OCF LIMITED

OCF - Bridgeworks

Award-winning Data Transfer Acceleration technology that improves utilisation of available Wide Area Network (WAN) bandwidth to increase data transfer speeds without using compression, deduplication or caching. Instead AI controlled data parallelisation mitigates latency and packet loss to improve utilisation to >90%.

Features

• Works with any file type
• Does not examine data (“fire & forget”)
• Encrypted data transfers at the same speed as unencrypted data
• In-flight iSCSI / FC / SAS protocol conversion available
• Supports up to 40 Gbps circuits
• 100 Gbps support coming soon

Benefits

• Mitigates the effects of latency and packet loss over distance
• Improves backup and RTO response times
• Increases throughput to ~90% of available bandwidth
• AI-controlled, real-time WAN monitoring and tuning
• Available as cloud, virtual, and physical appliance platforms

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Tenders@ocf.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

605747380862085

Contact

Megan Stroud
0114 257 2200
Tenders@ocf.co.uk

About your service

• Service categories:

  Systems Infrastructure Software

  Network

  Network management

  • Network performance management (NPM)
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Any software that uses the TCP/IP protocol to transfer data. This could be backup/recovery software, disaster recovery, data consolidation, migration etc.
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
• Service constraints: No constraints.
• System requirements:
  • IP network connectivity between sites
  • Administrative access to network routing
  • Internet or private WAN connectivity
  • Cloud account for cloud deployments
  • Supported hypervisor for virtual appliance deployments
  • Available compute, memory, and storage resources
  • Power and network connectivity for physical appliances
  • Ability to route traffic via the device
  • Outbound HTTPS access for management
  • No end-user software installation required

User support

• Email or online ticketing support: Yes
• Support response times: This is support tier dependent:; Bronze: Next working day ; Silver: Within one working day; Gold: Within 4 working hours; Platinum: Within 4 hours.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Support via maintenance licence: Bronze (09:00–17:00, device replacement next working day), Silver (Bronze + engineer), Gold (09:00–17:00, device replacement and engineer within 4 hours of diagnosis, next day if after 16:00), Platinum (24/7/365, device replacement and engineer within 4 hours of diagnosis: Next day if after 16:00); channels: email, ticketing, phone; SLA: requests acknowledged within one business day; service continues without licence; no dedicated technical account managers or cloud support engineers provided.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Bridgeworks helps users start using their service by providing full documentation on Bridgeworks website, including a Quick Start Guide to get up and running quickly and a comprehensive software user guide with detailed instructions.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: Users do not need to extract their data when the contract ends because no data is stored within the Bridgeworks system. All data remains within the user’s own environment.
• End-of-contract process: At the end of the contract, the offerings are supplied on an outright sale basis. Ongoing maintenance and support are available for an additional charge. The price of the contract includes the product, while maintenance and support are optional extra costs.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Bridgeworks’ onboarding and offboarding documentation is available on their website and is designed to be accessible for all users. The documentation supports standard accessibility features such as screen readers, keyboard navigation and clear formatting to ensure that users with accessibility needs can access setup, usage, and offboarding instructions effectively.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: None or don’t know
• API: No
• Customisation available: No

Scaling

• Independence of resources: Users are not affected by the demand other users place on the service because bandwidth usage can be scheduled, so that during normal business hours the amount of bandwidth used is limited.

Analytics

• Service usage metrics: Yes
• Metrics types: Service usage and performance metrics are available via standard SNMP interfaces and can be consumed by the customer’s existing monitoring tools.
• Reporting types: Regular reports
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Bridgeworks

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: In-house
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: No
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Users do not export data because no data is stored within the Bridgeworks system. All data remains within the user’s own environment.
• Data export formats: Other
• Other data export formats: No data is stored within the Bridgeworks system.
• Data import formats: Other
• Other data import formats: No data is stored within the Bridgeworks system.

Data-in-transit protection

• Data protection between buyer and supplier networks: Private network or public sector network
• Data protection within supplier network: Other
• Other protection within supplier network: The solution does not operate on a separate network; data remains within the customer’s infrastructure. Protection of data in transit is provided by the customer’s network security measures. For traffic between multiple devices, data uses the customer’s existing network infrastructure; encryption or VPNs can be applied as required by the customer.

Availability and resilience

• Guaranteed availability: The solution is deployed entirely within the customer’s infrastructure (on-premises or cloud VMs), so no formal SLA or guaranteed service availability is provided. Service uptime is determined by the customer’s environment, and the customer retains responsibility for monitoring and continuity. The maintenance licence covers support and feature updates, provided via email, online ticketing, and phone, with SLA response times separate from availability. This approach ensures transparency while allowing customers to deploy and manage the solution according to their operational requirements.
• Approach to resilience: This is available upon request.
• Outage reporting: The solution is deployed entirely within the customer’s infrastructure (on-premises, cloud VMs, or virtual appliances). As such, the service does not have a public dashboard or hosted API to report outages externally. Any service availability issues are detected and managed within the customer’s environment. Where required, updates, notifications, or guidance on potential issues are provided via email to the customer’s designated contacts. Customers retain full control over monitoring and can use existing tools such as SNMP, CLI, or cloud-native monitoring to detect interruptions. This approach ensures that all outage information remains within the customer’s infrastructure and that communication is delivered directly to the relevant personnel.

Identity and authentication

• User authentication needed: No
• Access restrictions in management interfaces and support channels: ACL in place, firewall rules, 2FA where possible; support channel is restricted by Active Directory permissions (support channel takes its permissions via Active Directory connection.)
• Access restriction testing frequency: At least every 6 months
• Management access authentication: Other
• Description of management access authentication: Bridgeworks does not supply a service. Bridgeworks supplies products that run on customer premises. Management access is therefore authenticated within the customer’s own environment.

Audit information for users

• Access to user activity audit information: No audit information available
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Bridgeworks operate an information security management system (ISMS) aligned with ISO/IEC 27001 and UK government security principles. Bridgeworks' information security policies cover governance, risk management, access control, asset management, cryptography, incident management, supplier security, business continuity, and data protection. Overall responsibility for information security sits with the Chief Information Security Officer (CISO), who reports to senior management and has authority to enforce security controls across the organisation. Policy owners are assigned for each security domain, and operational responsibility is delegated to system and service owners. Policies are approved by senior management, reviewed at least annually, and updated following risk assessments, audits, or material changes to services or threats. Compliance is ensured through mandatory staff security awareness training, onboarding and leaver processes, role-based access controls, and documented procedures.; Bridgeworks conducts regular risk assessments, vulnerability management, and internal audits to verify policy adherence. Security incidents and weaknesses are logged, investigated, and reported through a formal incident management process, with corrective actions tracked to completion. Third-party suppliers are assessed for security risks before engagement and monitored throughout the contract lifecycle.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Configuration baselines are defined, documented, and version controlled for all production systems. Changes to systems and services follow a formal change management process including logging, risk assessment, approval, testing, and planned implementation. Emergency changes are subject to expedited approval and post-implementation review.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Only authorised personnel can make changes, enforced through role-based access controls and separation of duties. Rollback procedures are documented and tested to ensure service resilience.Configuration items and change records are retained to provide an auditable trail and are reviewed through management oversight, risk assessments, and internal audits to ensure ongoing compliance and continuous improvement.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Bridgeworks operates protective monitoring aligned with ISO/IEC 27001 and UK NCSC guidance. Security events are identified through centralised logging, system and application monitoring, and alerting for suspicious activity. Logs are protected and retained for investigation. Potential compromises are triaged promptly and escalated to the security function. Incidents follow a formal response process including containment, investigation, remediation, and lessons learned. High-severity incidents are assessed within 24 hours and tracked until closure. Critical systems use tools such as Zabbix, with controlled patching via WSUS and Ubuntu Pro. Vulnerabilities are scanned regularly, and available patches applied within 24 hours of release.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Bridgeworks operates a formal incident management process aligned with ISO/IEC 27001. Pre-defined procedures are in place for common events, including security incidents, service outages, and data breaches. Users can report incidents via designated support channels, which are logged, prioritised, and triaged by authorised personnel.; Incidents are managed through defined stages covering identification, containment, investigation, remediation, and lessons learned. Customers are kept informed as appropriate, and incident reports are provided following resolution, including root cause, impact, actions taken, and preventative measures. Incident trends are reviewed by management to drive continuous improvement.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: A Proof of Capability (POC) is available, with the duration to be confirmed.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 10%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 15%
• Between £2,500,001 and £5,000,000: 15%
• Over £5,000,001: 15%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Citation ISO Certification Limited
• ISO/IEC 27001 accreditation date: Saturday 21 December 2024
• What the ISO/IEC 27001 doesn’t cover: OCF Limited has determined the scope of the Information Security Management System and this is recorded on the ISO 27001:2022 Certificate as follows: 'The design, build, deployment and support of high performance compute, storage, cloud and AI solutions to all sectors'. Activities outside of this scope are not covered by the certification.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: British Assessment Bureau Limited
• ISO 9001 accreditation date: Friday 19 September 2025
• What the ISO 9001 doesn’t cover: OCF Limited has determined the scope of the Quality Management System to cover the provision of IT solutions and related services designed to add value to clients’ businesses through the use of innovative technology, highly skilled personnel, effective project management, and strong partnerships with leading IT vendors. Activities outside of this scope are not covered by the certification.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 0ee0256a-ccf2-4edb-9079-046e14f12f56
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering
    • Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Tenders@ocf.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.