UST Global Pvt Ltd

UST Generative AI (GenAI) Sandbox

UST's GenAI Sandbox is a dynamic platform for safely experimenting with Generative AI, supporting use cases like document summarization and intelligent search. It integrates with Azure, AWS, or Google Cloud, simplifies using multiple LLMs, and connects with your data for impactful results, all while upholding Responsible AI principles.

Features

• Rapid prototyping
• Customisation and Flexibility
• Business Data Integration
• Secured and Controlled Environment
• Continuous Learning
• Responsible AI
• Fast Deployment
• Tailoring GenAI Cards
• Technology Agnostic
• Security

Benefits

• Prototypes Gen AI use cases from concept to deployment
• Ability to adopt different industry needs and use cases
• Provide complete data control within Client environment for GenAI experimentations
• Platform deployed in client’s Cloud subscription
• Continuously refine GenAI prompts as more data becomes available
• Robust guardrails including auditability, logging, managing sensitive language, cost controls
• Sandbox deployed to client environment and ready-to-use within 2 days
• We configure bespoke use-cases that integrate with Client enterprise data
• Sandbox be configured with your choice of cloud services, LLMs
• Sandbox is deployed on client cloud tenant, maintains data security

£48,000 a unit a year

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at ukpublicsectorsales@ust.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

115612896046637

Contact

Patrick Marren
07544102103
ukpublicsectorsales@ust.com

Service scope

• Service constraints: Currently major LLMs from providers like Azure, AWS and Google are supported but any customer specific LLM will require feasibility study to be integrated to Sandbox
• System requirements:
  • Frontend setup with either Low Code or No-code platforms
  • Azure or Google or AWS services Subscription and their LLMs

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Response time is within 72 hours
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: For subscribed customers, we provide an account manager to support interactions. Access to online knowledge base documents and FAQs. Email support with a guaranteed response time within 48-72 hours. Monitoring of the sandbox environment to anticipate and resolve issues periodically. Help with configuring and customising for specific business needs. Tailored training to help address needs within specific use cases and scenarios.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: We will provide online training and relevant user documentation
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: Data will be residing within the client’s cloud subscription environment. At the end of contract, we will only remove the deployed platform services.
• End-of-contract process: The price of the contract will cover charges for subscribed platform fee, initial deployment support, maintenance, and minor enhancements to the Sandbox. For any additional customisations and integrations to data sources or customer applications will be addressed through an additional sprint fee charged at GBP 10,000 per sprint (sprint will follow a 4 week sprint schedule).

Using the service

• Web browser interface: Yes
• Using the web interface: Users will have access to Canvas through the web interface, where they will have access to cards they create, and cards shared to them by other users. Users cannot connect to data sources dynamically and the same is available on request.
• Web interface accessibility standard: None or don’t know
• How the web interface is accessible: It is accessible as a secure website (using SSL).
• Web interface accessibility testing: The web interface is developed using the low code and no code platforms which adheres to most common testing standards.
• API: Yes
• What users can and can't do using the API: All use cases (cards) created by users within the platform will have relevant API end points, through which the users can connect.
• API automation tools:
  • Ansible
  • Terraform
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• Command line interface: No

Scaling

• Scaling available: No
• Independence of resources: Platform is deployed in client’s environment. It is not a multitenant deployment
• Usage notifications: No

Analytics

• Infrastructure or application metrics: Yes
• Metrics types:
  • CPU
  • Disk
  • Number of active instances
• Reporting types:
  • API access
  • Real-time dashboards
  • Reports on request

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: In-house
• Protecting data at rest: Other
• Other data at rest protection approach: Data will reside on hyperscaler provisioned cloud environment. The sandbox access will be routed through application gateway and firewalls. Standard cloud security will be enabled for all data stores used in the Sandbox,
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

• Backup and recovery: No

Data-in-transit protection

• Data protection between buyer and supplier networks: IPsec or TLS VPN gateway
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Our Service will follow standard Response to emails within 72 hours and Recovery SLA within 5 working business days. Any services dependent on Hyperscalers will not be guaranteed within the mentioned Service Levels as those are governed by the respective Hyperscalers.
• Approach to resilience: GenAI Sandbox is deployed within client’s chosen cloud environment and meant to be a Sandbox environment. Service resilience will depend on region availability and capabilities provided by the public cloud providers.
• Outage reporting: Email Alerting is in place and users will receive notification on specific platform outages from the support team

Identity and authentication

• User authentication:
  • Identity federation with existing provider (for example Google apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Management interfaces are access controlled via role based accessed control. Clients can define who are members of Administrator role. All authentication will be done against existing enterprise identity and access management systems
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Devices users manage the service through:
  • Dedicated device on a segregated network (providers own provision)
  • Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: User-defined

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Intertek
• ISO/IEC 27001 accreditation date: 25/09/2023
• What the ISO/IEC 27001 doesn’t cover: The certification includes application development, application management, infrastructure management services, engineering services, business process, outsourcing services, support functions such as human resources, finance, workplace management, sales & marketing, information services, information security management system, covering on-premises and cloud environments within UST.
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: Yes
• Any other security certifications:
  • ISO 22301
  • SOC1 SOC2 type II

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Information security is headed by Chief Information Security Officer, who reports to CIO.; UST has undergone the certification process on and has been audited by KPMG for BS7799-2:2002 and was upgraded to ISO 27001:2005 by Intertek (Subsidiary of KPMG) which is a widely recognized security standard having a significant number of control requirements. Later it was upgraded to ISO 27001:2013 by Intertek. In 2023, it is upgraded to ISO 27001:2022 by Intertek. In addition to the ISO 27001:2022 certification, UST is also certified for Business Continuity Management ISO 22301:2019, HITRUST, SOC2 Type II and Cyber Essentials/CE+. UST’s Information Security Policy ensures the following: ; 1. Information is protected from any unauthorized access.; 2. Confidentiality of information.; 3. Integrity of information is maintained.; 4. Availability of information for business processes is maintained.; 5. Legislative and regulatory requirements are met.; 6. Actual or suspected information security breaches are identified, reported, and investigated.; 7. Business continuity plans are developed, maintained, and tested.; 8. Third Party Supplier Security Assessments are done.

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: The Configuration management is managed by Delivery excellence team who have dedicated resources to manage the configuration management. The change management is managed by ITGC team and they follow ITIL framework
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: We follow Agile development framework for our platform development and enhancements with features or changes pushed through releases planned in a monthly cycle. Part of the sprints we follow the DevSecOps to assess potential security impacts and vulnerabilities.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Our Sandbox platform employs standard protective monitoring processes, including regular system scans and anomaly detection to identify potential compromises. We also allow customer’s security organization to add protective monitoring over and above our standard process. When a potential threat is detected, our team is notified promptly, and we aim to respond to incidents within a few hours, ensuring quick and effective resolution to maintain the platform's integrity.
• Incident management type: Supplier-defined controls
• Incident management approach: Standard monitoring is in place to capture events and alerts generated. Form will be provisioned within the sandbox to raise user reported incidents. Additionally, users could reach support through email.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
• Who implements virtualisation: Supplier
• Virtualisation technologies used: VMware
• How shared infrastructure is kept separate: Logically separated and each VM is managed through User Management

Energy efficiency

• Energy-efficient datacentres: Yes
• Description of energy efficient datacentres: Sustainability is a key part of our design philosophy and our efficient new data centers. We prioritize the decarbonization; and establishment of circular IT infrastructure, while also focusing on designing and implementing cloud migration and operations. Monitor and report on power and energy consumption, Aisle cooling for data centers, Reduce energy consumption where possible.

Social Value

• Social Value:

  Social Value

  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Tackling economic inequality

  UST engages in numerous initiatives for tackling economic inequality, these include: ; • Working with local Combined Authorities and training providers to build training courses (focussed on digital skills) for economically disadvantaged citizens. ; • People who engage in these courses can then be hired by UST into full-time roles and begin their career in technology. ; • UST support closing skills gaps in key technology areas e.g. UST have developed a mobile application to support the development of skills in Artificial Intelligence for 3 key user profiles – those looking to start a career in AI, those looking to move into an AI role, and citizens who are interested in AI.; • UST are keen to support local SME’s and can agree with a buyer as to how many local SME’s will be utilised in an engagement. ; • UST invest significant sums into innovation aimed at delivering more productivity at lower cost e.g. we have developed our own Generative AI Testing platform.

  Equal opportunity

  UST engages in numerous initiatives for promoting equal opportunities, these include: ; • Working TechSheCan to enable great access to women within the world of tech careers. UST also invested in building the training platform for TechSheCan.; • UST work with numerous partners to support veterans who want to start a carer in Tech once they have left the military.; • UST are an equal opportunities employer and do not discriminate on the basis of age, sex, gender, disability, or religion. We can share our policies and process for this to support discussions. ; • UST have published a detailed Modern Slavery statement and have processes in place to support this. More details can be found at: https://www.ust.com/content/dam/ust/documents/modern-slavery-statement-2022.pdf; • UST works with local skills development partners to support the development of tech skills amongst numerous societal groups.

  Wellbeing

  • UST have developed a Digital Inclusion Community App to support the development of essential digital skills amongst digital excluded people. This enables citizens to be able to use digital services, from both Public and Private organisations, driving a more integrated digital community.

Pricing

• Price: £48,000 a unit a year
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Customers will have choice to opt out in 8 weeks if they do not wish to continue. During this period, customers will access to only pre-built cards for testing and experimentation.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at ukpublicsectorsales@ust.com. Tell them what format you need. It will help if you say what assistive technology you use.