STONESTHRO LTD

Virtual Machine Proxora

We provide sovereign micro edge cloud distributed throughout the UK at sites adjacent to 5g mobile phone infrastructure and fibre connectivity. This provides a low latency close proximity cloud service including AI at a low carbon footprint.

Features

• Real time reporting
• PUE of as low as 1.02
• N+2 site availbility
• auto site failover
• Sites in Milton Keynes , Solihull and Southampton

Benefits

• Low latency
• Close proximity
• Low carbon footprint
• High availability across sites

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at andy.bates@stonesthro.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

537635956608765

Contact

Andy Bates
07880783166
andy.bates@stonesthro.co.uk

About your service

• Service categories:

  IaaS

  IaaS Compute

  • Bare metal
  • Container and serverless engine compute

  Virtualised x86

  • General purpose
  • Compute optimised
  • Memory optimised

  Accelerated

  • GPUs

Service scope

• Service constraints: Each site will have a 99.5% availability so our expectation is that clients order N+1 availability as a minimum to achieve higher availability
• System requirements:
  • We expect all clients to run AV
  • We expect all clients to have cyber essentials or above
• Cloud deployment model: Private cloud

User support

• Email or online ticketing support: Yes, at extra cost
• Support response times: 4 hours 9-5 Monday to Friday
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: No
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Support levels are even across customers with priority 1 incidents taking priority over lower incidents and planned outages
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We provide pre-sales induction to the platform and help guides
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: User data is in their partition and under their encryption. We can offer profesional services if needed to extract.
• End-of-contract process: There are no inclusions bar data wiping to our described standards
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: We assist verbally and in meetings as needed to ensure accesibility

Using the service

• Web browser interface: Yes
• Using the web interface: Expand and contract VM's order new VM and receive metrics and service reports
• Web interface accessibility standard: WCAG 2.2 AAA
• Web interface accessibility testing: This has been tested by our supplier in over 1500 deployments globally
• API: Yes
• What users can and can't do using the API: Existing VM's can be increased and decreased resources
• API automation tools: OpenStack
• API documentation: No
• Command line interface: No

Scaling

• Independence of resources: Our hypervisor allocated resources but we load balance across physical machines
• Usage notifications: Yes
• Usage reporting: Other
• Other usage reporting: Web portal
• Optimising consumption: Yes
• Automatic scaling: Yes

Analytics

• Infrastructure or application metrics: Yes
• Metrics types:
  • CPU
  • Disk
  • Memory
  • Network
  • Number of active instances
• Reporting types:
  • API access
  • Real-time dashboards
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Zadara

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Physical access control, complying with CSA CCM v4.0
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Backup and recovery

• What’s backed up:
  • Data
  • System configuration
  • Operating system
• Backup controls: Users have access to their portal and can control the services they backup and its frequency and granularity
• Datacentre setup:
  • Multiple datacentres with disaster recovery
  • Multiple datacentres
  • Single datacentre with multiple copies
  • Single datacentre
• Scheduling backups: Users schedule backups through a web interface
• Backup recovery:
  • Users can recover backups themselves, for example through a web interface
  • Users contact the support team
• Backup and recovery: Yes
• RPO/RTO: Yes

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: 99% per month
• Approach to resilience: We run swarms giving N+2 availability or higher with distributed power and comms per node
• Outage reporting: Public dashboard with email alerts

Identity and authentication

• User authentication needed: Yes
• User authentication: Multi-Factor Authentication (MFA)
• Access restrictions in management interfaces and support channels: We have PKI keys to platform API and MFA access to user interface portal where role based access controls access only to customer tenant
• Access restriction testing frequency: At least every 6 months
• Management access authentication: Multi-Factor Authentication (MFA)
• Devices users manage the service through: Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Cyber Essentials +, HIPAA, ISO27001, ISO27701, ISO27018, ISO9000, alignment with ISO20,000. Many of these are provided by our partners Zadara or Cornerstone
• Information security policies and processes: We have aligned our ISMS with ISO27001 while all security issues report to our CISO who is also our co founder and board member

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Changes are limited to software upgrade and hardware upgrade, these are tested in supplier environment ad deployed node by node starting with our alpha text and dev node
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We interface with NIST and NCSC early warning service.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We have a 24*7 SOC provided by Zadara
• Incident management type: Supplier-defined controls
• Incident management approach: We operate a documented incident management process aligned to ITIL v4 and NCSC principles to minimise disruption and protect data. Pre-defined runbooks exist for common incidents such as service degradation, security events, connectivity loss, and third-party failures, with clear severity levels, escalation paths, and response targets. Users report incidents via a service desk portal, email, or telephone, with out-of-hours escalation for critical issues. All incidents are logged, prioritised, and tracked to resolution. For major incidents, we provide written reports covering impact, timeline, root cause, and corrective actions, supported by post-incident reviews.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
• Who implements virtualisation: Supplier
• Virtualisation technologies used: Other
• Other virtualisation technology used: Z compute virtualisation
• How shared infrastructure is kept separate: Virtualisation at hyoper visor level and user based encryption

Energy efficiency

• Energy-efficient datacentres: Yes
• Description of energy efficient datacentres: Our microedge cloud platforms have a PUE of potentially as low as 1.02 due to high density loading and external location

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: We will offer 10 VM's for 1 month and extend on mutual agreement

Discount

• Provide your minimum discount applicable to your baseline prices: 10%

Formula for calculating price of your services

• Formula for calculating price of your services:

  Which of the core deployment models you intend to offer

  Private Cloud

  Private Cloud - Formula for calculating price of your services

  ---

  Total Cost

  The Total Cost for a buyer's call off requirement in a Private Cloud Deployment

  =

  Baseline Pricing

  IAAS platform PROXORA services pricing

  -

  Minimum Discounting

  10%

  +

  Onboarding Activity

  Onboarding costs may vary based on your specific requirements, please confirm with suppliers during the clarification process

  +

  Additional sources of cost

  Where clients have intensive work loads or need dedicated hardware this will drive additional cost. Where clients require bandwidth in exces of 10gigabits/s per node or ultra low latency needing 100gbits/s per node this may increase cost.

  -

  Additional sources of cost reduction

  Outside term and contractual commitment additional cost reductions may be leveraged by , time of day usage (ie using cloud at "quite times", CPU/GPU intensity or increased reserve capacity that is unused (ie reserving capacity for N+3 and above availability)

  ---

• Total Cost: The Total Cost for a buyer's call off requirement in a Private Cloud Deployment
• Baseline Pricing: IAAS platform PROXORA services pricing
• Minimum Discounting: 10%
• Onboarding Activity: Onboarding costs may vary based on your specific requirements, please confirm with suppliers during the clarification process
• Additional sources of cost: Where clients have intensive work loads or need dedicated hardware this will drive additional cost. Where clients require bandwidth in exces of 10gigabits/s per node or ultra low latency needing 100gbits/s per node this may increase cost.
• Additional sources of cost reduction: Outside term and contractual commitment additional cost reductions may be leveraged by , time of day usage (ie using cloud at "quite times", CPU/GPU intensity or increased reserve capacity that is unused (ie reserving capacity for N+3 and above availability)

Mandatory certifications

• Mandatory certifications:

  Are you are bidding to offer IaaS and/or PaaS as a reseller or are you in sole control of the infrastructure

  Reseller

  Cloud service suppliers you intend to resell with evidence

  Organisation 1

  Organisation name

  Zadara

  Website address/upload for organisation

  Website address

  Website address

  https://www.zadara.com/about/partners/

  ISO 9001 certification

  Provided

  ISO 27001 certification

  Provided

  ISO 20000-1 certification

  Provided

  Are you reliant on the Cloud Service Provider for some accreditations

  Yes

Cyber Essentials

• Do you have a Cyber Essentials Plus certificate?: No
• Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies, by the date of framework award.

Non-mandatory Standards and certifications

• ISO 28000:2022 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Other security certifications: Yes
• Any other security certifications:
  • SOC2 via Zadara primary cloud supplier
  • SOC 1 via Zadara primary cloud supplier
  • ISO27018 via Zadara primary cloud supplier
  • ISO27017 via Zadara primary cloud supplier
  • ISO27701 via Zadara primary cloud supplier
  • Cyber Essentials+ in progress

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at andy.bates@stonesthro.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.