BC Platforms

Mosaic TRE

BC Mosaic is a cloud native Trusted Research Environment that enables secure, federated access to health and life-science data. It supports collaborative clinical, genomic and multi-omics research through compliant data governance, secure workspaces and advanced analytics—helping healthcare and research organisations accelerate insights while keeping data under custodian control.

Features

• Secure Trusted Research Environment with accredited data governance
• UK-hosted, cloud-native secure analytics workspace
• Granular role-based and project-based access controls
• Integrated audit logging and full data lineage
• Controlled access to sensitive health and research data
• Advanced analytics using approved research tools
• Support for federated and collaborative research
• Configurable to local policies (SDE) and standards (OMOP SDTM etc.)

Benefits

• Enables safe secondary use of sensitive public sector data
• Supports compliance with UK data protection regulations
• Reduces risk of data misuse or unauthorised access
• Improves researcher productivity without compromising security
• Builds public trust through strong data governance
• Accelerates insights from health and population data
• Simplifies collaboration across public sector organisations
• Scales to meet evolving government/organisational research needs

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at james.walsh@bcplatforms.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

375191924149453

Contact

James Francis Foley Walsh
07542606093
james.walsh@bcplatforms.com

About your service

• Service categories:

  Application Development and Deployment

  Analytics and business intelligence

  • Advanced and predictive analytics
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: AWS exclusive
• System requirements: Customer does not need any specific system requirements.

User support

• Email or online ticketing support: Yes
• Support response times: 4 hours during business days.
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Basic support levels are classified as default, plus and enterprise. ; default - includes access to our service desk, L1 & L2 support personnel and standard SLAs. This is included in licencing cost.; plus - includes access to our service desk, L1 & L2 support personnel and the ability to log L3 tickets and feature requests and enhanced SLAs. This adds 1.25x multiplier to licence cost.; enterprise - includes access to our service desk, L1 & L2 support personnel and the ability to log L3 tickets and feature requests and enhanced SLAs, as well as technical account management and additional services at cost. This adds 1.5x multiplier and can scale higher depending on agreed terms, man hours and enterprise SLA.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: User documentation and in application user guidance. ; customers with optional sla can recieve onsite/online training.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: System comes with data export tools in CSV or data type specific formats.
• End-of-contract process: Renewal or offboarding/data expert conversations for software platform.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: Authorised users are able to execute data analytics using the API.; ; Users cannot make configuration changes or change their TRE settings through API, only data management and analytical tasks are available.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: No
• Customisation available: No

Scaling

• Independence of resources: Services are restricted to number of users, if number of registered users grows, services are scaled up. ; Individual analytical tasks are autoscaled in real time.

Analytics

• Service usage metrics: Yes
• Metrics types: User activity, number of active sessions over a period of time. Use of analytics tools number of events over a period of time.
• Reporting types: Real-time dashboards
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
  • Other
• Other data at rest protection approach: Our data is hosted on AWS who are compliant with all of the above and we have enabled encryption on all applicable services.
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure

Data importing and exporting

• Data export approach: System comes with tools for exporting data. ; If the system has been configured to restrict exports, specific staging area access can be configured.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • Vcf
  • Plink binary
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • Vcf
  • Plink binary

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: 99.5% uptime SLA, refunds are only applicable in specific enterprise level agreements.
• Approach to resilience: BC Platforms follows a cloud native architectural framework for its products and leverages AWS services for enhanced redundancy and resiliency, more details can be provided upon request.
• Outage reporting: Email alerts.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
• Access restrictions in management interfaces and support channels: System relies on role based access management to administrative features.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: Between 6 months and 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: No
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We adhere to security policies and processes outlined as part of ISO27001 framework and maintain an internal ISMS.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Any changes to production platforms are requested through our internal ticketing system and assessed for potential functional and security impact upon approval changes are made and logged, the change management process is reviewed regularly.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Vulnerability scanning is a standard step in our SDLC process as well as run time scanning of production environments, BCPlatforms takes a risk based approach to patch scheduling and release cycles, information about potential threats comes from publically available dictionaries as well as our scanning provider.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Networking layers are regularly monitored with alerting for potential incidents and our incident management policies are defined by our ISMS and are reviewed annually as part of our ISO27001 compliance.
• Incident management type: Supplier-defined controls
• Incident management approach: Predefined incident management response and report processes are outlined in our ISMS and reviewed annually during ISO 27001 audits. Incidents are reported through secure and documented channels.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: KPMG
• ISO/IEC 27001 accreditation date: Sunday 27 March 2022
• What the ISO/IEC 27001 doesn’t cover: ISO 27001 is a comprehensive certification that covers both our software and organisational processes. The above certification is renewed annually since the initial accreditation.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: None of the criteria
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: Yes
• Any other security certifications:
  • ISO 13485 (Medical Devices QMS)
  • GDPR Compliance Programs
  • HIPPAA alignment, not certifications but formally documented.

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at james.walsh@bcplatforms.com. Tell them what format you need. It will help if you say what assistive technology you use.