LEAN TREE LIMITED

Internal Developer Platform SaaS (Port.io)

A Port.io internal developer platform providing a web-portal and API allowing teams to manage a software/service catalogue, expose approved self-service workflows (golden paths), and apply standards through configurable policies and scorecards. It integrates delivery/operations tooling to centralise service ownership information, documentation, deployment and operational actions without building a bespoke platform.

Features

• Central software and service catalogue with ownership metadata
• Self-service workflow catalogue for approved tasks (golden paths)
• Templates for scaffolding and standardising new services
• Scorecards and policy checks for standards and compliance
• Tool integrations for source control, CI/CD, incident, and observability
• Role-based access control and audit logging

Benefits

• Reduces manual ticket handling for repeatable platform tasks
• Improves visibility of service ownership and operational readiness
• Supports consistent delivery standards across teams
• Enables safer self-service with governance controls
• Improves onboarding by centralising documentation and workflows

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@leantree.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

865093630269434

Contact

Caroline Topper
07880616068
bidteam@leantree.co.uk

About your service

• Service categories:

  Application Development and Deployment

  Application platforms

  Deployment centric application platforms

  • Application Server Software Platforms
  • Cloud Deployment-Centric Application Platforms
  • Transaction Processing Monitors
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Additional environments or tenants; premium support hours; configuration and onboarding services; additional integrations; custom workflow templates; advanced reporting; managed administration services, subject to Port (port.io) commercial model.
• Cloud deployment model: Public cloud
• Service constraints: Requires outbound HTTPS access from buyer networks to Port. Data ingestion uses push-based methods; inbound connectivity to buyer environments is not required for ingestion. For customers with strict network controls, on-premises Ocean integrations can be deployed in the buyer environment so data can be processed locally and only required results sent to Port. Onboarding timelines depend on integration complexity and buyer readiness; mobilisation is agreed at call-off.
• System requirements:
  • Supported web browser (current mainstream versions)
  • Outbound internet access to Port (port.io) service endpoints over HTTPS
  • Optional identity provider for SSO (SAML 2.0 or OIDC)
  • Optional access tokens or service accounts for tool integrations
  • Optional webhooks and API access for automation

User support

• Email or online ticketing support: Yes
• Support response times: As a professional service, response times are not governed by SLA. Queries are responded to as soon as reasonably practicable during normal UK business hours (Monday to Friday, excluding bank holidays).; ; Where required, extended cover (e.g. evenings, weekends, bank-holidays, or defined response targets) can be agreed at call-off and priced accordingly.; ; Each engagement is supported by a named account manager who acts as a key point of contact. An escalation path is in place, allowing issues to be escalated through senior leadership and, where appropriate, to board-level management, with escalation routes and expectations confirmed at call-off.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Support is provided via email/ticketing with service hours and escalation routes agreed at call-off. Lean Tree provides onboarding support, incident triage and coordination with the vendor where required. Response targets, service hours and any enhanced support options are confirmed and priced during discovery and scoping, then documented in the call-off contract.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: 1. Create tenant and administrator accounts; 2. Configure authentication and user groups (SSO where required); 3. Connect integrations (source control, CI/CD, ticketing, cloud accounts); 4. Import or define services and ownership metadata; 5. Configure templates, workflows, and scorecards; 6. Run pilot onboarding with a small set of teams before wider rollout
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: The buyer can export service catalogue metadata, templates, configuration, and audit information where available. Export methods may include API access and file-based exports. Data extracted and the available export mechanisms are confirmed with Port (port.io) as part of onboarding and documented for the buyer.
• End-of-contract process: End-of-contract includes: agreement of a termination date; data export window; account and integration decommissioning; administrative confirmation of closure; and data deletion in line with Port (port.io) retention and deletion policy. The supplier coordinates the process and provides a checklist to the buyer.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Port (port.io) provides administrator guide, end-user guidance, API reference, configuration examples, and release notes. Administrator guide, end-user guidance, API reference, configuration examples, and release notes are provided. Documentation is accessible online and can be exported or referenced as part of buyer onboarding materials.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Port.io’s user interface is a browser-based internal developer portal dashboard showing a unified software catalogue with services, team context, and metadata drawn from across your toolchain. Users navigate list and card views of services, actions and scorecards, personalised by role; dashboards display metrics and next-best actions. Interfaces support filters, custom views, and widgets tailored to teams or personas. An interface designer lets you customise layouts, colours and branding so the portal fits your organisation. The UI emphasises self-service actions, governance controls, and discoverability across connected systems.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: We have not performed this testing
• API: Yes
• What users can and can't do using the API: Users can use the Port.io API to set up and manage the internal developer portal programmatically. Through the API, they can define and update the software catalogue by creating blueprints, registering services, and attaching metadata from external systems. They can configure scorecards, trigger self service actions, and integrate Port with CI/CD or governance workflows. Users can also make ongoing changes by updating entities, modifying catalogue relationships, and automating operational actions.; ; Limitations exist around UI specific configuration. Some portal layout and visual customisation is primarily handled through the web interface rather than fully through API endpoints. Access is controlled by authentication tokens and role based permissions, so users can only modify resources they are authorised for. Certain administrative settings and complex design changes may require manual setup in the GUI rather than pure API management.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Configurable taxonomy, templates, workflows, scorecards, integrations, and RBAC. Deep custom development is out of scope unless provided as a separate professional service.

Scaling

• Independence of resources: The SaaS service is designed so each buyer organisation operates within an isolated tenant context. Capacity scales within Port (port.io) platform. Any buyer-managed integrations and underlying tools remain independently managed by the buyer.

Analytics

• Service usage metrics: Yes
• Metrics types: Port.io provides service level metrics focused on developer portal adoption, governance, and operational visibility. Metrics include catalogue completeness, ownership coverage, scorecard compliance results, and usage of self service actions. Teams can track how often services are accessed, whether required metadata is present, and progress against engineering standards. Port also surfaces integration driven insights from connected systems such as CI/CD, incident tools, or cloud platforms. Metrics are available in the portal dashboards and can be queried via the API for reporting. Port is not a full observability platform, so deep runtime telemetry depends on external integrations.
• Reporting types: Real-time dashboards
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Port.io

Staff security

• Staff security clearance: Staff screening not performed
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: Export is provided through the service interface and API. The export scope includes catalogue records, configuration, and audit information where available. The buyer can schedule exports prior to termination.
• Data export formats:
  • CSV
  • Other
• Other data export formats: JSON
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • JSON
  • YAML

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Port provides a public status page with live service health and uptime reporting and subscription options. The service is designed for high availability using redundant components. Contractual availability targets, service hours, and any service credits are confirmed and priced during discovery and scoping, then documented in the call-off contract.
• Approach to resilience: The IDP maintains encrypted backups of customer data in multiple AWS regions and has documented business continuity and disaster recovery procedures. The IDP Port (port.io) (Port (port.io)) simulates disaster recovery exercises at least once per year and has a formal business continuity plan available upon request.
• Outage reporting: The Port (port.io) provides service status communications and incident updates during outages. Post-incident summaries may be provided depending on severity and contractual terms.

Identity and authentication

• User authentication needed: Yes
• User authentication: Multi-Factor Authentication (MFA)
• Access restrictions in management interfaces and support channels: Port supports buyer single sign-on (SSO) using external identity providers via OIDC and SAML 2.0. Where configured, authentication (including MFA policies) is enforced through the buyer identity provider. Port can sync users and teams/groups on sign-in (identity provider dependent). Port does not fully support SCIM provisioning at this time; SCIM requirements are confirmed at call-off against the latest Port.io product/security documentation and applicable subscription terms.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Policies and processes cover: access control, cryptography, vulnerability management, incident response, secure development, supplier management, logging and monitoring, and business continuity. Policy documents can be provided to buyers on request where appropriate.
• Software Security Code of Practice: No

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Changes are requested, assessed for impact and risk, approved, implemented, and reviewed. Buyer-facing configuration changes follow buyer approval. Port (port.io) platform changes follow Port (port.io) release controls. Integrations and workflows are version controlled where possible.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: The IDP Port (port.io) (Port (port.io)) uses tooling such as Snyk (dependency vulnerability scanning), Trivy (container vulnerability scanning), and Semgrep (SAST). They also publish a vulnerability remediation timeline by severity (e.g., Critical within 30 days, High within 60 days, Medium within 120 days, Low within 180 days). The IDP undergoes annual third‑party penetration testing; a summary of findings is available upon request.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Monitoring rules and alerting focus on availability, performance, and suspicious administrative activity. Logs support investigation and audit. Buyers can request relevant log extracts subject to access controls and data protection.
• Incident management type: Supplier-defined controls
• Incident management approach: Incidents are logged, prioritised and handled through defined processes with triage, escalation and stakeholder updates agreed at call-off. Where a security incident affects buyer data, Port notifies customers as soon as possible and provides periodic updates during the day covering progress and impact. Response and resolution targets and any service levels are confirmed and priced during discovery and scoping, then documented in the call-off contract.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Trial availability is subject to Port (port.io) commercial model. Where trials are offered, they are time-limited and provided under standard trial terms.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 1%
• Between £500,001 and £1,000,000: 2%
• Between £1,000,001 and £2,500,000: 3%
• Between £2,500,001 and £5,000,000: 4%
• Over £5,000,001: 5%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 526831bd-54c9-4669-bf75-d6eb1c0d6521
• Cyber essentials plus: No
• Cyber Essentials Alternative: You do not have a current and valid Cyber Essentials Plus certificate, or will not have in place within 12 months of the date of award but have an IASME certified equivalent.
• Other security certifications: Yes
• Any other security certifications: Cyber Assurance

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@leantree.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.