XTRAVIRT LIMITED

VMware Cloud Foundation on Private Cloud

VMware Cloud Foundation (VCF) is a full-stack private and hybrid cloud platform that integrates compute, storage, networking, security, and cloud management into a single automated solution.

This service provides access to VMware Cloud Foundation software as a subscription-based offering.

Features

VMware Cloud Foundation 9 full-stack private and hybrid cloud platform
Unified lifecycle management across compute, storage, networking, firmware
Declarative infrastructure configuration with drift detection and compliance
Integrated NSX networking and security
Native Kubernetes platform services integrated into SDDC operations
Policy-driven resource management and workload placement
Secure multi-tenant isolation for shared cloud environments
API-first platform supporting infrastructure-as-code automation
Built-in capacity, health, and utilisation visibility
Private AI infrastructure support for secure enterprise AI workloads

Benefits

Consistent private and hybrid cloud operations across all environments
Reduced operational effort through automation and standardised workflows
Faster infrastructure provisioning with repeatable, policy-driven processes
Improved security using integrated networking and access controls
Simplified platform upgrades with full-stack lifecycle management
Supports legacy, modern, containerised, and AI workloads together
Predictable platform performance through proactive monitoring and management
Enables Private AI while maintaining data sovereignty and control
Simplifies cloud exit and workload portability

Service documents

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at accounts@xtravirt.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

Contact

XTRAVIRT LIMITED Chris Willliams
Telephone: 08004880038
Email: accounts@xtravirt.com

About your service

Service categories

IaaS

IaaS Compute

Container and serverless engine compute

Virtualised x86

General purpose
Compute optimised
Memory optimised

Accelerated

GPUs
APUs

Service scope

Service constraints: VMware Cloud Foundation must be deployed on VMware-supported hardware or cloud platforms and aligned to published reference architectures. Platform maintenance, patching, and upgrades are performed in line with VMware product requirements and may require planned maintenance windows. Capacity expansion is dependent on the underlying infrastructure. Third-party products and integrations must be compatible with the VMware Cloud Foundation release in use. Platform behaviour and availability are influenced by design and configuration choices.
System requirements: Supported hardware or cloud platform meeting VMware compatibility requirements

Network connectivity between customer environment and management components

DNS, NTP, and IP addressing services available

Identity provider integration for authentication and access control
Cloud deployment model: Public cloud

Private cloud

Hybrid cloud

User support

Email or online ticketing support: Yes
Support response times: Support response times are provided in line with Broadcom Global Support Services for VMware Cloud Foundation licences.

Severity 1 (Critical): 30 minutes, 24x7

Severity 2 (High): 2 business hours

Severity 3 (Medium): 4 business hours

Severity 4 (Low): 8 business hours

Response times, coverage, and resolution depend on the VMware support tier purchased.
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: None or don’t know
Phone support: Yes
Phone support availability: 24 hours, 7 days a week
Web chat support: No
Onsite support: Yes, at extra cost
Support levels: Support for VMware Cloud Foundation is provided in line with Broadcom Global Support Services for the licence purchased.

Broadcom offers multiple support tiers, for example Essential and Production, with different response targets and service features. Support levels, coverage hours, and response times are defined by Broadcom and vary by tier.

Support costs are included in, or added to, the licence price depending on the selected Broadcom support tier. Full details are set out in the pricing and licence documentation.

This service does not include a Technical Account Manager or Cloud Support Engineer from the supplier. Any named support contacts, account management, or enhanced support services are provided only where included within the Broadcom support offering.
Support available to third parties: Yes

Onboarding and offboarding

Getting started: Users can start using VMware Cloud Foundation through VMware-provided documentation, online resources, and support materials included with the software licence.

Xtravirt can provide optional services, including onboarding assistance, architecture guidance, knowledge transfer, training sessions, and professional services, if purchased separately. These services are not included as part of the standard licence-only offering.
Service documentation: Yes
Documentation formats: HTML

PDF
End-of-contract data extraction: End-of-contract data extraction

Customer data remains under the customer’s control at all times. VMware Cloud Foundation stores workloads using standard VMware virtual machine formats. Users can export, migrate, or transfer their data using VMware-supported tools and processes both during and after the contract term.

No supplier-led data extraction is required, as the service provides software licences only and does not store or manage customer data.
End-of-contract process: At the end of the contract, access to the VMware Cloud Foundation software licences ends in line with the agreed licence terms. Customers remain responsible for their infrastructure, workloads, and data.

The contract price includes the right to use the software and the associated VMware support entitlement for the contract term. No service transition or operational activities are included.

Any additional services, such as licence renewal, professional services, training, or migration assistance, are available at additional cost if required.
Documentation accessibility standard: EN 301 549

Using the service

Web browser interface: Yes
Using the web interface: Users access VMware Cloud Foundation through VMware web management interfaces.

Users can:

Access VMware management consoles provided with the licence

Configure and manage platform components within product capabilities

Create, modify, and manage workloads and resources

View system status, alerts, and usage information

Access documentation and support portals

Users cannot:

Bypass VMware licence or product limitations

Perform actions restricted by role-based access controls

Access features not included in the purchased licence edition

Make changes that conflict with VMware product constraints or supported configurations

Initial setup, configuration options, and available functions are defined by the VMware Cloud Foundation product and the licence purchased. All changes made through the web interface are subject to VMware product controls and user permissions.
Web interface accessibility standard: EN 301 549
Web interface accessibility testing: No independent web interface testing with assistive technology users has been carried out by the supplier. Accessibility testing of the web interfaces is performed by VMware as part of its product development and assurance processes.
API: Yes
What users can and can't do using the API: Users interact with VMware Cloud Foundation using VMware-provided APIs.

Users can:

Use VMware APIs to manage and automate supported platform functions

Provision and manage workloads and resources within licensed capabilities

Configure networking, security, and policies exposed by the APIs

Integrate with automation and infrastructure-as-code tools

Users cannot:

Perform actions not supported by the VMware Cloud Foundation APIs

Access features or operations outside the purchased licence edition

Bypass product controls, security policies, or role-based access restrictions

Use APIs to override unsupported configurations or platform constraints

Service setup, available API functions, and permissible changes are defined by the VMware Cloud Foundation product and licence purchased. API usage is subject to VMware documentation, permissions, and supported configuration limits.
API automation tools: Ansible

Chef

OpenStack

SaltStack

Terraform

Puppet
API documentation: Yes
API documentation formats: Open API (also known as Swagger)

HTML

PDF
Command line interface: Yes
Command line interface compatibility: Linux or Unix

Windows

MacOS
Using the command line interface: Users interact with VMware Cloud Foundation using VMware-supported command line tools.

Users can:

Use CLI tools to manage and automate supported platform functions

Create, modify, and manage workloads and resources

Configure networking, storage, and security features exposed by the CLI

Integrate scripting and automation within licensed capabilities

Users cannot:

Perform initial platform deployment unless supported by VMware tools

Access features not included in the purchased licence edition

Bypass VMware product controls, permissions, or security restrictions

Apply unsupported configurations through command line access

Available CLI functions and setup options are defined by VMware Cloud Foundation capabilities and the licence purchased. All actions are subject to role-based access controls and VMware product limitations.

Scaling

Independence of resources: This service provides software licences only. VMware Cloud Foundation is deployed within each customer’s own infrastructure or cloud environment. Resources are not shared between customers unless the customer chooses to do so. Demand or usage by other customers has no impact on an individual customer’s environment, as capacity, performance, and isolation are determined by the customer’s own infrastructure design and configuration.
Usage notifications: Yes
Usage reporting: API

Email
Optimising consumption: Yes
Automatic scaling: Yes

Analytics

Infrastructure or application metrics: Yes
Metrics types: CPU

Disk

Memory

Network

Number of active instances

Other
Other metrics: Platform Health

Events

Performance Logs
Reporting types: API access

Real-time dashboards

Regular reports

Reports on request
Resource tagging: Yes
FOCUS resource tagging: Yes

Resellers

Supplier type: Reseller providing extra features and support
Organisation whose services are being resold: Broadcom (VMware), Omnissa, Veeam, Google, AWS, Dell, HP, Dynatrace, Microsoft

Staff security

Staff security clearance: Conforms to BS7858:2019
Government security clearance: Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom

European Economic Area (EEA)

Other locations
User control over data storage and processing locations: Yes
Datacentre security standards: Supplier-defined controls
Penetration testing frequency: At least once a year
Penetration testing approach: Another external penetration testing organisation
Protecting data at rest: Physical access control, complying with another standard

Encryption of all physical media

Other
Other data at rest protection approach: Data at rest is protected using VMware Cloud Foundation security features and the controls implemented by the customer. This includes encryption capabilities provided by the platform, access controls, and secure key management where configured. Physical protection of storage media, backup handling, and retention policies are defined and enforced by the customer within their own infrastructure or chosen hosting environment.
Data sanitisation process: Yes
Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data Erasure

Backup and recovery

What’s backed up: VMware Cloud Foundation management component configuration data

Platform monitoring, logging, and audit configuration data
Backup controls: Platform-level backups cover VMware Cloud Foundation management components and configuration data. These backups are managed as part of the managed service. Workload-level backups, including virtual machines, files, and databases, are controlled by the customer using their chosen backup solution. Customers define backup scope, frequency, retention, and recovery policies for workloads. Xtravirt can advise on supported backup solutions and integration if required.
Datacentre setup: Multiple datacentres with disaster recovery

Multiple datacentres

Single datacentre with multiple copies

Single datacentre
Scheduling backups: Users schedule backups through a web interface
Backup recovery: Users can recover backups themselves, for example through a web interface

Users contact the support team
Backup and recovery: Yes
RPO/RTO: No

Data-in-transit protection

Data protection between buyer and supplier networks: Other
Other protection between networks: This is a subscription and licence-only service. The supplier does not operate or connect to a network on behalf of the buyer. Data in transit protection is implemented and managed by the buyer within their own environment, using Omnissa-supported security controls and industry-standard protocols such as TLS and VPN technologies where required.
Data protection within supplier network: Other
Other protection within supplier network: Data protection within supplier network

Other

Other protection within supplier network

The supplier does not transmit, process, or handle customer data as part of this service. All network connectivity, encryption, and data-in-transit protections are the buyer’s responsibility and are configured within buyer-managed infrastructure and supported deployment architectures.

Availability and resilience

Guaranteed availability: This service provides software licences only and does not include a guaranteed availability service level. Availability of VMware Cloud Foundation depends on the customer’s infrastructure design, configuration, and operational practices.

Xtravirt can help ensure a design aligned to VMware best practices that supports high availability and resilience, where required, through optional advisory or professional services. VMware Cloud Foundation includes software features that support high availability when correctly designed and configured.

As no availability guarantee is provided as part of this licence-only service, no service credits or refunds apply.
Approach to resilience: VMware Cloud Foundation is designed to support resilient private and hybrid cloud architectures through software features such as workload restart, clustering, and distributed services. The level of resilience achieved depends on how the software is deployed and configured.

The service is delivered as software licences only. Datacentre resilience, including power, cooling, physical security, and geographic separation, is provided by the customer’s chosen facilities or cloud provider.

Xtravirt can provide optional design guidance aligned to VMware reference architectures to support resilient deployments. Detailed resilience designs are agreed with the customer and are available on request.
Outage reporting: This service provides software licences only and does not include active outage monitoring or reporting by the supplier.

Outage information is provided through VMware by Broadcom support channels, which may include:

Online support portals for case updates

Email notifications related to logged support cases

There is no public status dashboard or supplier-operated outage API for this licence-only service. Any platform or infrastructure outage reporting is dependent on the customer’s environment and monitoring tools.

Identity and authentication

User authentication needed: Yes
User authentication: Multi-Factor Authentication (MFA)

Identity federation with existing provider (for example Google Apps)

Username or password
Access restrictions in management interfaces and support channels: VMware Cloud Foundation 9 management interfaces use role-based access controls to restrict access to authorised users. Access is authenticated using VMware identity services and permissions are assigned based on platform roles.

Support access is provided through authenticated Broadcom support portals associated with the VMware Cloud Foundation licence. Administrative actions and access events are logged in line with VMware Cloud Foundation security capabilities.
Access restriction testing frequency: At least once a year
Management access authentication: Multi-Factor Authentication (MFA)

Identity federation with existing provider (for example Google Apps)

Username or password
Devices users manage the service through: Dedicated device on a segregated network (providers own provision)

Dedicated device on a government network (for example PSN)

Dedicated device over multiple services or networks

Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)

Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: User-defined
Access to supplier activity audit information: Users have access to real-time audit information
How long supplier audit data is stored for: User-defined
How long system logs are stored for: User-defined

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001
Information security policies and processes: This service is licence and subscription only. The supplier does not operate, host, or process customer data as part of the service.

The supplier follows documented information security policies and processes aligned to ISO/IEC 27001, including governance, risk management, access control, incident management, and supplier assurance. Policies are approved at senior management level and reviewed regularly. Compliance is enforced through internal controls, mandatory staff training, and periodic audits. Any security incidents related to supplier activities are reported through established escalation and governance channels.

Operational security

Configuration and change management standard: Supplier-defined controls
Configuration and change management approach: Configuration and change management follow VMware product lifecycle and release management processes. Software components are versioned, tracked, maintained, and retired through controlled release processes.

Changes are assessed by VMware for operational and security impact prior to release, including security testing and vulnerability assessment. Customers control when changes are applied within their own environments.
Vulnerability management type: Supplier-defined controls
Vulnerability management approach: VMware manages vulnerabilities in line with its product security and maintenance processes.

Potential threats are assessed using internal security reviews, vulnerability scanning, and risk analysis during product development and maintenance. Threat intelligence is sourced from internal research, vendor and partner disclosures, industry threat feeds, and responsible security researchers.

Security patches and mitigations are developed, tested, and released by VMware based on severity and risk, in accordance with the Broadcom maintenance policy. Updates are made available to customers through standard release and advisory channels. Customers are responsible for applying patches within their own environments.
Protective monitoring type: Supplier-defined controls
Protective monitoring approach: Broadcom implements protective monitoring of its information systems and environments in alignment with documented security practices. Monitoring includes collection and analysis of logs and security events, automated detection of anomalies, and alerting based on known threat patterns.

Potential compromises are identified through continuous monitoring, event correlation, and threat intelligence feeds. When a suspected compromise is detected, Broadcom’s security operations teams triage the event, investigate root cause, and initiate containment and mitigation actions in line with documented procedures.

Response actions are prioritised based on risk and severity. High-impact security events are addressed promptly according to Broadcom’s incident response processes.
Incident management type: Supplier-defined controls
Incident management approach: VMware operates documented incident management processes for its products and support services.

Pre-defined procedures exist for common operational and security incidents. Incidents are reported by users through Broadcom support portals, phone, or other published support channels.

Incident updates and resolution information are provided through the support case system. Where applicable, incident summaries and post-incident information are shared in line with VMware and Broadcom support and contractual terms.

Customers remain responsible for incident management within their own environments.
Post-quantum cryptography secure: No

Secure development

Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Separation between users

Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
Who implements virtualisation: Third-party
Third-party virtualisation provider: VMware
How shared infrastructure is kept separate: Separation is enforced using VMware hypervisor-based virtualisation and software-defined networking. Workloads are isolated at compute, storage, and network layers. NSX provides logical network segmentation and micro-segmentation to control traffic between environments. Role-based access controls restrict management access by organisation and user role. Resource controls and policies prevent one organisation’s workloads from impacting another. Physical separation and facility security are provided by the buyer’s infrastructure where applicable.

Energy efficiency

Energy-efficient datacentres: No

Pricing

Discount for educational organisations: No
Free trial available: No

Discount

Provide your minimum discount applicable to your baseline prices: 0.01%

Formula for calculating price of your services

Which of the core deployment models you intend to offer

Private Cloud

Private Cloud - Formula for calculating price of your services

Total Cost: The Total Cost for a buyer's call off requirement in a Private Cloud Deployment
=
Baseline Pricing: See GCloud Service offerings
-
Minimum Discounting: 0.01%
+
Onboarding Activity: Onboarding costs may vary based on your specific requirements, please confirm with suppliers during the clarification process
+
Additional sources of cost: - Customer specific architecture and design
- buyer specific / custom deployment requirements
- Additional licenses for dependent surround services
- integration to existing buyer services
- buyer specific networking, security, identity needs
- allocation of buyer technical specialists to support implementation
-
Additional sources of cost reduction: - use of standardised services
- accelerated deployment timelines
- retirement of existing services

Mandatory certifications

Are you are bidding to offer IaaS and/or PaaS as a reseller or are you in sole control of the infrastructure

Reseller

Cloud service suppliers you intend to resell with evidence

Organisation 1

Organisation name

Broadcom / VMware