Chorus Intelligence Ltd

Chorus Intelligence Suite – Digital Intelligence and Investigation Software

The CIS is an end-to-end digital intelligence and investigation suite. Capabilities include secure and audited case management, cross-case analysis, digital data (CDR, ANPR, handsets, financial) cleansing and advanced mapping, federated search, entity attribution and enrichment. obfuscated open-source capture, internal and third-party data integration, custom evidential reporting, and internal/external data sharing.

Features

• Secure, encrypted and audited digital evidence and case management solution
• Cleanse and map digital data (CDR, ANPR, handsets, financial data)
• Internet Intelligence, federated search and OSINT Investigation tools
• Anonymously capture OSINT (webpages/snippets/video) as searchable PDFs via obfuscated environment
• Fully automated disclosure and redactable evidential reporting
• Secure, encrypted and audited digital data sharing internally and externally
• Upload, index and make searchable internal and unstructured data.
• Apply access controls to view/edit cases. Maintain audit logs
• Search internal and third-party systems data, direct from CIS
• Cross-case analysis. Bulk search entities across cases to reveal crossovers

Benefits

• Improve efficiency. Search, analyse, enrich, and report, from one platform
• Secure, encrypted and audited case management and data sharing solution
• Robust audit trail for all data processing
• Save money. Connect/API existing systems into one platform
• Software as a Service (SaaS) platform which protects anonymity
• Rapidly processes large raw data files to evidential standards
• Save 97% of time in data cleansing and preparation
• Intuitive, self-serve tools to empower multiple user roles
• Single licence fee includes training, support and upgrades
• Customisable and exportable courtroom-ready evidential reports

£3,800 a user a year

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at accounts@chorusintel.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

661058589877098

Contact

Sarah Stephens
020 3597 7350
accounts@chorusintel.com

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: There will be scheduled maintenance and business continuity testing.
• System requirements:
  • Windows 8.1 or Windows 10 on the endpoint.
  • Internet Explorer 11, Firefox or Chrome.
  • Appropriate infrastructure changes to access the service

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: In excess of 90 percent of incidents receive a first response within 30 minutes of being logged in business hours. Calls and emails are answered between 08:30 – 20:00, Monday to Thursday and 08:30 to 17:30 Friday. The service is supported by skilled application and infrastructure specialists. Where an issue or question needs further analysis, the standard SLA terms will be applicable
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Onsite support
• Support levels: Chorus provides a single support level to all customers and aims to provide the best quality of service. Support is included in the licensing cost, and we provide Customer Relationship Managers who engage directly with clients and have access to escalate to specialist cloud support engineers
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: A Customer Relationship Manager is assigned to each customer and will assess and arrange all necessary onsite and online training requirements, as well as access to the initial online training course as well as videos and documentation. Regular application webinars are posted to our website which all customers can access. The Service Desk is available as an additional free resource to help customers with any queries or assistance they may need. A comprehensive user guide is built into the software.
• Service documentation: Yes
• Documentation formats:
  • PDF
  • Other
• Other documentation formats:
  • Video
  • Online computer based training
• End-of-contract data extraction: For cloud deployments users have the ability to extract, download or permanently delete their data via a secure File Transfer Portal and Secure Shredder utility. ; ; For onsite deployments, users can either keep the hard disk (HDD) or delete any data and send the HDD back to Chorus, for the disk to be destroyed.; ; For cloud deployments, Chorus can arrange for data to be copied and returned to the customer, in a mutually acceptable format. Once the data is confirmed as returned, data is then is wiped from the server and cannot be recovered.
• End-of-contract process: A renewal notice is sent otherwise the contract ends at no additional cost.

Using the service

• Web browser interface: Yes
• Supported browsers: Chrome
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.1 AA or EN 301 549
• Description of service interface: Web Based user interface
• Accessibility standards: WCAG 2.1 AA or EN 301 549
• Accessibility testing: CIS has been independently assessed to confirm it follows best practice for items such as keyboard navigation, screen reader and colour contrast as well as adhering to common user workflow patterns for web based applications. CIS has been tested by an independent 3rd party to ensure compliance with the latest WCAG standards. This report can be shared if required. The testing covered usage of screen readers, keyboard navigation and colour contrast checks for the most part.
• API: Yes
• What users can and can't do using the API: Users are able to request data as read-only.; Users are unable to make changes through the API.; Users are able to upload raw data via the API; Read-only limitations.
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Applications within the platform are highly customisable and users can define items such as templates, column layouts, reports, session outputs and application views. ; CIS supports a degree of customisation at both the client level, such as security levels, some menu options etc as well as individual user customisations. Users are able to customise the look and feel of some parts of the application, set favourites in terms of layout or search preferences as well as customise colours and highlighting of data.

Scaling

• Independence of resources: Each customer has a logically separated, dedicated pool of resource which can be scaled as needed. Load balancing and comprehensive monitoring ensures any usage trends or spikes are identified and do not affect users of the service.

Analytics

• Service usage metrics: Yes
• Metrics types: Service usage reports
• Reporting types: Reports on request

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Data sanitisation type: Explicit overwriting of storage before reallocation
• Equipment disposal approach: In-house destruction process

Data importing and exporting

• Data export approach: Sessions can be exported from Chorus as a CI5 session file. Reports can be saved in Excel format, and data can be saved directly from Chorus in a variety of formats. Maps can be saved as PowerPoint slides or to an Excel workbook.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • XLSX
  • XML
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • XML
  • XLS
  • XLSX
  • JPEG
  • TXT
  • CIS
  • DGT

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • IPsec or TLS VPN gateway
  • Other
• Other protection within supplier network: Multiple security products protect the environment, including next generation firewalls, threat and intrusion detection solutions, multiple antivirus products, file type filtering and data encryption in transit and at rest. All data at rest is encrypted to AES256 standard.

Availability and resilience

• Guaranteed availability: Chorus Cloud SLA aiming to achieve 99% Availability.
• Approach to resilience: The cloud environment is highly resilient by design and further information is available upon request.
• Outage reporting: Service outages are reported to customers via email.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Dedicated link (for example VPN)
  • Username or password
  • Other
• Other user authentication: It is possible, in the AWS hosted environment to delegate Identity management to the clients own Identity provided, for example Azure AD, but most other Identity providers are supported. This includes MFA solutions.; Each system user must have their own username and password; Strict password security policies are in place governing length, complexity, history and how frequently it should be changed. This is kept in line with industry best practice recommendations.
• Access restrictions in management interfaces and support channels: Management and support access to the environment is only permitted by designated support staff over secure channels. A policy of least privilege is in place to limit which staff have access to production environments with all changes audited and anomalous behaviour is flagged, e.g. logging in at an unusual time would cause an alert to be raised. Access to the servers can only happen from a controlled list of IP addresses as a further layer of security.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Dedicated link (for example VPN)
  • Username or password
  • Other
• Description of management access authentication: MFA where supported

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: Between 1 month and 6 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: SN Registrars (Holdings) Ltd trading as DAS Certification
• ISO/IEC 27001 accreditation date: 06/08/2021
• What the ISO/IEC 27001 doesn’t cover: None
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: Yes
• Any other security certifications:
  • Cyber Security Essentials
  • PASF
  • ISO9001

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: Senior managers understand their responsibility with respect to security for the organisation and support this work with adequate financial resources, effective management and annual reviews. All personnel who have access to digital assets understand their daily responsibilities to protect and preserve the organisation’s security. Security requirements are addressed throughout all system/software development life cycle phases including acquisition, initiation and requirements engineering
• Information security policies and processes: Chorus is ISO 27001 accredited and adheres to a documented Information Security Policy. All Chorus offices and data centres are PASF accredited. Chorus holds Cyber Essentials Plus Accreditation. Training is conducted routinely and consistently, and security responsibilities are reflected in job descriptions. IT systems have restricted access and processes defined for system support are fully audited. Chorus adheres to a policy of least privilege with all changes to access entitlement requiring a clear business need and line manager approval.; MFA is required for all admin users and regular audits and reviews of access are carried out.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Consistent, controlled Configuration Management is achieved throughout the cloud environment using a leading systems management tool. This approach allows packages and configurations to be created, documented and tested prior to deployment into production. Once approved, these configurations and packages give a consistent, auditable outcomes. ; ; The cloud environment is protected by a Change Management process which mandates that all changes are identified, assessed and controlled. Following approval, changes are applied to a test environment to assess their impact before deployment into production.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Chorus takes vulnerability management extremely seriously, and the environment is scanned daily using a leading vulnerability assessment tool. A remediation process ensures that discovered vulnerabilities are appropriately remediated.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Chorus uses a leading protective monitoring product which monitors for threats and intrusion attempts, as well as monitoring logs and user activity.
• Incident management type: Supplier-defined controls
• Incident management approach: Chorus operates an ITIL aligned Incident Management Process which focusses on delivering efficient service operation and continual service improvement. Our Service Desk provides a single point of contact between our support team and our customers who can log incidents via phone or email. Service Management reports give customers an insight into their support usage.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  Wellbeing

  Wellbeing

  Chorus is dedicated to improving the wellbeing of our users, the law enforcement industry and the community of people that it supports and protects. We provide our investigative software for free to Locate International, a UK charity dedicated to helping families of unsolved missing person cases, find their loved ones. ; ; What’s more, we regularly run sponsorship events to raise money for local and national charities. We also work closely with the police forces that use our technology to support them in their charitable causes through sponsorship.

Pricing

• Price: £3,800 a user a year
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: For a designated period the software plus training and support will be made available to potential customers to assess the effectiveness of the software. These services will be made available free of charge and free of any obligation to the potential customer.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at accounts@chorusintel.com. Tell them what format you need. It will help if you say what assistive technology you use.