Grafana

Service scope

Software add-on or extension: No
Cloud deployment model: Public cloud

Private cloud

Hybrid cloud
Service constraints: No
System requirements: Standard version has no requirements; commercial features require a licence.

1 CPU and 512mb minimum

User support

Email or online ticketing support: Email or online ticketing
Support response times: Depends on SLA, normally within 4 hours
User can manage status and priority of support tickets: No
Phone support: Yes
Phone support availability: 9 to 5 (UK time), Monday to Friday
Web chat support: No
Onsite support: Yes, at extra cost
Support levels: L1: Tier/Level 1(T1/L1)
Initial support level responsible for basic customer issues. Gathering formation to
determine the issue by analysing the symptoms and figuring out the underlying problem.
L2: Tier/Level 2(T2/L2)
This is a more in-depth technical support level than Tier I containing experienced and more
knowledgeable personnel on a particular product or service.
L3 Tier/Level 3(T3/L3)
Individuals are experts in their fields and are responsible for not only assisting both Tier I and
Tier II personnel, but with the research and development of solutions to new or unknown
issues.
Severity Definitions
1- Critical: Proven Error of the Product in a production environment. The Product Software
is unusable, resulting in a critical impact on the operation. No workaround is available.
2- Serious: The Product will operate but due to an Error, its operation is severely restricted.
No workaround is available.
3- Moderate: The Product will operate with limitations due to an Error that is not critical to
the overall operation. For example, a workaround forces a user and/or a systems
operator to use a time consuming procedure to operate the system; or removes a nonessential
feature.
4- Due to an Error, the Product can be used with only slight inconvenience.
Support available to third parties: Yes

Onboarding and offboarding

Getting started: Core Grafana consultancy Grafana installation and configuration Grafana ingestion specifications Grafana tuning Grafana testing Security installation and configuration Excluded; Grafana support Grafana upgrades.

https://grafana.com/docs/
Service documentation: Yes
Documentation formats: HTML
End-of-contract data extraction: All data resides inside the customer´s own cloud/onprem account.
End-of-contract process: Upgrades, consultancy, service maintenance will end

Using the service

Web browser interface: Yes
Supported browsers: Internet Explorer 11

Microsoft Edge

Firefox

Chrome

Safari

Opera
Application to install: No
Designed for use on mobile devices: Yes
Differences between the mobile and desktop service: No feature differences
Service interface: Yes
User support accessibility: None or don’t know
Description of service interface: Runs via GUI.
Drag and drop features to customise layout.
Accessibility standards: None or don’t know
Description of accessibility: Grafana is partially conformant with WCAG 2.1 level AA and aims to meet this status in the future. Partially conformant means that some parts of the content do not fully conform to the accessibility standard.
Accessibility testing: None
API: Yes
What users can and can't do using the API: Access various features and functionalities to automate tasks, integrate with other systems and extend capabilities. For example, dashboard management, data source configuration, user management, alerting configuration, plugin development, audit logging and dashboard templating.
API documentation: Yes
API documentation formats: HTML
API sandbox or test environment: Yes
Customisation available: Yes
Description of customisation: Dashboards, visualisationsm data sources, alerting rules, user interface and authentication & authorisation can all be customized.

Users can customise thorugh the user interface, configuration files, and API.

The ability to customise depends on the user´s role and permissions- typically the following can: Administrators, dashboard designers, data source administrators alert managers, plugin managers. End users can customise their viewing experience by interacting with dashboard panels, filters and time ranges.

Scaling

Independence of resources: Each client has their own independent environment.

Analytics

Service usage metrics: Yes
Metrics types: Performance metrics
User activity metrics
Grafana can emit Jaeger or OpenTelemetry Protocol (OTLP) traces for its HTTP API endpoints and propagate Jaeger and w3c Trace Context trace information to compatible data sources.

Resellers

Supplier type: Not a reseller

Staff security

Staff security clearance: Other security clearance
Government security clearance: Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom

European Economic Area (EEA)
User control over data storage and processing locations: Yes
Datacentre security standards: Supplier-defined controls
Penetration testing frequency: At least once a year
Penetration testing approach: In-house
Protecting data at rest: Encryption of all physical media
Data sanitisation process: No
Equipment disposal approach: A third-party destruction service

Data importing and exporting

Data export approach: Users have the option to export their dashboard/table data in CSV format.
Data export formats: CSV

Other
Other data export formats: JSON
Data import formats: CSV

Other
Other data import formats: JSON

Data-in-transit protection

Data protection between buyer and supplier networks: Private network or public sector network

TLS (version 1.2 or above)
Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability: AWS guaranteee 99.999% uptime service. AWS services are delivered from multiple datacentres worldwide. When deploying customer services to AWS, the service can be configured such that services span multiple availability zones (data centres) to ensure service availability.
Approach to resilience: The data centre is provided by AWS who comply with the strictest of resiliency standards. Further information is available on request.
Outage reporting: Email alerts.
Slack channel alerts
Microsoft Teams channel Alerts

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Identity federation with existing provider (for example Google Apps)

Dedicated link (for example VPN)

Username or password
Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is restricted through a combination of username and passwords, multifactor authentication, firewalling, IP restrictions, the use of bastion hosts as appropriate.
Access restriction testing frequency: At least once a year
Management access authentication: 2-factor authentication

Identity federation with existing provider (for example Google Apps)

Dedicated link (for example VPN)

Username or password

Audit information for users

Access to user activity audit information: You control when users can access audit information
How long user audit data is stored for: At least 12 months
Access to supplier activity audit information: You control when users can access audit information
How long supplier audit data is stored for: At least 12 months
How long system logs are stored for: At least 12 months

Standards and certifications

ISO/IEC 27001 certification: No
ISO 28000:2007 certification: No
CSA STAR certification: No
PCI certification: No
Cyber essentials: Yes
Cyber essentials plus: No
Other security certifications: No

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: Other
Other security governance standards: Cyber Essentials
Information security policies and processes: Millersoft follows AWS best practice on security https://aws.amazon.com/security/. We have a range of technical and organisational measures to ensure data security and protection. These cover Access, Roles and Responsibilities, Resource/asset management, Access Control & Authentication, Workstation & Device Security, Network/Communications Security, Back-up, mobile/portable device security, and physical security of our premises. Staff training and awareness is ongoing, staff / contractors must sign confidentiality and privacy statements and read and sign company security policy. Sanctions are applicable for non-compliance. Our reporting structure if a security breach happens or is suspected: staff are trained to and required to immediately flag to DPO and CEO and lock down or isolate the breach where feasible; DPO/CEO will take immediate action including isolation or lock down of affected systems, notification to affected parties, implementation of business continuity and disaster recovery. Risk impact reviews are conducted when a new data category is processed, or system implemented, and security measures adapted as necessary. Category logs, training logs, access logs, and breach logs are maintained, reviewed and signed off periodically by the assigned DPO and CEO.

Operational security

Configuration and change management standard: Supplier-defined controls
Configuration and change management approach: Latest releases of Grafana are tracked. Any major security issues will be monitored and the application updated if any are found.
Grafana can be updated on request if updates are made and new features are required.
Vulnerability management type: Supplier-defined controls
Vulnerability management approach: Millersoft Grafana emphasizes security through proactive measures including regular security audits, community engagement for vulnerability reporting, and prompt release of patches. It employs automated security testing within its CI/CD pipeline, offers detailed security documentation, and maintains a responsible disclosure policy. Organizations are advised to integrate Keycloak with existing security tools for enhanced monitoring and to follow the project's security advisories for timely updates. These practices ensure ongoing prioritization of security, safeguarding user data and maintaining the integrity of the identity management platform.
Protective monitoring type: Supplier-defined controls
Protective monitoring approach: All logs go to AWS Cloudwatch for auditing, monitoring and alerting
Incident management type: Supplier-defined controls
Incident management approach: Detection and Reporting: Monitoring systems detect anomalies and issues are reported by users or automated systems.

Response: A dedicated team assesses the incident to determine its impact and urgency.

Analysis and Investigation: The team investigates to identify the root cause and extent of the incident.

Resolution and Recovery: Steps are taken to resolve the issue and restore service to normal operations.

Post-Incident Review: Analyze the incident to improve future response and prevent recurrence.

Secure development

Approach to secure software development best practice: Supplier-defined process

Public sector networks

Connection to public sector networks: No

Social Value

Tackling economic inequality

We believe that our social mission to assist young people into employment is compatible with the guidelines laid out in the Governments Social Value theme of tacking economic inequality (MAC 2.2). Wherever it has the opportunity to do so, Millersoft has and continues to offer placements, internships and employment to technology students from the deprived local area studying in local colleges and universities with whom we hold relations. Our method is to provide initial training and inductions to suitable internees before assigning them to live projects, where they are monitored, supported, challenged, and encouraged by experienced senior consultants and developers. As an organisation that values fresh and radical ideas to find new products and solutions to solve existing problems, internees are also encouraged to share their thoughts and ideas in a stimulating and collaborative environment, and often asked to implement, test and deploy them into real world projects. Regular development reviews are held with internees and progress objectives adapted accordingly. Internees, as is the case with all staff, receive regular training in the latest technologies which may cover Cloud Technologies (staff are trained to be Amazon Web Service Engineers and Architects), data processing tools, database management, project management, security. In most cases internees become full time employees at Millersoft once they graduate and are already well equipped to take on more responsibility and autonomy within the company.

Pricing

Price: £700 a unit a day
Discount for educational organisations: No
Free trial available: No

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

Grafana

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents