ARONDITE LTD

Cobalt

Cobalt is an enterprise platform for orchestrating autonomy-native, AI-enabled defence and national security operations. It integrates disparate hardware, data and logic into a unified, collaborative ‘operating system’. Cobalt operators leverage intuitive digital workflows to accelerate decision-making, collapse sense-effect chains, and wield scaled autonomy and AI across the full mission lifecycle.

Features

• Task heterogenous robotic and autonomous systems, from any supplier
• Autonomy-native command & control of blended human-machine teams
• Vendor-agnostic integrated data models, logic, hardware and software platforms
• Unifying data fabric for exploitation of organisational assets and ontologies
• Comprehensive mission design, planning and order dissemination tooling
• Modular edge deployment and training of third-party AI models
• All domain, all spectrum sensor fusion and cross-cuing architecture
• Configurable layer-based COP/CIP with AI-enabled observation triage
• Flexible and resilient deployment options requiring minimal configuration
• Federated multi-instance and cross-domain architecture for DDIL operations

Benefits

• Can be hosted agnostic to provider on any secure cloud
• Deploy optimal mix of multiple heterogeneous autonomous systems
• Configure custom no-code workflows across sense-effect chain
• Integrate opensource and enterprise data into common operating picture
• Conduct all-spectrum and multi-domain battlespace management/triaging
• Plan and disseminate orders across disaggregated units via Cobalt BMS
• Responsibly leverage AI models to accelerate and assure decision making
• Accelerate sense-effect chain via collaborative management of targeting lifecycle
• Analyse enemy behaviour and conduct after-action reviews
• Share data between echelons and units in DDIL environments

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at frameworks@arondite.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

345454828380427

Contact

Arondite
0208 0581228
frameworks@arondite.com

About your service

• Service categories:

  Application Development and Deployment

  Data management

  Database management systems

  • Relational Database Management Systems

  Data integration and intelligence

  • Data Ingestion and Transformation Software
  • Dynamic Data Movement Software
  • Data Quality Software
  • Data Access Infrastructure Software
  • Composite Data Framework Software
  • Master Data Intelligence Software
  • Metadata Management Software
  • Data Archiving and Information LifD-Cycle Management
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: Cobalt platform is flexible and can be installed on any cloud provider with appropriate security for customer needs. Hardware for private cloud configuration would need to be agreed prior to deployment. Cobalt requires a mechanism for functionality and security updates, but the timing and mechanism of these are clearly agreed with the customer prior to and during deployment.
• System requirements:
  • Enterprise cloud deployment (100 simultaneous users):
  • Linux with Ubuntu distribution recommended. Minimum 1 server, recommended 3
  • CPU cores per server: minimum 16 physical / 32 logical
  • RAM per server: minimum 64GB, recommended 256GB
  • Storage per server: minimum 5TB, recommended 10TB
  • GPU ram per server: 24GB
  • Bandwidth: minimum 10Gbps, recommended 24Gbps
  • UFW, antivirus in each machine. External customer firewall recommended
  • End user device: minimum 2 cores/4GB RAM
  • End user browsers: Chrome, Edge, Firefox, Safari

User support

• Email or online ticketing support: Yes
• Support response times: Arondite provides tiered support levels according to customer needs. Specific Service Level Agreements are agreed with each customer prior to deployment and documented in the contract.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes, at an extra cost
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: N/a
• Onsite support: Yes, at extra cost
• Support levels: Arondite provides tiered support levels according to customer needs. Specific Service Level Agreements are agreed with each customer prior to deployment and documented in the contract.
• Support available to third parties: Yes
• AI chatbot: No

Onboarding and offboarding

• Getting started: Arondite provides a range of onsite and remote training options, including in-person and online training sessions and user documentation, if required.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: Cobalt has several egress mechanisms and formats for comprehensively exporting data depending on user requirements. Arondite will support the user in selecting the best egress method to meet their needs.
• End-of-contract process: At the end of the contract, Arondite provides a structured offboarding process to ensure a smooth transition. This includes the secure export of all customer data. Customers retain full ownership of the data generated during the contract. Arondite will also securely delete any residual data from its systems in accordance with GDPR and customer instructions.; ; Included in the contract price are: Cobalt licensing, standard onboarding, user training, 24/7 support for critical issues, regular software updates, and documentation. The service also includes configuration of integrations with customer systems.; ; Additional costs may apply for: managed hosting, infrastructure hardware, bespoke development, on-site support, or integration with highly bespoke or legacy systems. These must be agreed in advance. Optional services such as advanced analytics modules or large-scale data migration support may also incur extra charges, depending on scope.
• Documentation accessibility standard: WCAG 2.2 A

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 A
• Description of service interface: Cobalt includes a web-based graphical user interface (GUI) accessible through modern browsers such as Chrome and Microsoft Edge. Cobalt also provides an administrators' interface for configuration of service options.
• Accessibility standards: WCAG 2.2 A
• Accessibility testing: N/a as yet
• API: Yes
• What users can and can't do using the API: All standard Cobalt user functionality is available through APIs at any layer of the platform. Specific features or custom functionality can be added on request depending on customer requirements.
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Cobalt is extensible by design and built to work in federated environments. At a base level, it includes a high degree of customisation via the integration of sensors, effectors, and autonomous systems. There is also extensive customisation available by default for supporting different user workflows.; ; Depending on the terms of the contract agreed with the customer, bespoke development is available.

Scaling

• Independence of resources: Cobalt uses load balancing, separated UI interfaces and multi-threaded servers with a resource locking system to handle concurrent access. This allows multiple users to access the system simultaneously and have immediate response to input.

Analytics

• Service usage metrics: Yes
• Metrics types: Cobalt can be configured to provide a wide range of service metrics, as required by the customer. Exact configurations of metrics will be agreed in the contract prior to project start.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: NCSC approved service provider
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: All persistent data is encrypted at the storage layer, ensuring that physical media theft or improper drive disposal does not result in data compromise.; ; On-Premise: We utilise ZFS native encryption. Data is encrypted at the dataset level, ensuring that blocks written to disk are unintelligible without the encryption key.; ; Cloud: We utilise the provider-managed block storage encryption (e.g., EBS Encryption) using customer-managed keys (CMKs).; ; In both scenarios, the keys used to encrypt storage are managed separately from the storage media itself, ensuring cryptographically secure erasure (Crypto-Shredding) is possible.
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: All customer data remains property of customer at all time and is available in various formats. Arondite will assist the customer in the egress of their data at contract end, using open standards such as JSON/XML/HTML/CSV. ODF export is available for written documents.
• Data export formats:
  • CSV
  • ODF
  • Other
• Other data export formats:
  • JSON
  • XML
  • HTML
  • PNG
  • JPEG
• Data import formats:
  • CSV
  • ODF
  • Other
• Other data import formats:
  • PNG
  • JPEG
  • TIFF
  • TS
  • MP4
  • Parquet
  • XLS
  • TXT
  • KML

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • Other
• Other protection between networks: All network traffic is encrypted via TLS 1.2 (Minimum) or TLS 1.3.; ; Legacy CBC-mode ciphers and static RSA key exchange are explicitly disabled at the ingress gateway.
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: We provide varying levels of support that can be tailored to meet customer requirements. A standard Service Level Agreements (SLA) document can be provided upon request, but we will agree specific support levels with the customer during the contracting phase.; ; Metrics that can be agreed in the SLA include:; ; Number of 9s uptime; ; Incident to acknowledgment maximum time window; ; Incident acknowledgment maximum time window; ; Refunds and other penalty mechanisms can be agreed with the customer during the contracting phase.
• Approach to resilience: This information is available upon request.
• Outage reporting: Cobalt reports outages on the admin dashboard and email alerts to system admins. Text messaging and other mechanisms such as APIs can be provided as per customer requirements.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Other
• Other user authentication: Standard access is via username, password, combined with 2-factor authentication using an authenticator app. Cobalt also allows single sign-on identity federation with existing providers via Keycloak.
• Access restrictions in management interfaces and support channels: User accounts are assigned a role by administrators which controls which interfaces they can access.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
• Description of management access authentication: Management access is via username, password, combined with 2-factor authentication using an authenticator app. Cobalt also allows Single Sign-on identity federation with existing providers via Keycloak.

Audit information for users

• Access to user activity audit information: Users receive audit information on a regular basis
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: You control when users can access audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Our information security policies and processes follow best practices aligned with ISO 27001–based ISMS principles and Cyber Essentials Plus controls. We apply core security principles including least privilege, MFA, role-based access control (RBAC), secure change management, vulnerability management, and incident response.; Security controls include conditional access, hardened endpoint baselines (anti-virus, disk encryption, VPN, and automated patching), and centralised logging with alerting for anomalous activity. Access to systems and data is granted strictly on a need-to-know basis and reviewed as roles change.; Patching compliance is continuously monitored. Where vulnerabilities do not yet have vendor patches, risks are assessed and mitigated using compensating controls or manual remediation. Vulnerability scanning and remediation are embedded into normal operational workflows, with issues tracked through to resolution.; Information security oversight sits with senior leadership, with day-to-day responsibility owned by the Technical Operations Specialist, who reports into senior management. Security incidents, risks, and control effectiveness are escalated as required. Policies are reviewed regularly and updated as the business and threat landscape evolve. Compliance is validated through ongoing monitoring and independent external assessments.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Continuous deployment and versioning to enable patches, remediations, and upgrades to services with minimal downtime.; ; Arondite’s Change Management Policy is based on the principles of CSA CCM v4.0 and sets internal standards for system changes, requiring requests to be submitted in a secure logged database. These requests are triaged and reviewed by their relevant component controller, who approves or rejects depending on adherence to laws/regulations, contractual compliance, and security impact review.; ; Requests are in the form of code from an internal software developer are also subjected to automated security and functionality testing as part of Arondite’s continuous integration process.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We apply core security principles including least privilege, MFA, role-based access control (RBAC), secure change management, vulnerability management, and incident response.; Security controls include conditional access, hardened endpoint baselines (anti-virus, disk encryption, VPN, and automated patching), and centralised logging with alerting for anomalous activity. Access to systems and data is granted strictly on a need-to-know basis and reviewed as roles change.; Patching compliance is continuously monitored. Where vulnerabilities do not yet have vendor patches, risks are assessed and mitigated using compensating controls or manual remediation. Vulnerability scanning and remediation are embedded into normal operational workflows, with issues tracked to resolution.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Protective monitoring is implemented in line with NCSC operational security principles, using risk‑based logging, alerting, and review to detect potential security events. Potential compromises are identified through system and security logs, malware alerts, authentication failures, and anomalous activity across cloud and endpoint environments. ; ; Alerts are triaged based on severity and escalated through defined incident management processes. High‑risk events are investigated and contained promptly, with immediate response for critical incidents and same‑day response for others. ; ; Monitoring outputs are retained to support investigation, assurance activities, and continuous improvement.
• Incident management type: Supplier-defined controls
• Incident management approach: Processes are defined for user account compromise, system compromise, malware detection, denial of service attacks, phishing attacks and ransomware attacks. There is also a generic process for other incidents covering identification, triaging, containment, analysis, remediation, recovery and review.; ; Users can report incidents via the user-interface, dedicated email address or normal support channels; ; All reports into incidents are provided to administrators of affected systems and available (in anonymised form) to non-affected administrators on request
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: Yes
• Connected networks:
  • Public Services Network (PSN)
  • Police National Network (PNN)
  • Joint Academic Network (JANET)
  • Scottish Wide Area Network (SWAN)
  • Health and Social Care Network (HSCN)

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0.5%
• Between £250,000 and £500,000: 1.25%
• Between £500,001 and £1,000,000: 2.5%
• Between £1,000,001 and £2,500,000: 5%
• Between £2,500,001 and £5,000,000: 7.5%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Assessment Bureau
• ISO/IEC 27001 accreditation date: Tuesday 14 October 2025
• What the ISO/IEC 27001 doesn’t cover: The entire business is covered by our ISO27001 certification
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: British Assessment Bureau
• ISO 9001 accreditation date: Tuesday 14 October 2025
• What the ISO 9001 doesn’t cover: The entire business is covered by our ISO9001 certification
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Eae24afb-bb91-4b23-8e7e-bcfb1839e78b
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: B1471895-38c1-42de-8848-90c5c23bdf06
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Introducing transparency to pay and reward processes
    • Working conditions which promote an inclusive working environment and promote retention and progression

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of issues relating to entering the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at frameworks@arondite.com. Tell them what format you need. It will help if you say what assistive technology you use.