IOCO SOLUTIONS LIMITED

Hoverfly Cloud Service Virtualisation

Hosted, high-performance API simulations for development environments and CI pipeline. Replace unreliable test environments or restrictive API sandboxes with hosted simulations during development and testing. Start a simulation in seconds, scale it to handle performance tests, then shut it down - use the command line, UI or a CI task.

Features

• API Simulation tool for Service Virtualization
• REST and SOAP services over HTTP/HTTPS
• Clones real APIs during development and testing
• Functional and performance testing against simulated APIs
• Integrates with most CI/CD and SCM solutions

Benefits

• Eliminate external service constraints, eliminate delays waiting for test resources
• Simulate business and performance scenarios
• Test for observed and extreme conditions
• Make testing routine and repeatable
• Reduce costs: Reduce hardware, software and consultancy investment
• Accelerate software release cycles and eliminate waste
• Produce tests quickly and effectively
• Improve Quality: Create more comprehensive test suites

£4,800 to £4,800 an instance a year

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at michael.morey@ioco.tech. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

369205181283305

Contact

Mick Morey
0118 206 2938
michael.morey@ioco.tech

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: Weekly and monthly maintenance windows are in place to allow for security and application fixes to be applied.
• System requirements:
  • Internet Access
  • Web Browser

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Severity 1 (Critical Service Incident) - Within 1 hour ; Severity 2 (Critical Service Incident) - Within 2 hour ; Severity 3 (Non-Critical Service Incident) - Within 4 business hours Severity 4 (Minor Support Request) - Within 1 business day or see service catalogue
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: We provide a service desk to log incidents and support requests. Calls are prioritised based on severity and assigned accordingly. 4 Levels of severity is classified. The service included 3 levels of support engineers cloud-; based on skill level (i.e 1st , 2nd and 3 rd level support ) as well as a vendor escalation process.We provide a client account manager and a cloud architect, as well as Service delivery manager where appropriate.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Extensive user documentation and help website. ; ; Training can be quoted on request.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Data is not owned by the provider and can be extracted at anytime by the customer. Customer requirements for the data extraction will be agreed prior to completion of the contract.
• End-of-contract process: Customer has 30 days from expiry of contract to extract all required data.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: Most functions of the application are available through the API including set up, starting and making changes to services.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: The application provides enough overhead to allow users to scale their demand elastically. Functionality based on Kubernetes.

Analytics

• Service usage metrics: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Via Web interface or API.
• Data export formats: Other
• Other data export formats: JSON
• Data import formats: Other
• Other data import formats:
  • Swagger
  • JSON

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: Data is encrypted at rest and in transit.

Availability and resilience

• Guaranteed availability: SLA 99.9% availability. ; If service fails to meet this key objective in a given calendar month 5% of prorated monthly cloud service fee will be refunded directly to the customer account within 30 days.
• Approach to resilience: Available on request.
• Outage reporting: Email alerts.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Restricted and vetted named users are allowed administrative access to the application management areas.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: Between 1 month and 6 months

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: Yes
• Any other security certifications: INFORMATION SECURITY MANAGEMENT SYSTEM ISO/IEC 27001:2013 for the Datacentre

Security governance

• Named board-level person responsible for service security: No
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: The change management processes follow ISO27001 A.12.1.2 controlled mechanism for making changes to operational environments.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: The change management processes follow ISO27001 A.12.1.2 controlled mechanism for making changes to operational environments.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We subscribe to multiple vendor provided vulnerability notification services. All vulnerabilities are reviewed and applicable patches are administered through the change control process . Mitigation measures will always be considered first, with critical patches targeted for resolution within 30 days.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Denial of Service is applied on all Internet links , with Intrusion detection\protection available to customers on request. ; All security events are logged\notified based on severity. Any attempted platform security compromises are dealt with 24/7 by security engineers. The responsibility remains with the customer to ensure detected intrusions are re-mediated where customers have control, permission, or access to modify their service. iOCO recommends that customers follow security best practices including, but not limited to: ; • Maintaining effective firewall rules ; • Limiting the communication ports to only the necessary, for conducting business ; • Locking down access
• Incident management type: Supplier-defined controls
• Incident management approach: The incident response process complies with industry standards for legally admissible chain-of-custody and forensic data collection management processes and controls. Response standards, procedures, and methods are implemented based on the severity level of an incident. Incident reports are produced as part of standard post incident process and provided to customers on request.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  Fighting climate change

  Fighting climate change

  Hoverfly Cloud is used to virtualize away expensive and power hungry back-end systems reducing carbon emissions and thus contributing to fighting climate change.

Pricing

• Price: £4,800 to £4,800 an instance a year
• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Access to the Hoverfly Cloud platform for 2 weeks. ; Support is provided on a best endeavours basis.
• Link to free trial: https://hoverfly.io/pricing

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at michael.morey@ioco.tech. Tell them what format you need. It will help if you say what assistive technology you use.