VE3 GLOBAL LTD

Business Technology Platform

SAP Cloud Platform (VCP) is a platform-as-a-service (PaaS) product offering a development and environment for cloud applications. Built on SAP HANA in-memory database technology, SCP utilizes open source and open standards, enabling independent software vendors, startups, and developers to build and test cloud applications based on VE3 in-memory database technology.

Features

Creating mobile apps for field service workers
Employee recruitment travel and expense management application
Automating employee onboarding processes
Developers flexibility
Variety of programming languages
Connect enterprise applications and data to IoT

Benefits

Integration of SAP Business Suite and SAP SuccessFactors

Education pricing available

Service documents

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at prime@ve3.global. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

Contact

VE3 GLOBAL LTD Nikhil Alex
Telephone: 02045520840
Email: prime@ve3.global

About your service

Service categories

PaaS

Application Platforms

Deployment-centric application platforms

Service scope

Service constraints: Quaterly upgrades, agreed scheduled downtime for updates. Customer are always on the latest version.
System requirements: HTML5 based browser (Broswer/Device Agnostic)

Internet connection
Cloud deployment model: Public cloud

User support

Email or online ticketing support: Yes
Support response times: 24*7
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: WCAG 2.2 AA
Phone support: Yes
Phone support availability: 9 to 5 (UK time), Monday to Friday
Web chat support: No
Onsite support: Yes, at extra cost
Support levels: Standard (Bronze) – Business hours support (09:00–17:30 UK), incident and request handling, access to cloud support engineers, monthly reporting.

Enhanced (Silver) – Extended hours (e.g., 07:00–20:00), proactive monitoring and improved response SLAs.

Premium (Gold) – 24×7 cover, continuous monitoring, priority P1/P2 handling, regular service reviews.

Managed (Platinum) – Full 24×7 managed service including optimisation, patching, and release management.
Support available to third parties: Yes

Onboarding and offboarding

Getting started: We provide a structured onboarding process to help users begin using the service quickly and safely. This includes access to clear user documentation, setup guides and configuration templates tailored to the chosen cloud platform.

We offer online training sessions, covering console navigation, identity and access management, resource provisioning, monitoring and cost controls. For buyers requiring deeper enablement, we also provide optional onsite or virtual workshops, walk-throughs of key features, and hands-on sessions for administrators and developers.

During onboarding, users receive support from a cloud engineer to help with environment setup, connectivity, security configuration and best-practice deployment patterns. We also guide users through initial policies, tagging structures and governance controls to ensure the environment is configured correctly from the start.

This approach ensures all users—technical and non-technical—can begin using the service confidently and efficiently.
Service documentation: Yes
Documentation formats: PDF
End-of-contract data extraction: At contract end, users retain full control of their data and can export it directly from the cloud platform using any preferred method. All Lot 1a services support data extraction through multiple options, including:

Web console download (object storage, file shares, database exports)

API-based retrieval (REST/JSON endpoints)

Command line tools (Azure CLI, AWS CLI, gcloud, OCI CLI, VMware CLI)

Bulk export utilities (storage migration tools, database dump/export commands)

Infrastructure-as-code templates to redeploy configurations elsewhere

Users may also migrate data to another environment by transferring object/bucket storage, exporting snapshots, or using encrypted transfer to alternative cloud or on-prem systems.

VE3 provides guidance during offboarding to ensure all data is exported successfully, including support for verification and integrity checks. After the customer confirms extraction, all remaining data is securely deleted in line with client instructions and cloud-provider retention policies.
End-of-contract process: When the contract approaches expiry, the customer is notified in advance and an agreed offboarding window is provided. During this period, users retain full access to their Google Cloud Console, APIs, CLI tools and VE3 support channels so they can export data, remove resources, migrate workloads or transfer services to another provider. VE3 maintains access rights, monitoring and basic support throughout offboarding to ensure users can safely extract VM images, databases, storage objects, logs and configurations. Once the customer confirms that all required data has been extracted, VE3 schedules the secure deprovisioning and sanitisation of remaining resources in line with Google Cloud’s data-deletion policies.

The contract price includes guidance on offboarding steps, continued portal and API access during the offboarding period, standard support for data extraction questions, and confirmation of secure deletion. Additional costs apply only where users require extended assistance—such as migration engineering, large-scale data transfer support, custom export tooling, or a managed transition project. These activities can be delivered on request as optional professional services.
Documentation accessibility standard: WCAG 2.2 AA

Using the service

Web browser interface: Yes
Using the web interface: All Lot 1a services include a secure, browser-based web interface that allows authorised users to provision, configure, monitor and manage cloud resources. Through the web console, users can set up services, deploy infrastructure components (compute, storage, networking, PaaS resources), configure security policies, review billing and usage, manage IAM roles, and perform operational tasks such as scaling, backup configuration and health monitoring.

Users can make changes through the interface at any time, including modifying resource parameters, updating configurations, creating or deleting instances, integrating services, or adjusting cost controls. Access is role-based to ensure users only perform actions permitted by their assigned permissions.

Limitations vary by provider but typically include:

some advanced automation functions may require CLI/API/Terraform

certain enterprise integrations or custom deployments may require backend configuration

infrastructure-level restrictions may apply based on buyer policy or governance

The interface supports multi-factor authentication, audit trails and role-based access to maintain security and compliance.
Web interface accessibility standard: WCAG 2.2 AA
Web interface accessibility testing: Cloud consoles provided by major vendors (Azure, AWS, Google Cloud, Oracle, VMware, SAP) undergo regular accessibility testing, including compatibility with screen readers (JAWS, NVDA), keyboard-only navigation, high-contrast modes and zoom tools. VE3 additionally validates user workflows during onboarding to ensure compatibility for users relying on assistive technologies. No barriers have been identified for standard administrative operations.
API: Yes
What users can and can't do using the API: Authorised users can use our REST/JSON APIs and the underlying cloud-provider APIs to provision, configure and manage environments. Typical operations include: creating and updating compute, storage and networking resources; deploying and scaling PaaS components (databases, integration services, data platforms); managing identities, tags, policies and cost controls; and retrieving monitoring, logging and billing data.

Services can be set up through the API by creating a tenant/subscription, defining resource groups or projects, and then deploying parameterised templates or infrastructure definitions. Changes are made by updating resource definitions or calling configuration endpoints; these can be fully automated in CI/CD pipelines.

Limitations include role-based restrictions (destructive or security-sensitive operations are limited to appropriate roles), provider-imposed rate limits, and a small number of advanced features that may only be exposed via the management console or change management process rather than the public API.
API automation tools: Ansible

Chef

SaltStack

Terraform

Puppet
API documentation: Yes
API documentation formats: PDF
Command line interface: Yes
Command line interface compatibility: Linux or Unix

Windows

MacOS
Using the command line interface: A full command line interface (CLI) is available for all Lot 1a services, enabling users to script, automate and manage cloud infrastructure programmatically. Using the CLI, users can authenticate to their cloud tenancy or subscription, initialise resource groups or projects, deploy compute, storage and networking components, configure PaaS services, and retrieve monitoring or diagnostic data.

Users can set up services by installing the CLI tool (for example, Azure CLI, AWS CLI, gcloud CLI, Oracle OCI CLI or VMware CLI), authenticating with MFA-enabled credentials or service principals, and running standard commands or applying infrastructure templates. Changes can be made by updating configuration parameters, running declarative scripts, or automating deployments through CI/CD pipelines.

Limitations include:

certain advanced features may require the web console or API rather than CLI

role-based access may restrict destructive operations

rate limits or governance policies may apply depending on buyer configuration

The CLI is fully compatible with automation workflows and is widely used for DevOps, infrastructure-as-code and repeatable environment builds.

Scaling

Independence of resources: At the infrastructure layer, customers are separated into dedicated subscriptions/tenancies, virtual networks and resource groups. Underlying hyperscale platforms (e.g. Azure, AWS, Google Cloud, Oracle, VMware) use hypervisor isolation, capacity reservations and “noisy neighbour” controls to prevent one tenant’s CPU, memory or I/O usage from impacting another.

At the platform layer, PaaS services run in separate containers or instances with defined resource limits, autoscaling and throttling. We use quotas and rate limiting on APIs, storage and compute so individual workloads cannot exhaust shared capacity.

Capacity is managed proactively through monitoring and scaling policies, with alerts on saturation thresholds.
Usage notifications: Yes
Usage reporting: API

Email

SMS
Optimising consumption: Yes
Automatic scaling: Yes

Analytics

Infrastructure or application metrics: Yes
Metrics types: CPU

Disk

HTTP request and response status

Memory

Network

Number of active instances
Reporting types: API access

Real-time dashboards

Regular reports

Reports on request
Resource tagging: Yes
FOCUS resource tagging: Yes

Resellers

Supplier type: Reseller providing extra features and support
Organisation whose services are being resold: SAP

Staff security

Staff security clearance: Conforms to BS7858:2019
Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom
User control over data storage and processing locations: Yes
Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
Penetration testing frequency: At least once a year
Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest: Physical access control, complying with SSAE-18 / ISAE 3402

Encryption of all physical media

Scale, obfuscating techniques, or data storage sharding
Data sanitisation process: Yes
Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data Erasure

Explicit overwriting of storage before reallocation / Secure Erase

Backup and recovery

What’s backed up: Virtual machines – full snapshots of compute instances and disks

Databases – managed and unmanaged cloud database services

Object storage – buckets, blobs, archived files

File shares – NFS/SMB cloud file systems
Backup controls: Users control backup policies through the cloud platform’s management console, CLI or API. They can define what resources to back up, retention periods, frequency (hourly, daily, weekly), and region or zone for storing copies. Different backup schedules can be applied to different workloads, such as separate policies for virtual machines, databases or storage accounts. Users may also enable continuous backup options or create on-demand snapshots at any time. Role-based access ensures only authorised administrators can modify backup rules.
Datacentre setup: Multiple datacentres with disaster recovery
Scheduling backups: Users schedule backups through a web interface
Backup recovery: Users can recover backups themselves, for example through a web interface
Backup and recovery: Yes
RPO/RTO: Yes

Data-in-transit protection

Data protection between buyer and supplier networks: Private network or public sector network

TLS (version 1.2 or above)

IPsec or TLS VPN gateway
Data protection within supplier network: TLS (version 1.2 or above)

IPsec or TLS VPN gateway

Legacy SSL and TLS (under version 1.2)

Availability and resilience

Guaranteed availability: We typically align service levels with the underlying hyperscaler (for example Azure, AWS, Google Cloud, Oracle, VMware) and then wrap them in a clear, contract-level SLA.

For Lot 1a services, our standard target is **99.9% availability per calendar month** for the managed components within our control (excluding planned maintenance windows agreed in advance, force majeure, and customer-caused issues). Higher targets (for example **99.95% or 99.99%**) can be designed and priced at call-off using multi-zone, active/active, or resilient architectures.

If we fail to meet the agreed availability SLA, customers are entitled to **service credits** against the monthly service charges. These are typically tiered (for example, increasing % credits as availability drops further below target) and are applied as a deduction from a future invoice. The precise percentage bands and thresholds are confirmed in the call-off so they reflect the specific design, criticality and cost of the environment.
Approach to resilience: Our service is designed to be resilient by leveraging the built-in high-availability and disaster-recovery capabilities of leading hyperscale cloud platforms. All customer environments run across **multiple datacentres (availability zones)** with independent power, cooling, networking and physical security controls. Core components such as compute, storage and networking are designed with **redundancy, automatic failover, and zone-level isolation** to protect against localised failures.

Data is stored with **multi-zone replication**, integrity checks and optional cross-region disaster-recovery configurations depending on buyer requirements. The platform continuously monitors infrastructure health and automatically replaces or restarts failed components. Load balancing, autoscaling, and distributed architectures ensure the service remains available during demand spikes or hardware failures.

Full details of underlying datacentre architecture and resilience controls are **available on request**, including compliance reports, redundancy configurations, and recovery architecture patterns.
Outage reporting: We use several channels to report outages and degradation so users are informed quickly and transparently:

Public dashboard: A cloud status page provides real-time visibility of service health, showing current incidents, affected regions/services and historical uptime.

Email alerts: Customers can subscribe to incident and maintenance notifications. During an outage we send initial alerts, updates, and closure messages, including impact, workaround (if any), and estimated time to resolution when available.

API / webhooks (Other): For advanced users, incident and health information can be integrated into their own tooling via APIs or webhooks (for example into ITSM, Teams/Slack, or NOC dashboards).

Identity and authentication

User authentication needed: Yes
User authentication: Multi-Factor Authentication (MFA)
Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is restricted using role-based access control (RBAC), least-privilege principles, and multi-factor authentication (MFA). Administrative actions are limited to authorised personnel within defined roles, with segregation between support, operations and security teams. All access is logged, monitored and periodically reviewed. Customer environments are isolated within separate tenancies or subscriptions, preventing cross-tenant access. Support channels enforce identity verification before any change is made, and sensitive operations require elevated approval. Remote access uses secure channels (TLS/MFA/VPN), with Just-In-Time access available where supported to minimise exposure windows.
Access restriction testing frequency: At least once a year
Management access authentication: Multi-Factor Authentication (MFA)
Devices users manage the service through: Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: User-defined
Access to supplier activity audit information: Users have access to real-time audit information
How long supplier audit data is stored for: User-defined
How long system logs are stored for: User-defined

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001
Information security policies and processes: We operate a full Information Security Management System aligned to ISO 27001 and Cyber Essentials Plus, supported by documented policies covering access control, asset management, data protection, secure development, vulnerability management, incident management, business continuity and supplier assurance. Policies are reviewed annually or after significant change.

Governance is overseen by the Information Security Lead, who reports to VE3’s senior management. Compliance is monitored through internal audits, automated controls, risk assessments, and mandatory staff training. Technical enforcement includes RBAC, MFA, encryption, network segmentation, logging and continuous monitoring.

Security incidents follow a defined process: detection, triage, containment, root-cause analysis and corrective action, with escalation to senior leadership where required. All changes follow a controlled change-management process to ensure policy adherence. We also align to hyperscale cloud security best practices and regularly review our posture against government and industry standards.

Operational security

Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
Configuration and change management approach: We follow a controlled, ITIL-aligned configuration and change management process. All components are defined and tracked using infrastructure-as-code templates stored in version control, creating a full audit trail and enabling consistent, repeatable deployments. Assets are registered in a configuration repository and tagged to track ownership, environment and lifecycle.

Changes follow a formal workflow: request, assessment, approval, implementation and review. Each change is evaluated for security impact, including access, encryption, network exposure, dependency effects and compliance. High-risk changes require security or CAB approval. All updates are tested in non-production and logged to support audit and traceability.
Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
Vulnerability management approach: We follow a structured vulnerability management process using automated scanning, configuration baseline checks and continuous monitoring to identify threats across our managed components. Potential vulnerabilities are assessed using CVSS scores, exploitability and service impact. Threat intelligence is sourced from vendor advisories (Microsoft, AWS, Oracle, SAP, VMware), NCSC alerts, CVE/NVD feeds and industry security communities. Critical vulnerabilities are typically remediated within 24–72 hours, high-risk within agreed SLAs, and others during scheduled maintenance. Underlying cloud platform vulnerabilities are patched by the hyperscaler; we apply configuration updates or compensating controls as required. All remediation actions are logged and tracked.
Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
Protective monitoring approach: We use continuous protective monitoring across all managed components, including log collection, anomaly detection, threat intelligence feeds and cloud-native security services (for example Azure Security Center, AWS GuardDuty, GCP Security Command Center). Potential compromises are identified through alerts on suspicious authentication, privilege escalation, unusual network activity, configuration drift or malware indicators. All alerts are triaged immediately; critical incidents receive response within 1 hour, with containment, investigation and remediation following a defined incident management process. Actions may include isolating resources, rotating credentials, applying patches and producing post-incident reports with root-cause analysis and corrective controls.
Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
Incident management approach: We operate a formal, ITIL-aligned incident management process with **pre-defined runbooks** for common events (service degradation, access issues, capacity problems, security alerts and backup/restore failures). Incidents can be reported by users via the **service desk portal, email or phone**, and high-severity events may also be raised automatically from monitoring and alerting tools.

All incidents are logged, categorised and prioritised with agreed response and resolution targets. We keep users informed through status updates during investigation and resolution. For **major incidents**, we provide a written **incident report** detailing timeline, root cause, impact, corrective actions and preventive measures, typically within an agreed timeframe.
Post-quantum cryptography secure: Yes

Secure development

Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Separation between users

Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
Who implements virtualisation: Third-party
Third-party virtualisation provider: Hyperscale cloud provider – Azure, AWS, Google Cloud, Oracle, VMware)
How shared infrastructure is kept separate: We use the hyperscaler’s multi-tenant virtualisation and logical isolation controls to ensure complete separation between organisations. Each customer operates within a dedicated tenancy/subscription, isolated virtual networks and resource groups. The underlying platform enforces strong separation through hypervisor-based isolation, container sandboxing, kernel-level security, and memory, CPU and I/O separation that prevents cross-tenant access. Network segmentation, firewalls, security groups and identity boundaries further ensure workloads cannot interact unless explicitly configured. Storage is logically isolated with encrypted, tenant-scoped keys. The provider regularly validates isolation through independent audits, penetration testing and compliance certifications.

Energy efficiency

Energy-efficient datacentres: Yes
Description of energy efficient datacentres: Our underlying hyperscale cloud providers (Microsoft Azure, AWS, Google Cloud, Oracle Cloud, VMware) operate datacentres that follow the EU Code of Conduct for Energy-Efficient Datacentres. They implement industry-leading efficiency measures including:

advanced cooling technologies (free-air, liquid, evaporative cooling)

energy-efficient power distribution and UPS systems

server virtualisation and high-density compute to reduce energy per workload

continuous monitoring of PUE (Power Usage Effectiveness) with targets typically ≤1.2 in modern sites

renewable energy procurement and carbon-reduction programmes

ongoing audits and lifecycle optimisation aligned to EU-CoC best practices

Pricing

Discount for educational organisations: Yes
Free trial available: No

Discount

Provide your minimum discount applicable to your baseline prices: 3%

Formula for calculating price of your services

Which of the core deployment models you intend to offer

Public Cloud

Public Cloud - Formula for calculating price of your services

Total Cost: The Total Cost for a buyer's call off requirement in a Public Cloud Deployment
=
Baseline Pricing: Baseline pricing is usage-based and is determined from published unit rates for the Public Cloud components that make up the buyer’s requirement (for example compute, storage, networking, and managed platform services), plus any VE3 standard service charges that are explicitly priced as part of the service offering. Buyers identify the baseline by selecting the required service components (region, tier, instance/service size, storage class and expected usage volumes such as hours/GB/requests) and multiplying expected usage by the published unit rates shown in the service’s Pricing section. Where a service includes a VE3-managed or professional services element, the applicable unit/day-rate or fixed charge is also shown in the Pricing section of the relevant catalogue entry. Prices are stated in GBP and exclude VAT unless otherwise specified. The minimum discount (as stated in the ‘Discount’ question) is then applied to derive the discounted baseline before onboarding and any other cost factors are added.
Baseline Pricing - Web link: https://www.ve3.global
-
Minimum Discounting: 3%
+
Onboarding Activity: Onboarding costs may vary based on your specific requirements, please confirm with suppliers during the clarification process
+
Additional sources of cost: Additional costs may arise where the buyer’s requirement increases scope or consumption beyond the baseline assumptions. Typical cost drivers include: higher-than-forecast public cloud consumption (for example increased compute hours, storage growth, managed database throughput, or API/request volumes); network and connectivity requirements (VPN/peering/private connectivity where applicable); high outbound data transfer (egress) volumes; enhanced security/compliance controls (for example WAF, SIEM/SOC integration, vulnerability scanning, encryption/HSM, additional audit requirements); backup and disaster recovery requirements (multi-region resilience, longer retention); increased logging/monitoring retention and observability tiers; additional environments (dev/test/stage/perf); premium support hours (24x7) and tighter incident SLAs; third-party software licensing/marketplace subscriptions; and change requests for non-standard configurations or accelerated delivery. Where underlying cloud services are priced in non-GBP currencies, exchange-rate movements may also affect pass-through consumption costs.
-
Additional sources of cost reduction: Cost reductions may apply in addition to the stated minimum discount through: commitment-based discounts offered by public cloud providers (for example Reserved Instances/Savings Plans/Committed Use) and volume-based pricing where applicable; right-sizing and autoscaling to reduce unused capacity; scheduling and shutdown of non-production environments out of hours; use of spot/preemptible capacity where appropriate; storage lifecycle management (tiering to lower-cost storage/archival); consolidation of shared services (logging/monitoring/network components) across workloads; use of existing customer licences (BYOL) where permitted; and sector-specific discounts or service bundling where included in the service pricing. VE3 can also provide FinOps optimisation and continuous cost governance so that reductions identified are reflected in revised run-rate forecasts and monthly charges.

Mandatory certifications

Are you are bidding to offer IaaS and/or PaaS as a reseller or are you in sole control of the infrastructure

Reseller

Cloud service suppliers you intend to resell with evidence

Organisation 1

Organisation name

Microsoft