Cloud Compare

Service scope

Software add-on or extension: No
Cloud deployment model: Public cloud

Hybrid cloud
Service constraints: Currently limited to Infrastructure as a Service (IaaS) analysis of leading cloud providers, include Microsoft Azure, Amazon AWS & Google in all locations globally.
System requirements: Browser within 2 versions of most recent for full support.

Desktop browser (no mobile application)

User support

Email or online ticketing support: Email or online ticketing
Support response times: Our SLA is to respond within 4hrs during normal working hours. Email and ticketing support is active only within our standard working day, therefore no support services during a weekend.
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: None or don’t know
Phone support: No
Web chat support: No
Onsite support: Yes, at extra cost
Support levels: Email, knowledge base and ticketing support is currently provided within our standard model.

On-site support can be provided at extra cost if required however, as our service is offered as public cloud, this would not normally be required.

Support to help run automated discovery of your IT estate can be run as a separate project engagement. All discovered information is loaded in to Cloud Compare to support analysis of your server estate at scale. POA.
Support available to third parties: Yes

Onboarding and offboarding

Getting started: Our service optionally includes an on-site (paid for) professional services includes kick off support, planning, full lifecycle enterprise and systems architecture change planning, strategic advice and guidance, training, user documentation, data capture, review meetings and full ongoing support.

We provide full produce guidance and set up support and we offer integration of Cloud Compare to existing tools and systems such as existing configuration management databases (CMDB) or other related systems.

This is all defined within a highly structured, data driven methodology that we have developed over 8 years of successful client projects.
Service documentation: Yes
Documentation formats: HTML
End-of-contract data extraction: Users can cancel their account at any time. Cancellations can be provided directly within the service (on the user account page) or by contacting us at support@shapecast.com

If clients decide to discontinue at any point, their data is then archived for a period of 6 months within which customers can request an extract of their data.
End-of-contract process: Users are asked to pay prior to uploading their server list analysis therefore on termination of the user account there should be no additional or outstanding fees.

Users can cancel their account at any time. Cancellations can be provided directly within the service (on the user account page) or by contacting us at support@shapecast.com

Using the service

Web browser interface: Yes
Supported browsers: Internet Explorer 11

Microsoft Edge

Firefox

Chrome

Safari

Opera
Application to install: No
Designed for use on mobile devices: Yes
Differences between the mobile and desktop service: Application is mobile aware so not all fields available in the desktop version are available in the mobile version, but both are optimised and easy to use.
Service interface: Yes
User support accessibility: WCAG 2.1 A
Description of service interface: Cloud Compare is a clean, simple web application delivered via modern browsers. This can be used on desktops or mobile devices and is fully responsive.
Accessibility standards: WCAG 2.1 AA or EN 301 549
Accessibility testing: We test the application against WCAG2.1AA standards against W3C guidance and http://romeo.elsevier.com/accessibility_checklist/
We test both manually (where tests dictate) and using accessilibity testing tools such as Wave and Axe.
API: Yes
What users can and can't do using the API: We have a full API for the service which will allow third party specialists to access our analytics engine which supports all of our products. However, this product is intended as a standard SaaS solution, so most customers are expected to use our service via the GUI.
API documentation: Yes
API documentation formats: Open API (also known as Swagger)

HTML

PDF
API sandbox or test environment: No
Customisation available: Yes
Description of customisation: Each registered user can customise their own profile and information. Once integrated via our API, customers can build completed internal dashboards and platforms using tools like PowerBI within Office 365

Scaling

Independence of resources: We typically provide private instances which are architected based on the expected demands of our clients. We monitor performance ongoing and any thresholds in demand are serviced via auto scaling services by our cloud provider (Amazon Web Services).

Analytics

Service usage metrics: Yes
Metrics types: We can provide service usage metrics upon request. This includes login frequency, usage and analytics based metrics.
Reporting types: Reports on request

Resellers

Supplier type: Not a reseller

Staff security

Staff security clearance: Other security clearance
Government security clearance: Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom
User control over data storage and processing locations: Yes
Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency: At least every 6 months
Penetration testing approach: Another external penetration testing organisation
Protecting data at rest: Physical access control, complying with another standard

Encryption of all physical media

Other
Other data at rest protection approach: Physical access control with another standard, encryption of all media & Other

All service access control is provided by Amazon EC2 & Relational Data Services (RDS) with data layer encryption (using XTS-AES-256 encryption)

User passwords are stored salted and hashed within our database. We also provide SQL injection protection within our front end application and API.
Data sanitisation process: Yes
Data sanitisation type: Deleted data can’t be directly accessed
Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach: Send a request to support@shapecast.com and we will make all data available via a secure, encrypted download link at no extra charge.
Data export formats: CSV

ODF
Data import formats: CSV

Data-in-transit protection

Data protection between buyer and supplier networks: Private network or public sector network

IPsec or TLS VPN gateway

Legacy SSL and TLS (under version 1.2)
Data protection within supplier network: IPsec or TLS VPN gateway

Other
Other protection within supplier network: Data is protected within our network to comply with Amazon Best Practices (https://d0.awsstatic.com/whitepapers/Security/AWS_Security_Best_Practices.pdf) and security groups which ensures that any data between layers of our architecture is fully protected. These are service based firewalls.

We encrypt data at rest with AES-256. This service is provided by AWS following their best practice (http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html)

Each layer of services are segregated using Amazon Security Groups and Access Control Lists that limit servers that communicate to specific machines.

Availability and resilience

Guaranteed availability: 99.5% uptime
Approach to resilience: We use Amazon Web Services (AWS) with failover within UK availability zones on the event of any single node failure.

We follow AWS UK GOV guidelines (https://d0.awsstatic.com/whitepapers/compliance/AWS_CESG_UK_Cloud_Security_Principles.pdf) and have resilience within the UK.
Outage reporting: Email alerts following significant outage and we provide a live status dashboard at https://stats.uptimerobot.com/8Bz18FjPOk

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Dedicated link (for example VPN)

Username or password
Access restrictions in management interfaces and support channels: All management and interfaces can be offered through fully secure VPN and username password.

Certain highly controlled environments use both VPN, username, password and MFA.
Access restriction testing frequency: At least every 6 months
Management access authentication: 2-factor authentication

Dedicated link (for example VPN)

Username or password

Audit information for users

Access to user activity audit information: Users contact the support team to get audit information
How long user audit data is stored for: Between 1 month and 6 months
Access to supplier activity audit information: Users contact the support team to get audit information
How long supplier audit data is stored for: At least 12 months
How long system logs are stored for: Between 1 month and 6 months

Standards and certifications

ISO/IEC 27001 certification: No
ISO 28000:2007 certification: No
CSA STAR certification: No
PCI certification: No
Cyber essentials: Yes
Cyber essentials plus: No
Other security certifications: No

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: No
Security governance approach: Security Governance is provided internally by our team currently as we have a fairly new platform to the market. However, we approach security governance seriously. We have board level appointed oversight of our services, we actively track risks which are reported at board level consistently and frequently. We actively track staff and partner compliance with our information security standards.
Information security policies and processes: We have an detailed and comprehensive set of information security policies, practices and principles which are followed by staff and partners. We actively track compliance with our policies at board level.

Operational security

Configuration and change management standard: Supplier-defined controls
Configuration and change management approach: We have detailed configuration and change management processes which relate to the development, testing and release management of our software. We use automated deployment management processes to roll changes between environments, roll back and configure services.

These are consistent across all of our changes and all environments. Releases are tightly controlled through environments and only key staff have access to production environment to make any changes.
Vulnerability management type: Supplier-defined controls
Vulnerability management approach: We release known security patches (minor releases) using automated services via our cloud provider. For major releases, we assess each release, then test in each of our pre-production environments. Following successful test, we then roll the change to our production environment using automated configuration management.

We use a third party automated vulnerability management platform to analyse, report and identify vulnerabilities which we then action through a regular change process, prioritised according to severity.
Protective monitoring type: Undisclosed
Protective monitoring approach: Protective monitoring is provided by AWS where our services are hosted. When we are notified of any breaches we aim to respond to clients within same business day. Further investigation is then provided by our team. Any further communications to potentially affected clients are made within 24 hours.

We also use a third party vulnerability testing platform which automatically tests and reports vulnerabilities. Patching is prioritised based on severity.
Incident management type: Supplier-defined controls
Incident management approach: Our standard process for incident management is to 1 - categorise incident (performance, security, etc), 2 - determine impact, 3 - determine if we involve AWS, 4 - work towards resolution & recover as necessary.

Following this, we notify affected customers (primary user representatives) about the incident, its cause and what we did to restore service. We then follow an internal incident review and root cause analysis with key learning rolled in to our service management and operations where possible.

Secure development

Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

Connection to public sector networks: No

Fighting climate change: Fighting climate change

Our service helps organisations running large, high consumption services which consume unnecessary power to move to low cost utilisation models where services can be deployed only when necessary. This reduces power demands.

Furthermore, services can be moved to providers which are committed to carbon neutral services support and enabled providers to actively monitor and reduce their carbon footprint and sustainability goals (https://azure.microsoft.com/en-gb/global-infrastructure/sustainability/)
Covid-19 recovery: Covid-19 recovery

Our service enables organisations struggling with reduced staff to quickly and easily run cloud based analyses without the cost and need to hire specialist staff that would traditionally incur significant expense.

This enables faster time to transform digitally to take advantage or remote staff who may be affected by Covid or unable to travel
Tackling economic inequality: Tackling economic inequality

Our service can be accessed anywhere, which enables staff to both access and to be productive from any areas of the UK, regardless of their economic status. This creates opportunity and enables access to areas which until relatively recently would not have been able to fully participate in the services offered to government easily.
Equal opportunity: Equal opportunity

Access to Cloud Compare is open to everyone regardless of their status, background or culture.

Pricing

Price: £1.50 a virtual machine a month
Discount for educational organisations: Yes
Free trial available: Yes
Description of free trial: Any organisation can run a trial version by signing up for an account. This is loaded with 10 trial servers to test the comparison modelling.

Any virtual machines loaded beyond the free 10 limit will be subject to £1.50 per month.
Link to free trial: https://cloudcompare.io

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

Cloud Compare

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents