GETECH LIMITED

AFI Backup for Google Workspace

AFI is the latest-generation data-protection solution built from the ground up for cloud-native performance. It provides automated, immutable backups for Google Workspace. Leveraging AI-based ransomware protection and a microservices architecture, AFI delivers the industry's fastest backup and recovery speeds (2-3x faster than legacy providers), full-text search capabilities, and unlimited retention.

Features

• Automated Protection: Automatic 3x daily backups for all Workspace workloads.
• Ransomware Defense: AI engine detects and blocks ransomware encryption attempts.
• Full-Text Search: Instantly search email bodies and files for recovery.
• Granular Restore: Recover specific emails, files, folders without overwriting data.
• Unlimited Retention: Keep data indefinitely with unlimited version history.
• Data Sovereignty: Select specific data residency regions for compliance.
• Instant Archiving: Archive departing users to save on Workspace licenses.
• Role-Based Access: Granular permissions for super admins, helpdesk, and end-users.
• Self-Service: Enable users to find and recover their own lost-files.
• Audit Logging: Comprehensive logs of all backup and restore actions.

Benefits

• Cyber Resilience: Protect critical data against ransomware and accidental deletion.
• Operational Speed: Fastest recovery times (RTO) using modern microservices architecture.
• Compliance Ready: Meet GDPR and legal requirements with immutable storage.
• Reduced Costs: Archive leavers cheaply without maintaining expensive Google licenses.
• User Autonomy: Reduce helpdesk tickets by empowering user self-recovery.
• Simplicity: Modern, intuitive interface requires zero training to manage.
• Data Independence: Secure copy of data stored independently from Google.
• High Fidelity: 100% data fidelity for metadata and file permissions.

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@getech.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

598518551428408

Contact

Richard Maclean
01473240470
bidteam@getech.co.uk

About your service

• Service categories:

  Application Development and Deployment

  Data management

  Data integration and intelligence

  • Dynamic Data Movement Software
  • Data Access Infrastructure Software
  • Master Data Intelligence Software
  • Data Archiving and Information LifD-Cycle Management
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes
• What software services is the service an extension to: This is a third-party backup solution that integrates via API with your Google Workspace domain.
• Cloud deployment model: Public cloud
• Service constraints: API Dependency: Backup speeds are theoretically capped by Google's API throughput limits (though AFI optimizes this via efficient API handling).; ; Cloud Only: AFI is a SaaS-only solution; there is no on-premise hardware option.
• System requirements:
  • Tenant: Active Google Workspace tenant.
  • Browser: Modern web browser (Chrome, Edge, Firefox, Safari).
  • Permissions: Requires Super-Admin authorization to install and grant OAuth scopes.

User support

• Email or online ticketing support: Yes
• Support response times: AFI provides 24/7 in-app chat and email support with very fast response times (typically <5 minutes for chat)
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: Google perform Voluntary Product Accessibility Testing for web chat; the latest results are available from this URL: https://services.google.com/fh/files/misc/google_chat_web_vpat.pdf; The following services are supported by the interface: text to speech, and speech to text, magnifying tool, high contrast colour schemes are all available options.; Additionally, the current Voluntary Product Accessibility Testing confirms the following features to 2.2 A or AA level testing.; Character Key Short cuts – 2.2 A; Pointer Gestures – 2.2 A; Pointer Cancellation – 2.2 A; Label in Name – 2.2 A; Motion Actuation – 2.2 A; Orientation – 2.2 AA; Identify Input Purpose – 2.2 AA; Reflow – 2.2 AA; Non-text Contrast – 2.2 AA; Text Spacing – 2.2 AA; Content on Hover or Focus – 2.2 AA; Status Messages – 2.2 AA
• Onsite support: Yes, at extra cost
• Support levels: Standard: AFI provides 24/7 in-app chat and email support with very fast response times (typically <5 minutes for chat). ; Enhanced: As the reseller, Getech provides Tier 1 configuration support, onboarding assistance, and strategic data protection advice.
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: Install: Install the AFI Backup app from the Google Workspace Marketplace.; ; Auth: Grant OAuth permissions (no service accounts or passwords required).; ; Configure: Auto-discovery detects all users; admins select OUs to protect and apply policies.; ; First Run: Initial backup begins immediately.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Export: Administrators can export all data (emails as PST/MBOX, Drive files as native formats) before the contract ends.; ; Deletion: Upon contract termination, the account is suspended. After a grace period (typically 14-30 days), all data is permanently and cryptographically erased from AFI storage.
• End-of-contract process: Service Cessation: Upon contract expiration, backups cease immediately. The account enters a suspended state.; ; Data Retention: Customers typically have a grace period (e.g., 30 days) to export their data.; ; Deletion: After the grace period, all data is permanently and cryptographically erased from AFI storage in accordance with SOC 2 standards.; ; Describe what’s included in the price.; ; Included:; ; Unlimited storage (fair use).; ; Unlimited retention periods.; ; 3x daily automated backups.; ; Full customer support.; ; Ransomware protection features.; ; Additional Costs:; Archived User Licenses: Often sold separately or at a different rate for leavers.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Don't know.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: Yes
• Compatible operating systems: Other
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: Administrator Portal: A modern, clean web interface that mirrors the design language of Google Workspace. It provides a dashboard view of protection status, ransomware alerts, and storage usage. ; End-User Portal: A simplified view allowing users to browse their own point-in-time snapshots and perform restores (if enabled by policy).
• Accessibility standards: None or don’t know
• Description of accessibility: Don't know
• Accessibility testing: N/A
• API: Yes
• What users can and can't do using the API: Automation: AFI provides API access to automate user provisioning, trigger backups, and retrieve audit logs.; ; Reporting: Extract protection status and storage consumption data programmatically for central reporting dashboards.
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: SLA Policies: Administrators can create custom backup SLAs (Service Level Agreements) to apply different retention periods and backup frequencies to different Organizational Units (OUs) or Groups (e.g., "Executives" vs "Students").; ; Access Roles: Create custom admin roles to restrict visibility (e.g., a "Restore Operator" who can restore data but not delete backups or change settings).; ; Labeling: Custom labels can be applied to backups for legal hold organization.

Scaling

• Independence of resources: AFI Backup utilizes a modern, cloud-native microservices architecture (orchestrated via Kubernetes) to ensure complete resource independence. Unlike legacy monolithic solutions, AFI dynamically scales compute resources horizontally in response to real-time demand. This ensures that a surge in backup activity from one tenant never impacts the performance or throughput of another.; ; Furthermore, the platform employs an AI-driven prediction engine to manage API request limits intelligently. This prevents "noisy neighbor" issues where one user's heavy load could cause Google Workspace API throttling for others. Customer data is also logically isolated, with options for distinct regional storage to ensure physical separation if required.

Analytics

• Service usage metrics: Yes
• Metrics types: The AFI Backup dashboard provides real-time, actionable insights into your data protection posture.; ; Protection Status: Visual breakdown of Protected vs. Unprotected users, Shared Drives, and Sites to ensure 100% coverage.; ; Task Health: Granular success/failure rates for backup cycles (3x daily), allowing instant identification of connectivity or permission issues.; ; Storage Trends: Historical view of data growth and storage consumption over time to aid in capacity planning.; ; Security Alerts: Real-time logging of Ransomware detection events, highlighting specific affected files and snapshots.; ; Audit Logs: Comprehensive tracking of all administrator actions (restores, policy changes, exports) for compliance and security auditing.
• Reporting types: Real-time dashboards
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: AFI

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: In-house
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: Customers can utilize Bring Your Own Key (BYOK) to manage their own encryption keys via Google Cloud KMS, ensuring data is cryptographically inaccessible even to the vendor.
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Direct Download: Administrators can export data directly from the AFI portal.
• Data export formats: Other
• Other data export formats:
  • Email: PST, MBOX, EML.
  • Drive: Native formats (DOCX, XLSX) or ZIP.
  • Contacts/Calendar: VCF, ICS.
• Data import formats:
  • CSV
  • Other
• Other data import formats: Restore: Data is restored directly back into Google Workspace via-API.

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: AFI Backup provides a Service Level Agreement (SLA) with a guaranteed 99.9% uptime. The service architecture is built on top of high-availability cloud infrastructure (Google Cloud Platform and AWS), ensuring continuous operation 24/7/365. In the event of a significant service disruption impacting the ability to access data, service credits may be applicable as per the terms of service.
• Approach to resilience: AFI utilizes a modern, cloud-native microservices architecture orchestrated via Kubernetes. This design ensures:; ; Redundancy: All system components and customer data are automatically replicated across multiple availability zones within the selected data center region to survive hardware failures.; ; Isolation: Data is logically isolated per tenant, and the platform uses distributed containers that automatically restart or scale horizontally in response to load or component failure.; ; API Resilience: A proprietary AI prediction engine monitors Google Workspace API limits in real-time to prevent throttling, ensuring backups complete successfully even during periods of high load.; ; Disaster Recovery: The platform includes built-in disaster recovery protocols with continuous testing of data recovery plans.
• Outage reporting: Dashboard: Real-time service status is visible directly within the administrator "Overview" dashboard, featuring a "Protection Status" widget that highlights any failures or connectivity issues.; ; Alerts: Administrators can configure automated notifications via Email, Slack, or Microsoft Teams webhooks to receive instant alerts regarding backup failures, outages, or security events.; ; Support: In the event of a confirmed outage, the AFI support team provides updates via the help center and direct communication channels.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Afi controls access through strict Role-Based Access Control (RBAC) and Single Sign-On (SSO). Management interfaces utilize OAuth integration with Google Workspace or Microsoft 365, ensuring that your organization's existing MFA and conditional access policies are automatically enforced for all administrators.; ; For support channels, we operate on a Least Privilege model. Support staff have no standing access to customer data; access is granted only when required for specific troubleshooting tickets and is strictly time-bound. All access events and administrative actions are recorded in immutable audit logs for full transparency.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
• Information security policies and processes: Policy Framework: AFI Backup operates under a comprehensive Information Security Management System (ISMS) aligned with ISO/IEC 27001 and SOC 2 Type II standards. This framework governs all aspects of our service, including access control, incident response, and vendor risk management.; ; Reporting Structure: Security is managed by a dedicated Security Team that reports directly to the C-Level executive board, ensuring security is a primary business objective. We undergo annual independent third-party audits (SOC 2 Type II) to verify control effectiveness.; ; Enforcement:; ; Least Privilege: Access to internal systems is restricted via Role-Based Access Control (RBAC) and mandatory Multi-Factor Authentication (MFA).; ; SDLC: We follow a Secure Software Development Life Cycle (SSDLC) with mandatory code reviews and automated vulnerability scanning before any release.; ; Operational Security: We employ continuous infrastructure monitoring, automated intrusion detection, and regular "Red Team" penetration testing to ensure policies are strictly followed.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Service components are tracked using Infrastructure as Code (IaC) and version-controlled Git repositories, ensuring a complete audit trail for our microservices architecture.; ; Changes follow a Secure SDLC process with mandatory peer reviews and automated vulnerability scanning (SAST) integrated into CI/CD pipelines. Consistent with SOC 2 Type II standards, significant updates undergo formal risk assessment and approval by our Security Team. This ensures all changes are evaluated for security impact, protecting confidentiality and integrity before release to production.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: We employ continuous automated vulnerability scanning (SAST/DAST) within our CI/CD pipelines and conduct regular "Red Team" penetration testing to assess threats. Threat intelligence is sourced from global CVE databases, Google Cloud security bulletins, and automated monitoring tools.; ; Leveraging our Kubernetes-based microservices architecture, we deploy critical security patches rapidly—typically within 24 hours of validation—without service downtime. All patches undergo automated testing in staging environments before rollout. This process is fully governed by our SOC 2 Type II and ISO 27001 compliant ISMS.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: We identify potential compromises using 24/7 automated intrusion detection systems (IDS), real-time log analysis, and AI-driven anomaly detection to flag suspicious activity immediately.; ; Upon detection, our dedicated Security Team triggers our ISO 27001-aligned Incident Response Plan. We utilize our microservices architecture to instantly isolate affected containers or accounts, preventing lateral movement.; ; We respond to critical security alerts immediately. Investigations begin within minutes of detection, and customers are notified promptly of confirmed breaches, ensuring compliance with GDPR and SOC 2 reporting requirements.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Afi employs automated, AI-driven workflows for common incidents, including ransomware detection and API connectivity handling. "Soft" failures trigger automatic retries, while critical events initiate immediate security playbooks.; ; Reporting Incidents: Users can report issues 24/7 via our in-app support chat or by emailing support@afi.ai.; ; Providing Reports: We ensure transparency through:; ; Real-time updates: Dashboard alerts and granular audit logs.; ; Proactive notifications: Alerts sent via Slack, Microsoft Teams, and Email.; ; Formal Analysis: Public status updates and Root Cause Analysis (RCA) for major disruptions.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Afi.ai does not offer a permanently free version. Instead, we provide a 30-day Free Trial that includes full access to all features, unlimited users, and standard support. There are no functional restrictions during the trial period; however, access and data retention cease if not converted to a paid subscription.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 2%
• Between £500,001 and £1,000,000: 4%
• Between £1,000,001 and £2,500,000: 6%
• Between £2,500,001 and £5,000,000: 8%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: LRQA Ltd
• ISO 9001 accreditation date: Friday 18 August 2023
• What the ISO 9001 doesn’t cover: Getech's ISO 9001 covers all aspects of our business.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: Securitymetrics
• PCI DSS accreditation date: Saturday 27 December 2025
• What the PCI DSS doesn’t cover: All elements of Getech's payment processing that involve cardholder data, i.e. credit, debit, or other, are covered by this certification. Standard invoice and payment (on account) process's not using cardholder data are not directly covered by process's under this certification, but are protected by Getech's other company wide security and audit process's.
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 171d1c94-afa5-43a2-bab2-872b1a5939cf
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 40b64042-5c06-4b30-93e5-f585fe810fd1
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Plans for positive actions with community groups.
    • Measures for making facilities used in the delivery of the contract available for community groups, education or training
    • Collaborating with anchor institutions and community groups to make facilities available for education, training or community events

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@getech.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.