure VMs via Azure selfservice portal & API
  • On demand. Billed by the hour for Azure Stack resources.
  • Azure Platform spans two UK datacentres separated by over 100km.
  • 24/7 Azure service desk included standard with SLA response times
  • Azure connected to internet, PSN, HSCN, Janet via UKCloud
  • Based on Microsoft AzureStack, an extension of Microsoft Azure
  • UK hosted by SC and NPPV cleared personnel. Azure alternative
  • The Azure service is aligned with NCSC Cloud Security Principles
  • Azure technology available from a trusted UK sovereign provider


  • Configure the Azure solution that is right for your application
  • Create GEOINT capabilities leveraging the experience of the Helyx Team
  • Realise benefits of GEOINT more rapidly than on premise implementations
  • Use the latest technology and operating systems
  • Remove the cost of new infrastructure for fixed term projects
  • Use innovative automation techniques to rapidly build new environments
  • All data stored in UK at secure data centres
  • Scale GEOINT capability for short-term demand, eg web application delivery
  • Have a resilient service using your existing processes and practices
  • Azure on a cloud that aligns with NCSC best practice


£0.03 a virtual machine an hour

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at gcloud@helyx.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.


G-Cloud 12

Service ID

8 9 3 0 2 0 5 7 6 0 1 2 1 7 5


Helyx Secure Information Systems Ltd Ian Dent-Krauze
Telephone: 01684 273725
Email: gcloud@helyx.co.uk

Service scope

Service constraints
System requirements
Our service is tailored to meet your needs

User support

Email or online ticketing support
Email or online ticketing
Support response times
Tickets are responded to on a priority basis. We aim to respond to ALL initial questions within 15 minutes during normal business hours, and High Severity tickets will be responded to 24/7, if selected as an option.
User can manage status and priority of support tickets
Online ticketing support accessibility
None or don’t know
Phone support
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
Onsite support
Yes, at extra cost
Support levels
We have a number of support levels that can be tailored to suit customer needs. These range from 24/7 reporting via a support desk, with a response within normal working hours, to P1 issues that are addressed 24/7 within agreed response times.
Support available to third parties

Onboarding and offboarding

Getting started
All new customers are assigned a Project Lead that will provide proactive support and advice for the duration of the project. This also includes the assistance from DevOps and cloud architects, to ensure the right solution is provisioned and maximised for the workloads, along with a range of user guides.
Service documentation
Documentation formats
  • HTML
  • ODF
  • PDF
  • Other
Other documentation formats
  • Video
  • Audio
  • Webinars/Webex
  • Presentations
End-of-contract data extraction
The customer has complete autonomy of how data is stored and managed within their virtual environment. Data can be extracted either from within the VM (for example, copying data over virtual networks), or the entire VM (for example, exporting as an OVF).
End-of-contract process
We will return all your data and materials which cannot be deleted or exported by you, and securely destroy all copies of your data on your written instruction.  We will return any pre-paid sums for services not delivered to you. We will not penalise you for terminating your contract with us unless specifically stated in the Service Definition. We will also return all of your confidential information, unless there is a legal requirement that we keep it.

Using the service

Web browser interface
Using the web interface
It also allows users to interface with the capabilities delivered as part of the service, typically via a web browser.
Web interface accessibility standard
None or don’t know
How the web interface is accessible
The web interface is accessible using the most common web browsers, and is delivered over various public and private networks, including the internet, PSN, N3/HSCN and Janet. The web interface is protected by standards-based encryption, two-factor authentication where necessary, and optionally IP address restrictions.
Web interface accessibility testing
What users can and can't do using the API
Dependent on options selected by the customer.
API automation tools
  • Ansible
  • Chef
  • SaltStack
  • Puppet
  • Other
API documentation
API documentation formats
  • Open API (also known as Swagger)
  • HTML
  • ODF
  • PDF
Command line interface
Command line interface compatibility
  • Linux or Unix
  • Windows
  • MacOS
Using the command line interface
Dependent on options selected by the customer


Scaling available
Scaling type
Independence of resources
In order to guarantee that users are not affected by the demands from other users, we use resource reservations and shares, such as internet bandwidth shaping. In addition, the capacity-planning team ensure that usage, in terms of all resources, is constantly monitored and increased accordingly, relating to user demand.
Usage notifications
Usage reporting
  • Email
  • Other


Infrastructure or application metrics
Metrics types
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
  • Other
Other metrics
  • IP Management
  • User quotas
Reporting types
  • Real-time dashboards
  • Regular reports
  • Reports on request


Supplier type
Reseller providing extra features and support
Organisation whose services are being resold

Staff security

Staff security clearance
Conforms to BS7858:2012
Government security clearance
Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least every 6 months
Penetration testing approach
‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest
Physical access control, complying with CSA CCM v3.0
Data sanitisation process
Data sanitisation type
Explicit overwriting of storage before reallocation
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

Backup and recovery
Backup controls
Dependent on options selected by the customer
Datacentre setup
Multiple datacentres with disaster recovery
Scheduling backups
Users contact the support team to schedule backups
Backup recovery
Users contact the support team

Data-in-transit protection

Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Bonded fibre optic connections
  • Other
Other protection between networks
We offer the choice of connecting:
• Via the internet using additional encryption such as TLS 1.2
• IPSec VPN tunnels
• Via private networks such as leased lines or MPLS
• Via public sector networks such as PSN, N3, Janet
Data protection within supplier network
  • TLS (version 1.2 or above)
  • Other
Other protection within supplier network
We use dedicated CAS-T circuits between each of our sites, to ensure the protection of customer data in-flight. Additionally, we encrypt this data within our Elevated OFFICIAL platform. All data flows are subject to our protective monitoring service.

Availability and resilience

Guaranteed availability
Dependent on options selected by the customer. 99.90% for a single VM deployed as a single instance.
Approach to resilience
Our service can be deployed across a number of sites, regions and zones. Each zone is designed to eliminate single points of failure (such as power, network and hardware). Other features dependent on options selected by the customer.
Outage reporting
All outages will be reported via the Service Status page and the notifications service within the UKCloud Porta,l forwarded to the user as agreed.  Outages are identified as Planned maintenance, Emergency maintenance, and platform issues.  In addition, the designated Project Lead will proactively contact customers as appropriate.

Identity and authentication

User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
  • Other
Other user authentication
For online systems (e.g. Customer Portal & API interfaces), all users are required to have a unique username, password and memorable word combination. Customers may also use 2FA authentication tokens.
Access restrictions in management interfaces and support channels
Customers have the option to raise a support request via telephone or email. Helyx will always authenticate the identity of the user by validating known phone numbers and asking them for specific characters within their pre-agreed memorable word.
Access restriction testing frequency
At least every 6 months
Management access authentication
  • 2-factor authentication
  • Dedicated link (for example VPN)
Devices users manage the service through
  • Dedicated device on a segregated network (providers own provision)
  • Dedicated device on a government network (for example PSN)
  • Dedicated device over multiple services or networks
  • Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)

Audit information for users

Access to user activity audit information
Users contact the support team to get audit information
How long user audit data is stored for
Between 1 month and 6 months
Access to supplier activity audit information
Users contact the support team to get audit information
How long supplier audit data is stored for
Between 1 month and 6 months
How long system logs are stored for
Between 1 month and 6 months

Standards and certifications

ISO/IEC 27001 certification
ISO 28000:2007 certification
CSA STAR certification
PCI certification
Other security certifications
Any other security certifications
  • Cyber Essentials Plus
  • List X

Security governance

Named board-level person responsible for service security
Security governance certified
Security governance standards
Other security governance standards
Cyber Essentials Plus;
List X
Information security policies and processes
The Company is governed by an integrated suite of information security policies. Under the top level Information Security Policy itself are second-level documents with specific focus on Acceptable Use, Antivirus Protection, Asset Management, Business Continuity Management, Data Protection,  and many others.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Helyx has implemented and maintained a range of configuration and change management processes. Formal configuration management activities, including record management and asset reporting, are monitored and validated. Any identified discrepancies are promptly escalated for investigation. An established process for the submission of change requests is mandated, which is held with a quorum of operational and technical management personnel.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Helyx has a vulnerability management policy and process. Where technically possible, real-time updates and status reports are identified and sourced from credible vendor sources. For other systems and software, assigned personnel have responsibility for regularly reviewing technical forums and specialist groups to promptly identify and evaluate any emerging patches or updates which require our attention.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
Following best practice from the National Cyber Security Centre (NCSC), Helyx protects all its platforms with 24x7 enhanced protective monitoring services, vulnerability scanning and assessment.  Our approach to protective monitoring at minimum meets the Protective Monitoring Controls (PMC 1-12) outlined in NCSC document GPG13 (Protective Monitoring for HMG ICT Systems).  It includes checks against systems events (SIEM) and network traffic analysis, including time sources, cross-boundary traffic, suspicious activities at a boundary, network connections and status of backups.  Any alerts generated are logged and investigated 24x7.
Incident management type
Supplier-defined controls
Incident management approach
Helyx has a documented incident management policy and process. This activity is responsible for the progression of alerts generated by automated monitoring systems, issues identified by Helyx personnel, and incidents identified and reported to Helyx by its customers and partners. All incidents are reported into a central ticketing system, which ensures that each is promptly assigned to an appropriate resource, and its progress tracked (and escalated, as required) to resolution.

Secure development

Approach to secure software development best practice
Supplier-defined process

Separation between users

Virtualisation technology used to keep applications and users sharing the same infrastructure apart
Who implements virtualisation
Third-party virtualisation provider
How shared infrastructure is kept separate
We use Microsoft Azure Stack provided by Microsoft as an extension to their Azure public cloud

Energy efficiency

Energy-efficient datacentres
Description of energy efficient datacentres
UKCloud’s services are CarbonNeutral® cloud services. They achieved this certification by working with Natural Capital Partners to measure and reduce Their CO2 emissions across all sources used to deliver their cloud services to our customers. These include direct emissions from all owned or leased stationary sources that use fossil fuels and/or emit fugitive emissions, and emissions from the generation of purchased electricity and steam (including transmission and distribution losses) to power their servers. For their cloud services to achieve CarbonNeutral® status, an independent assessment of the CO2 emissions produced from direct and indirect sources required to deliver them was carried out, followed by an offset-inclusive emissions reduction programme. This means that for every tonne of greenhouse gas emissions we produce in delivering cloud services, they buy a verified carbon offset which guarantees that an equivalent amount of greenhouse gas emissions is reduced from the atmosphere through a renewable energy or clean technology project.


£0.03 a virtual machine an hour
Discount for educational organisations
Free trial available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at gcloud@helyx.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.