AMS

AMS File Transfer

AMS File Transfer is a secure, encrypted file transfer and file sharing solution for exchanging large and/or confidential files internally and externally. The service provides controlled access, encryption, and a full audit trail to support traceability. It is used by UK public-sector organisations, including the NHS, for secure file exchange.

Features

• Secure file delivery
• Transfer large files with no size limit
• Personalise with your branding
• File sharing & collaboration
• PACS integration
• 256-bit AES encryption
• Full audit trail
• UK data sovereignty
• 2 factor authentication
• Outlook integration

Benefits

• Secure your data in transit
• Reduce costs by replacing manual delivery
• Digital transformation
• Support compliance for securely transferring information
• Speed delivery of large files e.g. medical scans/images
• Personalised branding
• Modern & user friendly experience
• Increase productivity & free up user time

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@ams-ltd.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

688508652866461

Contact

Sales Team
01202 652070
sales@ams-ltd.com

About your service

• Service categories:

  Applications

  Content workflow and management

  Content services

  • Content Sharing and Collaboration Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: All communication to the service requires TLS 1.2 or higher to ensure a high level of secure encryption. Some older browsers that don't support TLS 1.2 are not supported.
• System requirements:
  • Any web browser (except older browsers that don't support TLS1.2)
  • Optional desktop tools require Windows 10 or higher
  • Optional PACS: Windows 2016-2025 Server, 8GB-RAM, 75GB-HDD, MultiCore 3.6GHz 64-bit

User support

• Email or online ticketing support: Yes
• Support response times: Response times are prioritised based on severity during UK business hours (9 to 5 Monday to Friday, excluding public holidays):; ; Level 1 – Business critical: Response within 2 hours.; Level 2 – Degraded service: Response within 4 hours.; Level 3 – General issues: Response within 8 hours.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Standard support included with the service. All customers have a dedicated account manager with whom they can escalate support if needed.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Full documentation is provided including, Quick Start Guide, User Guide, Online Videos, FAQ's and Admin Guide.; ; Online and onsite training is available.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • ODF
  • PDF
• End-of-contract data extraction: Data can be extracted via the portal, which includes reporting tools.; ; Every client has their own separate SQL database and storage account, which we can make accessible to the client.; ; There are options for AMS to create export tools to deliver the client data in a bespoke format, based on client requirements.
• End-of-contract process: Access to the portal to download data can be provided for a period of time after termination, at no additional cost.; ; Access to your SQL database and storage account can be provided. The only additional costs for this would be the Data Download charges at the contract rate.; ; Bespoke data export solutions would be quoted on a case by case basis for engineering time, dependent on your requirements.; ; All customer data will be deleted no later than 60 days after the effective date of termination, unless otherwise agreed in writing between the parties.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The web platform has been designed to be mobile friendly, and the same interface is used for both with no limitations. You can take advantage of a mobile device camera to take and securely transfer photos.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Web interface that enables users to send/receive file transfers, and share files. Admin interface for configuration and management of the system.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Accessibility evaluations are conducted through internal self-assessments using industry-standard tools and methodologies. This includes the following tools:; ; Accessibility Insights for Web: This tool is designed to assist developers in identifying and resolving accessibility issues. It provides automated checks and guided assessments for WCAG compliance.; ; WAVE Evaluation Tool: WAVE can identify many accessibility and Web Content Accessibility Guideline (WCAG) errors but also facilitates human evaluation of web content.; ; NVDA Screen Reader (NonVisual Desktop Access): Testing with NVDA ensures that our platform is navigable and functional for users who depend on screen readers to access digital content.
• API: Yes
• What users can and can't do using the API: Access to the API is restricted to users who have been explicitly granted the required API privilege. The assignment and management of user privileges are controlled by authorised administrators.; ; The API is used solely to support user actions, such as sending and receiving file transfers.
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: The following customisations can be carried out by AMS on behalf of the customer: ; - Interface branding: including logos, images, and colours; - Disclaimers, sign up terms and conditions; - URL; - Email domain; - Email templates

Scaling

• Independence of resources: The service is designed to ensure that one customer’s usage does not adversely affect others. Demand is managed through load balancing across service components, isolated tenant resources and fair usage rate limiting to prevent excessive consumption. Customer data is stored in separate storage accounts and databases, and processing capacity is managed to minimise contention. Where appropriate, compute resources are scaled or burst capacity is used to accommodate changes in demand and maintain consistent service performance.

Analytics

• Service usage metrics: Yes
• Metrics types: Metrics for storage, bandwidth and user licences are provided.
• Reporting types: Real-time dashboards
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: A wide range of technical and process controls are in place in line with ISO 27001 to protect data at rest.
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure

Data importing and exporting

• Data export approach: Data can be extracted via the portal. This includes reporting tools to export lists of transactions, users, groups, bandwidth, storage, audits etc. Files can be downloaded. In File Shares entire folders can be downloaded as a zip file.; ; There are options for AMS to create export tools to deliver the client data in a bespoke format, based on client requirements.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • TXT
  • PDF
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: SLA: 99.5% availability of the Cloud Services per calendar month, excluding any Scheduled Maintenance.; ; If the SLA is not met the customer will be refunded 10% of the service fees for the month.
• Approach to resilience: The service is hosted in Microsoft Azure on multiple load shared virtual machines. Each virtual machine is in different Azure Availability Set.; ; SQL Server and Storage Account resilience is provided by Microsoft Azure as a managed service.; ; All data is backed up to a different Azure UK region.
• Outage reporting: Outages and scheduled maintenance are reported via a public dashboard and email alerts.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces is restricted through role-based access controls and unique user accounts protected by username and password authentication. Multi-factor authentication is supported for administrative access. Optional geo-fencing is available to restrict access to management interfaces by public IP address. Access to support channels is restricted to authorised customer contacts, and requests are verified before any administrative action is taken.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We operate a documented Information Security Management System (ISMS) aligned with ISO/IEC 27001, including an Information Security Policy and supporting policies and procedures covering areas such as access control, data protection, incident management, supplier security and secure development.; ; Overall responsibility for information security sits with senior management, who provide governance and oversight as part of day-to-day operations.; ; All policies and procedures are communicated to staff as part of onboarding and ongoing training, with compliance reinforced through documented processes, role-based access controls and management oversight. Evidence of key controls and activities is maintained and reviewed.; ; Policies and processes are reviewed at least annually, and compliance is monitored through internal review and independent external audit as part of our ISO 27001 certification.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Service components are tracked throughout their lifecycle with assigned ownership to ensure accountability for configuration, maintenance and retirement. Asset owners are responsible for understanding the security and operational characteristics of each component.; ; Changes are managed through a controlled change process and assessed for purpose, scope and potential security impact. Where a change may introduce or alter risk, a risk assessment is carried out in line with the organisation’s risk management framework. Risk and process owners identify potential impacts and required controls. Where necessary, testing plans and rollback procedures are defined to maintain service security and resilience.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: An asset register is maintained, with asset owners responsible for identifying and managing vulnerabilities, supported by the Technical Director and Operations Director. Potential threats are assessed through regular risk assessments and review of technical vulnerabilities. Microsoft Defender for Cloud is used to monitor the environment and identify and report new vulnerabilities. Critical or high-severity vulnerabilities and patches are deployed immediately, with other patches applied in line with a defined patching schedule. Vulnerability information is obtained from cloud provider alerts, supplier advisories and penetration testing results.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Protective monitoring is provided using Microsoft Defender for Cloud to continuously monitor the service environment and identify indicators of potential compromise through security alerts and events. Alerts are reviewed to detect abnormal or suspicious activity and to assess whether a potential security incident may exist.; ; Where a potential compromise is identified, the event is logged and prioritised for investigation. Initial assessment and triage are carried out promptly, with higher-severity alerts escalated without undue delay in accordance with the incident management process.
• Incident management type: Supplier-defined controls
• Incident management approach: We operate a documented incident management process for information security events. Incidents can be reported by users or staff via an incident reporting process and are assessed and escalated without undue delay. Where required, affected customers are notified by email. Once an incident is contained and corrective actions are completed, an incident report is prepared and shared with affected customers and relevant authorities where applicable. Preventative actions are identified to reduce the risk of recurrence, and audit records are retained to support review and assurance activities.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: A free 14-day trial is available and includes up to five users with access to core service functionality. Custom domains and advanced configuration options are not included. Trial terms may be adjusted by agreement.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Approachable Certification
• ISO/IEC 27001 accreditation date: Friday 15 November 2024
• What the ISO/IEC 27001 doesn’t cover: The ISO/IEC 27001 certification applies to the information security management system supporting the design, development, operation and support of AMS cloud-based SaaS services.; ; The certification does not extend to customer controlled environments, end-user devices, networks, browsers or identity systems, nor to third-party systems or data sources integrated or accessed by customers outside the AMS service boundary.; ; Physical security of underlying data centre infrastructure and hardware lifecycle processes are managed by the cloud hosting provider and are not directly within the Supplier’s operational control, although they are subject to contractual and assurance arrangements.; ; While the Supplier provides the technical controls to support secure operation, customer-specific configuration choices, including data classification decisions, retention policy settings, access control assignments and the use of optional service features, are determined and managed by the Buyer.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Afb5448d-e534-45df-b635-bc510114db0f
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@ams-ltd.com. Tell them what format you need. It will help if you say what assistive technology you use.