CIRRO LIMITED

Managed flexFS Cloud File System Service

Our Managed flexFS Cloud File System Service provides organisations with a scalable, high-performance, POSIX-compliant distributed file system delivered as a fully managed service. It enables compute and analytics workloads to access file data efficiently, securely, and cost-effectively leveraging object storage as the backend with elastic throughput and robust operational support.

Features

• An innovative cloud-native file system
• Object storage integration (AWS-S3, Azure-Blob, Google Cloud and Wasaabi)
• Metadata services and high-availability configuration
• Mount client management and lifecycle operations
• Data encryption at rest and in transit
• Fine-grained access controls and ACLs where supported
• Integration with existing identity and access management
• Logging and audit trails for compliance
• Elastic throughput that grows with demand
• Support for thousands of hosts accessing volumes simultaneously

Benefits

• High-throughput, POSIX file access without traditional file system overhead
• Elastic scalability for spikes and unpredictable workloads
• Reduced storage and compute costs versus traditional file systems
• Secure, compliant access controls and encryption
• Fully managed operational support
• Seamless integration with cloud storage providers
• Proven performance for data-intensive workloads
• Predictable billing and resource consumption
• Minimal infrastructure and maintenance burden

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at gov@cirro.dev. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

511096588933354

Contact

Michael Owen
020 3418 0412
gov@cirro.dev

About the service

• Service categories:
  • IaaS
    • IaaS Storage
      • File
        • File

Service scope

• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: FlexFS is an innovative cloud-native file system developed by Paradigm4 that transforms network-accessible object storage into a POSIX-compliant file system mountable across multiple hosts with concurrent access. A flexFS volume behaves like a traditional folder while delivering elastic throughput that scales with workload demands. It supports standard file utilities and workflows without special adapters or application rewrites.; ; The service is designed for data-intensive environments, including high-performance computing (HPC), AI/ML pipelines, large-scale analytics, scientific research, media processing, and enterprise file workloads that demand high throughput, concurrency, and predictable cost control.
• System requirements: Browser and Internet Connection

User support

• Email or online ticketing support: Yes
• Support response times: P1 - 30 mins. p2 - 2hrs, p3 - 4hrs, p4 - working day
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: The standard (Silver) support is included in the price of the solution and provides email and phone service 9 to 5 (UK time) Monday to Friday and includes:; - 1st, 2nd and 3rd level with quarterly reporting on SLA compliance; - Proactive remote monitoring of system's health; - File System's SW rolling updates; - 10% Net additional storage available as buffer; ; Additional support services such as 8x7 or 24x7 with on-site support are available at extra costs
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Cirro – Cloud Migration Best Practice Standards; Cirro follows recognised, industry‑standard cloud migration best practices. This framework provides a structured and proven approach to planning, migrating, and optimising cloud environments.; Core Best Practice Framework; Cirro aligns its cloud migrations to the Microsoft Cloud Adoption Framework, which is wide-ly adopted as best practice for Azure migrations.; Migration Lifecycle Adopted by Cirro; • Analyse – Assessment of the existing environment, dependencies, risks, security and com-pliance requirements.; • Plan – Definition of migration strategy, workload prioritisation, timelines, rollback planning, and risk management.; • Transition – Phased migration using Azure-native tools to minimise downtime and disruption.; • Operate – Ongoing operational management, monitoring, security and cost optimisation.; • Transform – Adoption of cloud-native services and modern workplace technologies to im-prove performance and scalability.; • Continual Improvement – Continuous optimisation using lessons learned, service reviews and performance reporting.; ; In summary, Cirro delivers cloud migrations using best practice, supported by ISO-accredited quality, security and continuity standards. This ensures migrations are secure, low-risk, well-governed, and continuously optimised after go-live.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• Documentation accessibility standard: WCAG 2.2 AAA
• End-of-contract data extraction: At exit, we will deliver a structured, time-boxed handover ensuring you or your successor MSP receives all data in open formats:;  Databases: Native SQL .bak files (full/differential/log chain), CSV exports, schema docu-mentation.;  File Shares: Robocopy with ACL preservation, or packaged archive (ZIP/TAR).;  SFTP Zones: Structured export including logs.;  Configurations: AD, GPOs, RAS farm exports, SFTP configs, certificates (via escrow).;  Verification & Handover: Data integrity checked via checksums, with joint sign-off.;  Secure Destruction: Certified wiping of residual data post-handover.; This guarantees no vendor lock-in, UK-only handling, and a risk-free transition.
• End-of-contract process: The contract and Sales Order will detail all the pricing elements for the delivery and running of the services as and when the agreement ends. The customer may wish to extend for an additional or shorter term, these commercial terms can be accommodated under G-Cloud guidelines / restrictions. Should the customer wish to exit at the end of the contracted term, then the Exit Plan will be invoked. This document looks at an exit plan including migrating services to another provider, to internal platforms or whatever other options have been detailed. This will also include likely costs. At this time a formal SoW will be produced to detail the level of involvement required from Cirro to transition services to another provider. This is charged on a Time & Materials basis, the rates of which are details at the start of the Agreement. A Customer may wish to request the new provider assists with the transition and therefore limiting assistance and costs from Cirro . Cirro will always look to provide professional support and assistance to reduce risk and maintain service during any major transition.

Using the service

• Web browser interface: No
• API: No
• Command line interface: No

Scaling

• Independence of resources: This is guaranteed by the architecture of the solution which is based on a network of hundred micronodes working in a peer-to-peer mode and therefore capable of processing simultaneously thousands of concurrent accesses to the system.; Furthermore, from a data separation standpoint, each user of the system is granted his dedicated space name which can be accessed only through user authentication which is based on a key-pair protocol. Only the public key is passed during the communication. The private key (delivered to user only) is used to cypher each request. user authentication
• Usage notifications: Yes
• Usage reporting:
  • API
  • Email
• Optimising consumption: Yes
• Automatic scaling: Yes

Analytics

• Infrastructure or application metrics: No

Supplier type

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Paradigm4

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: In-house
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
• Equipment disposal approach: In-house destruction process

Backup and recovery

• Backup and recovery: No

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)

Availability and resilience

• Guaranteed availability: 99.99%
• Approach to resilience: Resilience is built into the core fabric of our operations and cloud compute platforms, we build resilience in customer deployments against requirements. This approach ensures that as a business, we are highly resilient, and as a customer, you have the flexibility to have the right level of resilience based on required update, data loss sensitivity, risk and cost.; Everyday resilience:;  N+1 compute and storage design; dual PSUs, redundant networking.;  Dual PSUs and redundant network paths.;  HA clustering for Domain Controllers, File & Print, RAS Gateways/Hosts.;  SQL log backups every 15 minutes.
• Outage reporting: All of the above

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: All management interfaces are only accessible by named and security vetted individuals via a two factor authenticated session on an IPSEC v2 VPN tunnel. Multiple failed attempts automatically lock the individual user account with automated notification sent. All passwords are timed and must be unique and can't be recycled.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Username or password
• Devices users manage the service through:
  • Dedicated device on a segregated network (providers own provision)
  • Dedicated device on a government network (for example PSN)
  • Dedicated device over multiple services or networks
  • Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)
  • Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We follow ISO 27001 Information Security Management Systems (ISMS) and CSA guidelines as well as best practice for Cyber Security. Our providers are accredited to the appropriate standards, such as ISO 27001, 9001 and 14001.

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Changes made by the Customer to their Cloud environment which they support themselves is done so at the Customers risk. Where The SwARM provides Support of the Customers environment, all change requests must be formally submitted and approved by SwARM, they are fully audited and assessed against risk. The request has to include: 1. Reason a. Improving security b. Improving performance or functionality c. Reduce operational overhead or cost 2. Request to be approved by SwARM’s: a. Service Manager b. System Architect c. InfoSecurity 3. Change request must include: a. Expected outcome b. Test plan c. Roll-back plan d. SoW
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: All systems are scanned for vulnerabilities every month. Cirro uses the Common Vulnerability Scoring System (CVSS) for all Common Vulnerabilities and Exposures (CVE) provided by the National Vulnerability Database. Scoring for non-CVE vulnerabilities is provided by UB’s vulnerability scanning tool. A priority is placed on patching or mitigating the vulnerability based on these scores and the logical location of the vulnerability within The SwARM's network infrastructure. Remediation occurs within 10 business days for critical vulnerabilities.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Our service management processes are ITIL aligned and have a particular focus on Security Incident Management System and Continuous Service Improvement. Some of the components of this system have been provided below: - Network and Host-based IDS/IPS - Traffic monitoring and intelligent traffic analysis - Packet capture and analysis to enable investigations into alerts - DNS monitoring to detect DNS lookups to known or suspected malware -
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: Prevention: The understanding of and application of insight gained from the intelligence Detection: The interpretation of any events of interest occurring to discriminate between legitimate and abnormal events to identify anomalous activity Investigation: The analysis of anomalies to determine whether they are emerging threats that may lead to a security incident Reaction: Our analysts use tailored, predefined and configured Playbooks to efficiently inform their reaction to an identified threat Response: The planning of effective mitigation in response to the cyber-attack, the communication of these plans to all relevant stakeholders, and the collaboration with all relevant parties to carry out mitigation.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: No

Energy efficiency

• Energy-efficient datacentres: Yes
• Description of energy efficient datacentres: This solution uses additional object storge. When used in conjunction with Wasabi we can conform data centres support energy efficiency by using a simplified object-storage architecture that reduces hardware complexity, power consumption, and cooling demand. By eliminating performance tiers and optimising storage density, Wasabi data centres lower energy use per terabyte while maintaining high availability and durability.

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Qs

Discount

• Provide your minimum discount applicable to your baseline prices: 0%

Formula for calculating price of your services

• Formula for calculating price of your services:

  Which of the core deployment models you intend to offer

  • Public Cloud
  • Private Cloud

  Public Cloud - Formula for calculating price of your services

  ---

  Total Cost

  The Total Cost for a buyer's call off requirement in a Public Cloud Deployment

  =

  Baseline Pricing

  Pricing provided as part of each service description

  Baseline Pricing - Web link

  https://www.cirro.dev

  -

  Minimum Discounting

  0%

  +

  Onboarding Activity

  Onboarding costs may vary based on your specific requirements, please confirm with suppliers during the clarification process

  +

  Additional sources of cost

  Additional application testing, additional resources

  -

  Additional sources of cost reduction

  lesser service levels, reduced resilience

  ---

  Private Cloud - Formula for calculating price of your services

  ---

  Total Cost

  The Total Cost for a buyer's call off requirement in a Private Cloud Deployment

  =

  Baseline Pricing

  Pricing provided as part of each service description

  -

  Minimum Discounting

  0%

  +

  Onboarding Activity

  Onboarding costs may vary based on your specific requirements, please confirm with suppliers during the clarification process

  +

  Additional sources of cost

  Additional application testing, additional resources

  -

  Additional sources of cost reduction

  lesser service levels, reduced resilience

  ---

• Total Cost: The Total Cost for a buyer's call off requirement in a Public Cloud Deployment
• Baseline Pricing: Pricing provided as part of each service description
• Baseline Pricing - Web link: https://www.cirro.dev
• Minimum Discounting: 0%
• Onboarding Activity: Onboarding costs may vary based on your specific requirements, please confirm with suppliers during the clarification process
• Additional sources of cost: Additional application testing, additional resources
• Additional sources of cost reduction: lesser service levels, reduced resilience
• Total Cost: The Total Cost for a buyer's call off requirement in a Private Cloud Deployment
• Baseline Pricing: Pricing provided as part of each service description
• Minimum Discounting: 0%
• Onboarding Activity: Onboarding costs may vary based on your specific requirements, please confirm with suppliers during the clarification process
• Additional sources of cost: Additional application testing, additional resources
• Additional sources of cost reduction: lesser service levels, reduced resilience

Standards and certifications

• Supplier type: Both
• Organisations resold: Innovate Ltd
• ISO 9001 certification: Yes
• ISO 14001 certification: Yes
• ISO 20000-1 certification: Yes
• ISO 27001 certification: Yes
• ISO 27017 certification: Yes
• ISO 27018 certification: Yes
• Do you have a Cyber Essentials Plus certificate?: Yes
• Cyber Essentials Plus certificate Number: 0f502da2-6ecb-4b4e-a52f-8c9c99388c62
• ISO 28000:2022 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Plans to engage the contract workforce in deciding the most important workplace issues to address
  • Ensuring new workers are informed of their right to join a trade union
  • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
  • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Activities to cascade good practice on fair working conditions throughout the supply chain
  • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
  • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
  • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Volunteering opportunities for staff
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
  • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
  • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
  • How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.
  • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain
  • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

  Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

  • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
  • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
  • Plans for engaging a diverse range of businesses in engagement activities prior to appointing subcontractors (including activities prior to award of the main contract and during the contract term)
  • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
  • Ensuring accessibility to contracting and subcontracting opportunities for disabled business owners and employees
  • Structuring of the supply chain selection process to ensure fairness (e.g. anti-corruption) and encourages participation by a diverse range of businesses, including with regard to new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutual
  • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
  • Plans to respond flexibly and adapt approaches to community engagement and initiatives
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at gov@cirro.dev. Tell them what format you need. It will help if you say what assistive technology you use.