IT Auxilium / GP IT Services / Health IT Services

Endpoint Backup with Disaster Recovery (BCDR)

GP IT Services provides Datto Endpoint Backup with Disaster Recovery to protect laptops and desktops against data loss, device failure, ransomware and major incidents. The service combines automated cloud backups with full system recovery, including file restores, bare-metal recovery and cloud-based system virtualisation to maintain business continuity.

Features

• Automated endpoint backups for laptops and desktops
• Image-based backups capturing full system state
• File and folder level recovery options
• Bare metal restore to replacement hardware
• Instant cloud virtualisation for business continuity incidents
• Encrypted data transfer and secure cloud storage
• Centralised management through web based console
• Ransomware protection with immutable backup copies
• Frequent backups reducing potential data loss
• Scalable licensing for growing endpoint environments

Benefits

• Reduces data loss from device failure ransomware or user error
• Minimises downtime through rapid file and full system recovery
• Enables business continuity during major incidents or outages
• Reduces IT recovery effort with automated backup processes
• Supports remote working without reliance on office infrastructure
• Improves resilience against ransomware and destructive attacks
• Restores productivity quickly using cloud virtualised systems
• Simplifies disaster recovery without on premises infrastructure
• Scales easily as endpoint numbers grow or change
• Protects critical business data across all user devices

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@healthitservices.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

572195646044837

Contact

Sales - Health IT Services
01223 827 410
sales@healthitservices.co.uk

About your service

• Service categories:

  Systems Infrastructure Software

  Storage

  Data replication and protection

  • Data Protection Software
  • Backup and Recovery Reporting Software
  • Storage Replication Software
  • Systems and Data Migration Software
  • Replication Management Software

  Archiving

  • Email Archiving Software
  • File and Other Archiving Software

  Storage infrastructure and device management

  • Storage Device Management Software
  • Other Storage Management and Infrastructure Software
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Our service extends Datto’s cloud backup platform and integrates with endpoint operating systems such as Microsoft Windows and Apple macOS. It complements wider Datto data protection services and supports organisations already using Microsoft cloud services, without requiring changes to existing endpoint management or infrastructure platforms.
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: The service is delivered as a cloud-based solution and support is provided remotely by GP IT Services and Datto. It requires supported Windows or macOS devices with an active internet connection and installed backup agent. Mobile devices are not supported. Disaster recovery features rely on cloud virtualisation and are subject to service availability, licensing and network connectivity.
• System requirements:
  • Supported Windows endpoint devices with Datto backup agent installed
  • Supported macOS endpoint devices with Datto backup agent installed
  • Active internet connection for backups restores and recovery
  • Datto Endpoint Backup with Disaster Recovery licence per device
  • Local administrator permissions for agent installation
  • Modern web browser for management console access
  • Sufficient device storage for snapshot creation
  • Network access allowing secure Datto cloud communication

User support

• Email or online ticketing support: Yes
• Support response times: 08:00 to 18:00 Monday to Friday, excluding Bank and Public Holidays. 24x7 cover if the client has OOH support add-on.; ; 30 min to 4 hour response dependent on priority call:; P1 - 30 mins,; P2 - 2 hours,; P3 - 4 hours; P4 - 4 hours
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: None or don’t know
• How the web chat support is accessible: Web chat is available once logged into our Support Portal. Users can ask questions and the bot will either signpost to the necessary support article or suggestion a resolution based on it's learning from tickets logged/resolution notes/ongoing learning the bot undertakes. The bot will not provide data or information from other customers, but may use learning from others to help support an answer.
• Web chat accessibility testing: Users can use speech to text in order to detail their issues and respond.
• Onsite support: Yes, at extra cost
• Support levels: We provide three support levels to meet different operational needs. Standard Support is included as part of the service and offers business-hours access to the service desk, incident logging, diagnostic assistance and help with backup or restore activities. Buyers also receive access to online documentation at no extra cost. Enhanced Support is available for buyers who require extended assistance. It provides longer support hours, priority incident handling, proactive monitoring of backup activity and optional service reviews. This level is charged as a fixed monthly fee per tenant, with pricing dependent on the size and complexity of the environment. Premium Support is designed for organisations with higher resilience requirements. It offers extended-hours or full 24/7 incident response, priority restoration for critical issues, regular performance reporting and fast escalation to senior engineers. Pricing is bespoke and agreed based on user numbers and required response targets. A dedicated Technical Account Manager or Cloud Support Engineer can be provided on request. This optional service includes ongoing configuration guidance, scheduled reviews and support with complex restorations. It is charged either as a monthly retainer or on a day-rate basis depending on the level of engagement required.
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: GP IT Services helps users start using the service through a structured, remote onboarding process. We configure the Datto platform, assign licences and deploy the endpoint backup agent to supported devices. Users are provided with clear online documentation, setup guides and knowledge base articles covering backup, restore and disaster recovery processes. Remote training sessions can be delivered for administrators to explain monitoring, recovery options and best practice configuration. Onsite training is not usually required due to the cloud-based design but can be arranged if needed. Ongoing support is provided by GP IT Services, with escalation to Datto where appropriate, ensuring users can adopt and operate the service confidently.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: When the contract ends, users can extract their data by restoring files and folders from Datto Endpoint Backup back to their endpoint devices before service termination. Using the web-based management console, authorised administrators or users can download recovered data in its original file format. Once the contract has ended, access to the service is removed and retained backups are securely deleted in line with Datto data retention and security policies.
• End-of-contract process: At the end of the contract, access to Datto Endpoint Backup is withdrawn and scheduled backups stop. Customers are expected to complete any required file or folder restores before service termination. After the contract ends, retained backup data is securely deleted in line with Datto data handling and retention policies.; ; The contract price includes the Datto Endpoint Backup licence per device, secure cloud storage, encrypted data transfer, access to the web-based management console, monitoring, alerting and standard remote support provided by GP IT Services. Additional costs may apply for optional services such as enhanced support tiers, onboarding assistance, device rollout support or other professional services agreed separately.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Our onboarding and offboarding documentation is delivered through a secure, browser-based knowledge portal accessible on any modern device. Content is structured with clear headings, readable layouts and screen-reader compatibility. Users can navigate using keyboard controls and adjust display settings for visibility needs. Documents are available in standard web formats to support assistive technologies, and key guides can be downloaded for offline use. This ensures administrators with a range of accessibility requirements can follow setup and offboarding steps without barriers.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: Yes
• Compatible operating systems:
  • MacOS
  • Windows
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: The service interface consists of a secure, web-based management console provided by Datto, accessed by GP IT Services and authorised customer administrators. The interface provides clear visibility of protected endpoint devices, backup status, storage usage and alerts. From here, administrators can stand up virtual environments of backed up machines for DR purposes. Users can configure backup schedules, initiate file or folder restores and review activity logs through an intuitive dashboard. Role-based access controls restrict actions based on user permissions, supporting secure administration without the need for local infrastructure or specialist client software.
• Accessibility standards: None or don’t know
• Description of accessibility: The service is accessed through a secure, web-based management console designed in line with recognised web accessibility standards. The interface supports keyboard navigation, screen readers and scalable text, enabling use by administrators who rely on assistive technologies. Access is provided via standard web browsers without specialist software. While users can manage backups and restores based on assigned permissions, they cannot modify underlying platform components.
• Accessibility testing: The service interface has been tested to ensure compatibility with common assistive technologies. Testing included screen-reader navigation, keyboard-only operation and high-contrast display checks to confirm that key functions such as browsing backups, initiating restores and accessing reports remain usable without a mouse. User feedback confirmed that headings, labels and navigation elements are structured in a way that supports predictable movement through the portal. Compatibility was assessed using widely adopted assistive tools including screen readers available on Windows and macOS. No issues were identified that prevented authorised users from completing core administrative tasks.
• API: No
• Customisation available: Yes
• Description of customisation: Users can customise the service through the secure web-based management console provided by Datto and administered by GP IT Services. Administrators can customise backup schedules, backup frequency, retention periods, file and folder selections, alerting thresholds and disaster recovery options such as cloud virtualisation and recovery priorities. Customisation is completed directly within the console using predefined configuration settings, without scripting or infrastructure changes. Role-based access controls determine who can make changes. Only authorised administrators, typically GP IT Services engineers or nominated customer IT staff, can modify service configuration. End users may be permitted to restore their own files where enabled but cannot change backup policies, retention or recovery settings.

Scaling

• Independence of resources: GP IT Services delivers Datto Endpoint Backup with Disaster Recovery as a multi-tenant, cloud-based service built to scale securely. The underlying Datto platform uses tenant isolation, workload segmentation and elastic cloud resources so one customer’s backup, restore or virtualisation activity does not impact others. Capacity and performance are continuously monitored and automatically scaled, ensuring consistent service availability and performance regardless of overall platform demand.

Analytics

• Service usage metrics: Yes
• Metrics types: GP IT Services provides service metrics through the Datto management console. Metrics include backup success and failure status, last successful backup time, backup frequency, protected endpoint counts, storage usage and recovery activity. Disaster recovery metrics include recovery point objectives, restore test status and cloud virtualisation activity. Alerts and audit logs provide visibility of issues and administrative actions, supporting monitoring, reporting and compliance assurance.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Datto/Kaseya

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Physical access control, complying with CSA CCM v4.0
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Users export their data by restoring files and folders from the Datto Endpoint Backup platform back to their endpoint devices using the web-based management console. Authorised users or administrators can then download and save the recovered files locally in their original formats. The service, provided by Datto, does not use proprietary file formats, ensuring exported data remains accessible outside the service.
• Data export formats: Other
• Other data export formats:
  • VMDK
  • VHD
  • VHDx
  • RAW
• Data import formats: Other
• Other data import formats: Users don't upload data; original file formats are automatically captured.

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Datto does not provide a cloud uptime SLA.
• Approach to resilience: This is available on request (subject to an NDA)
• Outage reporting: Datto Infrastructure status may be monitored at https://status.datto.com/.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is restricted using layered security controls operated by Datto and GP IT Services. The management console enforces role-based access control, ensuring users can only view or perform actions appropriate to their role. Strong authentication is required, including multi-factor authentication where enabled. All administrative actions are logged for audit purposes. Support access is limited to authorised contacts verified against customer accounts. Privileged access is granted on a least-privilege basis and reviewed regularly to maintain security and compliance.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • Other
• Other security governance standards: ITAuxilium is Cyber Essentials accredited. We also follow the UK GDPR and the Data Protection Act 2018, NCSC Cloud Security Principles and follow the service management practices of ITIL.
• Information security policies and processes: ITAuxilium is Cyber Essentials accredited. We also follow the UK GDPR and the Data Protection Act 2018, NCSC Cloud Security Principles and follow the service management practices of ITIL.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We operate a structured configuration and change management process that tracks all service components through their full lifecycle using controlled configuration records and documented versioning. Proposed changes are logged, reviewed and risk assessed before approval. Each change undergoes a security impact assessment to evaluate effects on data protection, access controls and service stability. Approved changes follow a scheduled deployment process with testing, rollback planning and post-implementation review. This ensures components remain current, secure and fully traceable while minimising disruption to users.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We operate a continuous vulnerability management process that monitors, assesses and mitigates threats to the service. Potential vulnerabilities are evaluated using recognised risk frameworks, considering severity, exploitability and potential impact on confidentiality, integrity and availability. Security patches and updates are prioritised based on criticality, with high-risk vulnerabilities addressed as quickly as possible, typically within vendor-recommended timeframes. Threat intelligence is sourced from trusted industry feeds, vendor advisories, NCSC alerts and recognised security communities. Regular scanning and ongoing monitoring ensure new risks are identified promptly, and remediation actions are tracked through to completion.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We use continuous protective monitoring to detect unusual activity or indicators of compromise across the service. Automated alerts highlight anomalies such as failed backups, unexpected access attempts or abnormal system behaviour. When a potential compromise is identified, it is immediately escalated to the security team for investigation, containment and verification. Confirmed incidents follow a defined response process that includes isolation, remediation and communication with affected users. Response to high-severity incidents begins immediately, with lower-level events handled within standard operational timeframes. This approach ensures timely detection, rapid assessment and effective mitigation of security threats.
• Incident management type: Supplier-defined controls
• Incident management approach: We operate a structured incident management process with predefined procedures for common events such as failed backups, access issues and suspected security incidents. Users can report incidents through the service desk by email or via the support portal, where tickets are logged and prioritised. Each incident is handled using a standard workflow covering triage, investigation, resolution and communication. For higher-severity events, we provide formal incident reports that outline the cause, actions taken and any recommended improvements. Reports are shared with authorised administrators once the incident is closed, ensuring transparency and clear auditability.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: We provide a time-limited free trial of Datto Endpoint Backup with Disaster Recovery, supplied by Datto. The trial includes agent installation, automated backups, secure cloud storage and file restores. It excludes contractual SLAs, long-term retention, guaranteed recovery resources and production support, and is available for a limited evaluation period.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 5%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: De0ed732-62b1-4b95-bbe5-a7039e7eb424
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@healthitservices.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.