Bramble Hub Limited

Bramble Hub Bluestar Software - Digital Asset Delivery

Provides a mechanism to securely transfer computer files, digital media and evidence over the internet between organisations using end to end encryption. Delivered via a web browser without the need to install plugins or specialist software components.

Features

• End to end encryption
• Full audit trail of usage
• Optional virus scanning of uploaded assets
• Two factor authentication for recipients
• Automatic asset retention and deletion
• Optional Active Directory integration
• Internet accessible public portal
• Integrity of all files maintained using persistent checksums
• Multiple files managed and delivered together as a single publication
• Delivery of publications to multiple recipients

Benefits

• Secure data transfer between organisations
• Promotes collaborative working
• Two factor authentication ensures only intended recipients can open
• Automatic encryption requiring no additional software
• All electronic transfer of data, no physical copies
• Re-use of known recipients, overhead is managed once
• Time expired access
• Audit trail provides specific dates when recipients perform actions
• Support for files up to 10GB in size
• Operationally proven

£3,500 a licence a month

• Free trial available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at contact@bramblehub.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

542980297322116

Contact

Geoff Couling
+44 (0) 2077350030
contact@bramblehub.co.uk

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Can be used in conjunction with Bluestar's Digital Asset Management (DAM) software and our main Corvus product set.
• Cloud deployment model: Hybrid cloud
• Service constraints: N/A
• System requirements:
  • Application designed for Linux server platform
  • AV integration supports ClamAV and Kaspersky
  • Appropriate browser for use with the application
  • Internet Explorer 10 not supported without enhanced security settings

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Depends upon the exact nature of the agreed support contract and service level. Typically, critical faults are responded to within 2 hours and have a resolution / circumvention supplied within 12 hours in 99% of cases. Other levels have a range of response times, circumvention times and resolution measures.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.1 AA or EN 301 549
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Support is offered at two levels - standard office hours and extended 24 x 7 (available at additional cost). Typically, customers operate a first line support function with Bluestar delivering a second line capability. Customers can opt for Bluestar to carry out first line support but this is subject to an additional charge. All customers are assigned a technical lead and support manager.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Initial handover to the customer's representatives is typical. User manual is provided as part of the product, accessible to all users. Service is designed to be as easy to use as possible, with tool tips and pointers in order to help new users. Formal training courses are provided at additional cost.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • ODF
  • PDF
• End-of-contract data extraction: Service provider will provide extract of data in CSV format for structured data and a set of flat files should the data be requested at the end of the contract.
• End-of-contract process: If requested extracts of data will be provided to the customer. Otherwise the service will be left operational (with access for new data restricted). The expiry dates of all data will be naturally reached and all information will be securely destroyed as per the built in weeding processes.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The system provides secure file transmission and reception via an industry standard browser. The nature of the service means that it is therefore less applicable to mobile devices. However, any device providing a suitable browser technology can utilise the service. The recipient would have to determine whether the type of device was appropriate for the content to be downloaded / accessed.
• Service interface: No
• User support accessibility: WCAG 2.1 AA or EN 301 549
• API: No
• Customisation available: Yes
• Description of customisation: Customers can control the retention periods for publications and the storage capacity used by the service. Many other elements can be configured with the support of Bluestar personnel. Any options which affect pricing, will be highlighted and discussed with the customer. Furthermore, customers can work with Bluestar to determine the overall server model and can have locally installed elements if this is preferred.

Scaling

• Independence of resources: Application scales horizontally with the addition of more nodes. Load balancing fronts the services to distribute load between all servers. Transportable tokens are used to allow users to move between servers without interruption

Analytics

• Service usage metrics: Yes
• Metrics types: Formal audit of all transactions that take place on the system is provided. Users with permissions are able to search through the audit and extract to CSV should that be required. The built-in Report Viewer feature allows a range of metrics to be included, such as transactions in a time period, average response etc.
• Reporting types:
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Explicit overwriting of storage before reallocation
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Users can download publications / files as required because this is part of the application functionality provided. Similarly, users can upload (i.e. import) any data they require using the features provided. Although not typically the case, additional data imports can be taken as a separate chargeable activity if required.
• Data export formats:
  • CSV
  • Other
• Other data export formats: Corvus maintains the original source format 'as is'
• Data import formats:
  • CSV
  • Other
• Other data import formats: All except executable and virus infected files are accepted

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
• Other protection between networks: In addition to TLS a private - public - private - public signing process is used to ensure data can only be sent by an expected server and only received by another expected server
• Data protection within supplier network: Other
• Other protection within supplier network: Data transferred over a shielded private network, data at rest encrypted with AES256

Availability and resilience

• Guaranteed availability: Service levels are discussed on a per customer basis. As a general guide, Bluestar offers 99.95% availability for the main service.
• Approach to resilience: The system is deployed using a distributed service architecture, that is to say the system has built-in redundancy by locating the same service capability across multiple physical machines. This is combined with load balancing so that a particular service location operates effectively. Using these (patented) techniques, we have no single point of failure within the system itself and therefore achieves extremely high levels of availability as standard.
• Outage reporting: Bluestar deploys its own Corona monitoring application. This is used to implement monitors and metrics linked to the main service. Monitoring checks a range and variety of conditions such as capacity, network access, performance of individual processes etc. Alerts are immediately visible on screen and sent via email (and SMS) to administrators and (optionally) customer representatives.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Username or password
  • Other
• Other user authentication: Additional controls are applied to external users of the application and will require 2-factor authentication.
• Access restrictions in management interfaces and support channels: Authentication as part of a role based access framework. Access rights to different features depend on permissions assigned within the application.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Citation ISO Certification
• ISO/IEC 27001 accreditation date: 16/10/2023
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: Yes
• Any other security certifications: ITHC CHECK as per CESG guidelines

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: Yearly audits against cyber essentials plus combined with specific Health Checks for customer implementations. These comply with customer requirements including CESG government standards.
• Information security policies and processes: Bluestar has aligned our processes to ISO27001 as part of our accredited ISO9001 process.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Typically the change management process is agreed with customers to suit their preferred model. In all cases, customer representatives authorise work to be carried out and will be asked to participate in the acceptance testing on a suitable test platform.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Bluestar considers all aspects of vulnerability including the physical location and access controls. Software configurations utilise an automated patching process (run daily as a minimum) to ensure that any potential threats are mitigated as quickly as possible. At the outset, all builds are established with a 'known' and approved benchmark which is independently verified.
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: Bluestar adopts compliance with recognised standards covered by agreements with our hosting providers.
• Incident management type: Supplier-defined controls
• Incident management approach: Incident management is a built-in element of our Support-Link and automatic monitoring systems and is defined within our business process management workflow. Any incidents (including security) reported, or identified, are passed on to our support team and if sufficiently serious in nature, are immediately notified to Bluestar's dedicated Support Manager. The Support Manager will escalate to the Senior Management Team (Director level), if the incident is either deemed sufficiently serious, or there are specific customer circumstances , or if the SLA is compromised.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  Fighting climate change

  Fighting climate change

  Bluestar Software’s G-Cloud 14 applications and services provision will enable our customers to; realise a direct benefit in reducing their carbon footprint in the fight against climate change.; Bluestar applications digitise our customers’ services, significantly reducing the need to create and; share printed materials and our online collaboration tools reduce the requirement to physically; travel to meetings using public and private transport.

Pricing

• Price: £3,500 a licence a month
• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Customer commits to providing a formal assessment of the system at the end of the trial period.; Trial period will be agreed on a case by case basis.; That functionality may be limited given the constraints of the trial.

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at contact@bramblehub.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.