CLOUD APPLICATION SERVICES LTD

Application Development Services

We design, build and deliver bespoke cloud-based applications tailored to client requirements. Using Agile delivery, we provide secure, scalable and standards-compliant software, including integration and testing. This service covers application development and enhancement only; ongoing support is also provided via GCloud but under a different lot - Cloud Support.

Features

• Bespoke cloud application design and development
• Agile delivery with iterative releases and stakeholder feedback
• Secure, scalable cloud-native application architectures
• Integration with existing systems and third-party services
• Standards-based development using modern technologies
• Automated testing and quality assurance processes
• Data modelling, migration and integration support
• Cloud platform–agnostic application design
• Accessibility and compliance built into development lifecycle
• Deployment-ready applications for cloud environments

Benefits

• Deliver tailored digital services aligned to specific business needs
• Accelerate delivery through iterative Agile development approaches
• Improve service reliability with robust, scalable application design
• Reduce manual processes through bespoke workflow automation
• Integrate systems to eliminate duplication and data re-entry
• Enhance user experience through user-centred application design
• Enable faster change through modular, maintainable software
• Improve data accuracy through consistent validation and integration
• Support secure digital transformation across cloud environments
• Increase organisational efficiency through modern cloud-based applications

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@cloudapplicationservices.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

377940858287907

Contact

Niall Curran
+442895926001
info@cloudapplicationservices.com

About the service

• Service categories:
  • Application Development and Deployment
    • Application development
      • Development languages, environments and tools
        • Development languages, environments and tools
      • Software construction components
        • Software construction components
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Existing cloud-based line-of-business, case management, and enterprise applications, where bespoke development extends functionality, integrations, workflows, or user interfaces, or delivers new standalone applications.
• Cloud deployment model:
  • Public cloud
  • Hybrid cloud
• Service constraints: Delivery is limited to application design, development, testing and deployment. Hosting, infrastructure provisioning, and ongoing operational support are not included and must be provided by the client or a separate Cloud Support service. Delivery timelines depend on timely access to client stakeholders, documentation, environments and third-party systems. Integration work is subject to availability and stability of external APIs and services. Security and compliance requirements may affect delivery approach and timescales.
• System requirements:
  • Client-provided cloud environment or approved development hosting
  • Access to required development, test and deployment environments
  • Appropriate user access to existing systems and APIs
  • Supported modern web browsers for application access
  • Client-managed cloud subscriptions and billing arrangements
  • Network connectivity between cloud and integrated systems
  • Required software licences provided by the client
  • Secure authentication and identity management services available
  • Compliance with client security and governance standards
  • Availability of technical documentation and integration specifications

User support

• Email or online ticketing support: Yes, at extra cost
• Support response times: Responses to support queries are provided during UK business hours, Monday to Friday. Initial responses are typically provided within one business day. Response times outside business hours, including weekends and public holidays, are not guaranteed unless specifically agreed as part of a separate support or managed service arrangement.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: No
• Support levels: Support under this service is limited to development-related assistance during delivery and agreed warranty periods. Support is provided on a time-and-materials basis and charged at the published day rates. Typical support includes defect fixes, clarification of delivered functionality, and minor configuration adjustments.; ; No standard service levels, incident classifications, or 24x7 coverage are included within this service. A dedicated Technical Account Manager or cloud support engineer is not provided as standard, but may be made available on request and charged separately.; ; Ongoing operational support, managed services, and formal SLAs are all available under a separate (GCloud) Cloud Support service.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Getting started is managed through an agreed project initiation and delivery approach. We support buyers through requirements workshops, design walkthroughs, and onboarding sessions aligned to the specific application being developed. User guidance and technical documentation are provided as part of delivery, tailored to user roles and responsibilities. Training is typically delivered remotely, with onsite sessions available if required and agreed. Support during initial rollout focuses on enabling effective use of the delivered application rather than ongoing operational support, which is available separately under Cloud Support.
• Service documentation: Yes
• Documentation formats: PDF
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: Data extraction arrangements are agreed with the buyer as part of the contract. Where applications developed under this service process or store data, data can be exported in commonly used, open formats such as CSV, JSON, or database extracts. Extraction is supported during the contract or at contract end, subject to buyer requirements and access to the relevant environments.; ; Data extraction support is provided on a time-and-materials basis if required. Hosting environments and live data are typically client-managed; therefore, the buyer retains direct access to their data at all times. Following contract completion, any supplier-held copies of data are securely deleted in accordance with contractual and regulatory requirements.
• End-of-contract process: At the end of the contract, all agreed development activities will have been completed and delivered to the buyer, including source code, documentation, and agreed handover materials. Knowledge transfer and reasonable support to enable transition are included where agreed as part of the contract deliverables.; ; Where required, assistance with data extraction, transition to another supplier, or extended handover support can be provided on a time-and-materials basis at published rates. ; ; Any supplier-held data is securely deleted following contract completion, in accordance with contractual and regulatory requirements.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Applications are typically delivered as responsive web solutions. Functionality is consistent across desktop and mobile devices, with layouts optimised for smaller screens. No separate mobile-only features are provided unless specifically required by the buyer.
• Service interface: Yes
• Description of service interface: The service interface is a web-based user interface delivered as part of each bespoke application. Interfaces are designed to be intuitive, accessible, and responsive, supporting use on desktop and mobile devices. Functionality and presentation are tailored to client requirements and user roles.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Accessibility is considered throughout design and development, with interfaces built to meet WCAG 2.2 AA standards. Testing typically includes keyboard-only navigation, screen reader compatibility (such as NVDA and VoiceOver), colour contrast checks, focus management, and responsive behaviour across devices. Where appropriate, usability testing is carried out with client representatives, including users who rely on assistive technologies. Automated accessibility testing tools are supplemented with manual testing to identify issues not detectable automatically. Accessibility findings are reviewed and addressed as part of the development lifecycle, with remediation prioritised before delivery.
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: APIs are provided as part of bespoke applications to enable integration with external systems. Users can use the API to securely exchange data, trigger application processes, and retrieve application information in line with agreed specifications. APIs are typically REST-based and authenticated using industry-standard security mechanisms.; ; APIs are not used to provision or configure the service itself, but support operational integration once an application is deployed. Changes to API behaviour, structure, or permissions are managed through agreed change control as part of development activities.; ; APIs are limited to the functionality defined for each bespoke application and are not shared across clients. Administrative configuration, infrastructure management, and security controls are not exposed through the API.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Customisation is delivered as part of the application development process. Buyers can customise application functionality, workflows, data models, integrations, user interfaces, and security roles to meet specific business requirements. Customisation is defined through requirements workshops and documented specifications, then implemented by the supplier as part of agreed development activities.; ; Customisation is carried out by the supplier’s development team, with buyer input and approval at each stage. End users do not directly configure or modify the service themselves. Any changes after delivery are managed through agreed change control and are chargeable at published rates.

Scaling

• Independence of resources: Applications are deployed using logically isolated environments and resources appropriate to the buyer’s requirements. Where shared cloud infrastructure is used, isolation is achieved through separate environments, resource allocation, and access controls. Capacity, scaling, and performance characteristics are defined as part of the solution design to ensure one buyer’s usage does not impact another. In client-managed or dedicated environments, buyers retain full control over resources. This approach ensures predictable performance and avoids contention between unrelated users or services.

Analytics

• Service usage metrics: Yes
• Metrics types: Usage metrics are available where implemented as part of the application design, including activity logging, performance monitoring, and audit reporting, depending on buyer requirements.
• Reporting types:
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Data export methods are agreed with the buyer as part of the application design and delivery. Where applications developed under this service store or process data, exports can be performed via built-in export functions, database extracts, or APIs, depending on the solution. Data is provided in commonly used, open formats such as CSV, JSON, or structured database files. Where required, export support can be provided on a time-and-materials basis. In client-managed environments, buyers retain direct access to their data at all times.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • JSON
  • XML
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • JSON
  • XML

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The service is designed for high availability and is hosted on resilient cloud infrastructure with redundancy across multiple availability zones. We guarantee 99.9% service availability per calendar month, excluding planned maintenance and events outside our reasonable control.; ; Availability is measured at the application level and includes core service functionality. Planned maintenance is scheduled outside of core business hours where possible and customers are notified in advance.; ; Service availability is monitored continuously using automated monitoring and alerting. Any service degradation or outage is investigated and resolved in line with our incident management procedures.; ; If monthly availability falls below the guaranteed level, customers are entitled to service credits, calculated as a percentage of the monthly service charge for the affected period. Credits are applied to future invoices upon request and in accordance with the service agreement. Refunds are not provided in cash.; ; The service is backed by documented operational processes including monitoring, incident response, backup, and recovery procedures to minimise disruption and restore service promptly in the event of failure.; ; More detailed SLA terms, including exclusions and credit thresholds, are defined in the contract agreed with each customer.
• Approach to resilience: The service is designed for resilience using cloud-native architecture and operational controls that minimise the impact of component failure and support rapid recovery.; ; The service is hosted on resilient cloud infrastructure with built-in redundancy across multiple availability zones. Core components are deployed in a highly available configuration to avoid single points of failure. If an underlying component fails, traffic is automatically routed to healthy components without customer intervention.; ; Data is protected through regular automated backups and tested restore procedures. Backups are stored securely and separately from the live environment to support recovery from data corruption, accidental deletion, or infrastructure failure.; ; Service health is monitored continuously using automated monitoring and alerting. Incidents are detected quickly and handled through defined incident management and escalation procedures to restore normal service as soon as possible.; ; Planned maintenance is managed to minimise disruption and is typically performed outside of core business hours, with advance notice provided to customers.; ; The underlying datacentre resilience, including power, cooling, physical security, and environmental controls, is provided by the cloud hosting provider and complies with recognised industry standards. Detailed datacentre resilience information is available on request.
• Outage reporting: Service availability is monitored continuously using automated monitoring and alerting. Any service disruption or degradation is detected promptly and assessed by the support team.; ; Customers are notified of outages and significant service issues via email alerts to nominated service contacts. Notifications include the nature of the issue, affected services, and regular status updates until resolution.; ; Where appropriate, updates are also provided through agreed customer communication channels, such as service management meetings or support tickets.; ; A public outage dashboard is not provided by default. However, outage information, incident summaries, and post-incident reports can be made available to customers on request.; ; An API for outage reporting is not currently provided. Service status information and incident details are communicated directly to customers to ensure clarity and relevance.; ; Planned maintenance that may affect service availability is communicated in advance, including expected impact and timing, to minimise disruption and allow customers to plan accordingly.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is strictly restricted to authorised personnel only. Role-based access control (RBAC) is enforced, with permissions granted on the principle of least privilege. Administrative access requires strong authentication using unique user accounts and multi-factor authentication (MFA). Access is logged and monitored, with regular reviews of user roles and permissions. Support access to customer environments is time-bound, approved, and auditable, and where required is performed under customer authorisation. All access to management and support systems is protected by secure network controls and encryption in transit.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users receive audit information on a regular basis
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users receive audit information on a regular basis
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We operate a formal information security management framework aligned to ISO/IEC 27001 and the Software Security Code of Practice. Core policies include Information Security, Access Control, Risk Management, Incident Management, Change Management, Data Protection, Business Continuity, Secure Development, Supplier Security, and Acceptable Use.; ; Security governance is overseen by senior management with clear accountability. An Information Security Lead is responsible for policy ownership, risk assessment, incident response, and compliance reporting. Security risks, incidents, and audit findings are reported through defined management reporting channels and reviewed regularly.; ; Policies are communicated to all staff through onboarding, mandatory security awareness training, and regular refreshers. Compliance is enforced through role-based access controls, documented procedures, peer review, change control, logging, and monitoring.; ; Adherence to policies is verified through internal reviews, external audits, vulnerability management, and penetration testing. Non-compliance or security incidents trigger formal investigation, corrective actions, and management review to ensure continuous improvement.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: All service components are tracked throughout their lifecycle using version-controlled repositories, configuration records, and deployment logs. Assets, dependencies, and environments are documented and maintained in line with ISO/IEC 27001–aligned controls.; ; All changes follow a formal change management process, including impact and risk assessment, with specific consideration of security, data protection, and service availability. Changes are reviewed and approved by authorised personnel, tested in non-production environments, and deployed using controlled release procedures. Rollback plans are defined, and all changes are logged, auditable, and subject to post-implementation review.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We typically deploy within Azure or AWS environments and benefit from their vulnerability scanning and mitigations at the infrastructure level.; ; At a software level, regular patching protects against identified vulnerabilities. More immediate patching can be performed to apply critical updates. Threats are assessed based on risk, exploitability, and potential impact to confidentiality, integrity, and availability. ; ; Security updates and patches are prioritised by severity. Critical vulnerabilities are remediated as soon as practicable, typically within defined SLA timeframes, with testing before deployment.; ; Threat intelligence is sourced from product component suppliers including Microsoft. All remediation actions are tracked, logged, and reviewed for effectiveness.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We do not typically provide the infrastructure for the applications. Where appropriate, protective monitoring is usually provided by the infrastructure provider.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: We operate a documented incident management process with predefined runbooks for common events, including service outages, security incidents, and data issues. Users report incidents via a dedicated support email or service desk during support hours, with escalation for critical incidents. All incidents are logged, triaged, prioritised, and assigned ownership. Customers are kept informed through email updates and, where applicable, service status notifications. Post-incident reports are provided on request and include root cause analysis, impact assessment, corrective actions, and preventative measures. The process is reviewed regularly to ensure continual improvement.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 2%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 7%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 12%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: British Assessment Bureau
• ISO/IEC 27001 accreditation date: Monday 17 March 2025
• What the ISO/IEC 27001 doesn’t cover: NA
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: Provided
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Activities to cascade good practice on fair working conditions throughout the supply chain
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges

  Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

  • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
  • Ensuring accessibility to contracting and subcontracting opportunities for disabled business owners and employees
  • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)
  • Support for community-led initiatives relevant to the contract. Illustrative examples: improving transport links; reducing loneliness; helping with English language proficiency; and facilitating social mixing among people with different backgrounds
• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

  • Understanding of issues relating to entering the contract workforce
• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@cloudapplicationservices.com. Tell them what format you need. It will help if you say what assistive technology you use.