DEEPER THAN BLUE LTD

Web, Application and CMS Development and Modernisation

DeeperThanBlue delivers secure, cloud-native web, application and CMS development for UK public sector organisations. We design, build and modernise digital services aligned to GDS standards, using Agile delivery, user-centred design and DevOps practices to reduce risk, improve accessibility and enable scalable, resilient services.

Features

• Full GDS lifecycle delivery across Discovery, Alpha, Beta and Live
• Agile Scrum delivery with multidisciplinary public sector experience
• Cloud-native development using microservices and serverless architectures
• Legacy application modernisation and technical debt reduction
• API-led integration enabling interoperability and data sharing
• DevOps automation with CI/CD and Infrastructure-as-Code
• User-centred UX/UI design meeting WCAG accessibility standards
• Secure-by-design engineering aligned to NCSC principles
• Technical Design Authority governance and architecture assurance
• Collaborative delivery with structured knowledge transfer

Benefits

• Reduced delivery risk through proven GDS-aligned approaches
• Faster time to market via Agile and DevOps delivery
• Lower long-term costs through cloud-native architectures
• Improved accessibility and usability for end users
• Secure, compliant services meeting government security requirements
• Scalable and resilient applications supporting fluctuating demand
• Reduced technical debt without disruptive system replacement
• Greater transparency through clear governance and documentation
• Increased organisational capability through skills transfer
• Reduced supplier dependency using open standards

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at chris.booker@deeperthanblue.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

490582174269658

Contact

Chris Booker
0114 3992820
chris.booker@deeperthanblue.co.uk

About your service

• Service categories:

  Application Development and Deployment

  Application development

  • Development languages, environments and tools
  • Software construction components
  • Business rules management

  Modelling and architecture

  • Object Modelling Tools
  • Business Process Modelling Tools
  • Enterprise Architecture Tools
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: Specific constraints would need to be further understood as part of service scoping and project take-on.
• System requirements:
  • Internet connection & web browser
  • Use on any web-enabled device with modern internet browsers.
  • Deployed on AWS, Microsoft Azure, Google Cloud or IBM Cloud
  • Can be deployed on premise

User support

• Email or online ticketing support: Yes
• Support response times: DeeperThanBlue provides flexible, enterprise‑grade Managed Services with defined service levels tailored to customer needs. Support is available across Standard and Premium tiers, with coverage options ranging from business hours to full 24×7 service. ; ; We prioritise incidents by severity, ensuring fast and effective response times, from critical Level 1 issues, where systems are unavailable, through to general enquiries. Our SLAs guarantee rapid response, with Premium support offering enhanced targets for high‑impact incidents. ; ; This structured approach ensures consistent, reliable service management that keeps essential systems stable, secure, and fully supported.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: None
• Onsite support: Yes, at extra cost
• Support levels: DeeperThanBlue provides comprehensive Support and Managed Services to ensure stability, performance, and security of critical business systems, priced from £850 to £3,575 monthly including incident hours. ; ; Our support model offers a choice of coverage levels, allowing customers to select the service window that best fits operational needs, from standard business hours, extended business hours, and full 24×5 availability through to 24×7 support for always‑on environments. These options ensure organisations can depend on consistent access to skilled support specialists whenever incidents arise. ; ; Two service tiers are available: Standard and Premium. Both provide structured incident categorisation with defined response times, while Premium delivers faster responses for high-severity issues. Incidents are prioritised by impact and urgency: Level 1 (production system outages) through Level 4 (general enquiries). Response commitments range from one-hour for critical Premium incidents to 24-hour for low-severity queries across both tiers. ; ; Our Managed Services are delivered by experienced engineers who monitor, diagnose, and support system operations proactively. By combining flexible coverage options with clear and measurable SLAs, DeeperThanBlue ensures customers benefit from reliable technical support, reduced downtime, and consistently high service quality. This approach enables organisations to maintain optimal performance while focusing on strategic objectives.
• Support available to third parties: No
• AI chatbot: No

Onboarding and offboarding

• Getting started: The onboarding process for any project will depend on the scope of the work outlined at proposal stage.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: At the end of a contract, DeeperThanBlue ensures that all customer data is securely and efficiently extracted in a structured and accessible format. Customers retain full ownership of their data and can request extraction at any time before contract closure. Data will typically be provided through secure transfer methods such as encrypted download or SFTP, using mutually agreed file types (e.g. CSV, JSON, XML, or database export).; ; Prior to termination, DeeperThanBlue coordinates closely with the customer to agree specific data formats, timelines, and validation checks to ensure complete and accurate extraction. Once the transfer is complete and verified by the customer, all remaining customer data will be securely deleted from DeeperThanBlue systems in accordance with ISO27001-aligned data governance and GDPR best practice.; ; DeeperThanBlue supports customers through the transition process to minimise service disruption and provide any necessary technical assistance to achieve a smooth handover of data assets.
• End-of-contract process: At the end of a contract, DeeperThanBlue ensures that all customer data is securely and efficiently extracted in a structured and accessible format. Customers retain full ownership of their data and can request extraction at any time before contract closure. Data will typically be provided through secure transfer methods such as encrypted download or SFTP, using mutually agreed file types (e.g. CSV, JSON, XML, or database export).; ; Prior to termination, DeeperThanBlue coordinates closely with the customer to agree specific data formats, timelines, and validation checks to ensure complete and accurate extraction. Once the transfer is complete and verified by the customer, all remaining customer data will be securely deleted from DeeperThanBlue systems in accordance with ISO27001-aligned data governance and GDPR best practice.; ; DeeperThanBlue supports customers through the transition process to minimise service disruption and provide any necessary technical assistance to achieve a smooth handover of data assets.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
  • ChromeOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The desktop service may integrate with other enterprise applications. This may be more limited on the mobile device.
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: Bespoke coding and architecture will be in place.
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: The scope of customisation will be established during the fact-finding stage of any project.

Scaling

• Independence of resources: DeeperThanBlue prevents one customer’s usage from negatively affecting others by applying strict capacity management and logical segregation of resources. We provision environments with appropriate headroom based on monitored usage patterns and agreed service levels, and we scale resources vertically or horizontally to absorb peaks in demand. Workloads are isolated at the application and data layers, with controls on concurrency, resource allocation and rate limiting to prevent noisy-neighbour effects. Performance, availability and utilisation are continuously monitored, with alerts and proactive tuning to address hotspots before they impact users, helping to maintain consistent service levels across all customers.

Analytics

• Service usage metrics: Yes
• Metrics types: Billing & Usage metrics, Application logs & performance metrics, User login & API events.
• Reporting types:
  • API access
  • Real-time dashboards
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Microsoft, IBM, Google, AWS, BigCommerce, Shopify, HCL

Staff security

• Staff security clearance: Staff screening not performed
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
  • Other
• Other data at rest protection approach: Security for both data-in-use and data-at-rest is the customers responsibility as the applications are developed.
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Users can request a data export from DeeperThanBlue at any time during or at the end of their contract. Upon receiving a formal request, DeeperThanBlue will prepare the data in a structured, commonly used format such as CSV, JSON, XML, or a database export. The data is transferred securely via encrypted download link or SFTP, following verification of customer authorisation. DeeperThanBlue provides assistance to ensure the data is complete, accurate, and compliant with GDPR and ISO27001 standards, enabling customers to retain full ownership and portability of their information.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • Microsoft Excel
  • Text only
  • CSV
  • XML
• Data import formats:
  • CSV
  • ODF

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: DeeperThanBlue designs and operates its services to meet defined service level targets, typically expressed as a minimum percentage uptime over a monthly or annual period. We use resilient cloud infrastructure, proactive monitoring and capacity management to minimise unplanned downtime. Planned maintenance is scheduled outside core service hours wherever possible and notified in advance. Where SLAs are agreed, service performance is measured and reported regularly, with service credits or remedial actions available by prior contract. Our aim is to provide consistent, predictable availability aligned to business needs and clearly documented within each customer’s order form or call-off contract.
• Approach to resilience: DeeperThanBlue’s approach to resilience combines cloud-native architecture, redundancy and robust operational processes. Services are deployed across multiple availability zones or equivalent constructs, with no single points of failure in critical components wherever feasible. We implement automated backup, tested restoration procedures and, where appropriate, replication between environments. Monitoring and alerting systems detect performance or stability issues early, enabling timely intervention. Configuration management, change control and security hardening reduce the risk of outages caused by human error or vulnerabilities. Disaster recovery objectives (RPO/RTO) are defined with customers and tested periodically to ensure they remain achievable and aligned to business risk.
• Outage reporting: In the event of a service outage, DeeperThanBlue operates a structured incident management process with clear communication to affected customers. Incidents are prioritised by business impact and severity, with dedicated technical resources assigned until service is restored. Customers are informed through agreed channels (for example email, ticketing system or agreed stakeholder contacts), with regular updates on progress and expected resolution times. After major incidents, we provide a post-incident report outlining root cause, impact, timeline, remedial actions and any longer-term improvements. Lessons learned are incorporated into our operational practices to reduce the likelihood and impact of future incidents.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Role based access restricts access to management interfaces and support channels. Roles include developer, manager, auditor and billing manager. Different roles see different interfaces.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: DeeperThanBlue adopts a structured, risk-based security governance approach to safeguard client data and IT assets. We integrate security oversight into our organisational framework, ensuring clear accountability, defined roles, and management visibility across all projects. Regular audits, compliance monitoring, and alignment with recognised standards ensure proactive risk management. Our approach includes continuous assessment, incident response readiness, and the embedding of security into development and operational practices. By combining strategic oversight with operational controls, we ensure that security decisions support business objectives while maintaining compliance, resilience, and stakeholder trust across all client engagements.
• Information security policies and processes: DeeperThanBlue maintains comprehensive information security policies and processes that govern the handling, storage, and protection of data. Policies cover access management, data classification, encryption, secure development, and incident response, ensuring all staff and contractors understand their responsibilities. Processes are continuously reviewed and updated to align with evolving threats, regulatory requirements, and industry best practice. Training, awareness campaigns, and regular audits reinforce adherence, while monitoring and reporting mechanisms enable timely identification and mitigation of risks. By embedding security into daily operations, DeeperThanBlue ensures the confidentiality, integrity, and availability of information, providing clients with robust protection against cyber threats and operational disruptions.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: DeeperThanBlue follows a disciplined configuration and change management approach to ensure stability, security, and reliability of IT systems. All changes are formally logged, assessed for risk, and approved prior to implementation, with separation of duties to prevent unauthorised modifications. Configuration baselines are defined and maintained across environments, enabling consistency and traceability. Automated tools track changes, while testing and validation processes reduce disruption and prevent security weaknesses. Emergency changes follow a controlled escalation procedure, with post-implementation reviews to capture lessons learned. This structured approach ensures operational integrity, supports regulatory compliance, and minimises risk to both client systems and business services.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: DeeperThanBlue implements a proactive vulnerability management approach to identify, assess, and remediate security weaknesses across systems and applications. Automated scanning and manual assessments detect vulnerabilities, which are prioritised for risk, potential impact, and business criticality. Patch management processes ensure timely deployment of updates; mitigation strategies address residual risks. Continuous monitoring/reporting provide visibility to management and support compliance with recognised standards. Staff awareness and training reinforce secure practices, ensuring vulnerabilities are promptly addressed. By embedding vulnerability management into operational routines, DeeperThanBlue reduces exposure to cyber threats, strengthens system resilience, and maintains the confidentiality, integrity, and availability of client and organisational assets.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: DeeperThanBlue adopts a comprehensive protective monitoring approach to detect, analyse, and respond to security events across IT environments. Centralised logging and monitoring tools capture system activity, enabling real-time identification of anomalous behaviour, potential threats, and policy violations. Alerts are prioritised and escalated according to predefined risk criteria, ensuring rapid response to critical events. Regular review and correlation of logs support compliance audits, forensic investigations, and continuous improvement of security controls. By integrating monitoring with incident management and threat intelligence, DeeperThanBlue maintains operational visibility, strengthens cyber resilience, and ensures clients’ systems remain secure, compliant, and available to support ongoing business operations.
• Incident management type: Supplier-defined controls
• Incident management approach: DeeperThanBlue maintains a structured incident management approach to ensure rapid detection, containment, and resolution of security and operational events. Incidents are categorised, prioritised, and logged in a centralised system, with clear escalation paths and defined roles and responsibilities. Standardised procedures guide response, communication, and recovery, minimising impact on business operations and client services. Post-incident reviews capture lessons learned and inform process improvements. Integration with monitoring, vulnerability management, and governance frameworks ensures a holistic approach. Staff are trained in recognising and reporting incidents, fostering a proactive security culture. This approach ensures resilience, compliance, and the protection of information and IT assets.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 172fc5f8-b27f-4d3b-8e17-7491b529e4be
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: A62e3614-9846-4de9-90f3-0c032387c640
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at chris.booker@deeperthanblue.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.