IDOX SOFTWARE LTD

Geospatial Platform as a Service

Our Geospatial Platforms as a Service (PaaS), theMapCloud, provides a cost-effective way to manage and serve geographic data, services and applications. Hosted on AWS, our platform provides a secure, scalable, highly performant spatial data infrastructure. We manage the platform, the application-ready geospatial datasets suite and component services (WFS, WMS, WMTS).

Features

• Fully managed cloud geospatial platform service
• Globally leading geospatial technologies
• Flexible, reliable, scalable, highly-performant platform
• Built in security
• 24/7 availability with full backup and disaster recovery
• Instant access to extensive catalogue of existing geospatial data
• Provisioning of OGC compliant web services
• Cloud hosted on enterprise infrastructure from AWS

Benefits

• Cost effective - no need to invest in expensive infrastructure
• Reduced costs - no need to manage Cloud GIS infrastructure
• Future proofed – access to state-of-the-art cloud GIS infrastructure
• Time savings - rapid service provisioning and speed to market
• Guaranteed service quality standards
• Data security and resilience are taken care of.
• Robust development environment for custom solutions
• On demand, dynamic scaling - proven, high-performance platform
• Backed by a dedicated Service Desk

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@idoxgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

696774989783814

Contact

Jen.roberts@idoxgroup.com
0333 011 1200
bidteam@idoxgroup.com

About your service

• Service categories:

  Application Development and Deployment

  Data management

  Data integration and intelligence

  • Data Access Infrastructure Software
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Planned maintenance will be undertaken without disruption to live services. However, in the unlikely event that maintenance may affect live services, a maintenance period will be scheduled and communicated to customers in advance. Users' internet speed/reliability may impact service performance.
• System requirements: Ability to consume standards-compliant HTTPS data feeds / REST APIs

User support

• Email or online ticketing support: Yes
• Support response times: We provide a managed Service Desk available from 08:30 to 17:30 Monday to Friday with the exception of Christmas Day, Boxing Day and New Year’s Day public holidays. Our target response time is in within 1 hour during these times. A case number and a priority will be allocated to the call by a member of our Service Desk and a target resolution date will be set according to call priority, as detailed in our Service Level Agreement.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Standard Service Support Levels; Priority - Nature of query / Target response time / Target resolution time:; 1 - Urgent and major fault on the system affecting all users including system unavailability with no workaround / 1 hour / 4 hours.; 2 - Significant and/or non-urgent fault affecting many users e.g. specific functionality or data / 1 hour / 3 business days.; 3 - Minor fault with no significant impact on usage and/or request for support relating to functionality of a supported application / 1 hour / 5 business days.; 4 - Minor/cosmetic issue with workaround available or Request for support on longer term issue. / 1 hour / 10 business days.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Upon receipt of an order an assessment of platform configuration requirements, data volumes and expected level of usage is defined in collaboration with the customer, forming a data migration and platform configuration plan. We ensure migration of customer applications and data onto theMapCloud is as easy and straightforward as possible. This typically involves either uploading the data via the internet or the use of high capacity hard drives, depending on the individual requirements.
• Service documentation: Yes
• Documentation formats: Other
• Other documentation formats: MS Office Documents
• End-of-contract data extraction: Off-boarding from the service is achieved via a formal Service Desk cancellation process. This ensures any relevant user information is removed from the service and all user data is deleted. Account termination is conducted in line with the published terms and conditions of the service, and data destruction certificates are available upon request.
• End-of-contract process: An offboarding plan will be defined in colaboration with the customer. We will arrange for customer access to the services to be removed upon contract expiry. All customer data is removed from the platform and can be provided back to the customer, at an agreed charge, as part of the offboarding process if required. A data destruction certificate is available upon request.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: The overall onboarding and offboarding process is described in the Service Definition. Upon receiving an order we will contact the customer directly via email and where necessary set up an online meeting to discuss their onboarding requirements. Similarly we would confirm with a customer via email the offboarding arrangements prior to the end date of their contract.

Using the service

• Web browser interface: No
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Any differences will be dependent on the type of application or service being developed and provisioned on the platform.
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: The service interface will be dependent on the type of application being developed and provisioned on the platform.
• Accessibility standards: None or don’t know
• Description of accessibility: The accessibility standards will be dependent on the requirements of the application being developed and provisioned on the platform.
• Accessibility testing: N/A
• API: Yes
• What users can and can't do using the API: The API offers a read-only HTTPS standards compliant access to digital mapping and geospatial data. Custom APIs can also be developed for customers as an additional service. Customer access is setup by Idox and no changes can be made by the customer via the API.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: The service is designed to host and serve customer data via data services, and custom web applications. Any web applications hosted on theMapCloud can be designed based on customer requirements.

Scaling

• Independence of resources: TheMapCloud data services are architected to scale on demand based upon certain thresholds such as CPU and memory usage. This means no adverse effect on performance regardless of service demand.

Analytics

• Service usage metrics: Yes
• Metrics types: Service management reports are provided detail map transactions and data storage. We report on a range of KPIs as set out in our SLA including system availability, OS and third party data management, system performance, service desk performance etc.
• Reporting types: Regular reports
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest: Physical access control, complying with CSA CCM v4.0
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Customer data will typically be available via OGC-compliant web services (WMTS, WMS, WFS etc.). Export tools for a range of formats can be made available in a hosted web application or API, if required by the customer.
• Data export formats: Other
• Other data export formats: Export tools for a range of formats
• Data import formats: Other
• Other data import formats: Upload tools for a range of formats

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: Other
• Other protection within supplier network: Hosting infrastructure provided by Amazon Web Services (AWS) provides security groups which are applied to all servers in the network.

Availability and resilience

• Guaranteed availability: Testing indicates availability of 99.9%. theMapCloud platform is a highly available, scalable platform hosted on AWS 24/7.
• Approach to resilience: TheMapCloud platform is architectured upon Amazon Web Services employing the Multi-Zone capability, meaning we have resilience fail-over to another physical data centre location if required.
• Outage reporting: Online 24/7 real-time monitoring systems instantly notify Idox staff in the unlikely event of unforeseen downtime. Any downtime is then communicated to customers via email.

Identity and authentication

• User authentication needed: Yes
• User authentication: Username or password
• Access restrictions in management interfaces and support channels: Any internal management functions are not shared with customer users and restricted to internal use via user credentials. Access to our support desk is restricted via username and password.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: All divisions of Idox follow the ISO27001 accredited Information Security Management System of Idox Software Ltd.; This ISMS covers all business functions including but not limited to, information systems, networks, physical environment, incident/threat management, project & contract management and personnel management. Information security awareness training is conducted to ensure policies are communicated and ongoing annual internal reviews and auditing is conducted to ensure processes are followed. The system and controls are also externally verified an certified annually as part of the ISO 27001 certification process. Risks raised through internal and external audits are reviewed at management meetings by the information security manager, the appropriate head of business and a board representative.
• Software Security Code of Practice: No

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: IT change management processes are carried out using Change Requests and records are maintained within the Change Management system. All concerned parties are informed of the status of the request as changes or progress is made as applicable.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: We monitor OWASP and various vendor alert sources for emerging vulnerability intelligence and patching data. A combination of web application scanning, host vulnerability scanning, and external perimeter proactively identifies any design, configuration, or patching weaknesses. When identified, any threats are assessed in context and where warranted, mitigations are implemented in accordance with their severity. These controls and processes are monitored as part of our ongoing ISMS/ISO27001 auditing programme.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Monitoring tools are used to measure server performance metrics as well as storage and network/bandwidth utilisation and unusual server/network/perimeter activity. The alerts from these systems are actively monitored and reviewed and any potential intrusion attempt is raised in line with our security incident reporting procedure for further investigation.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Incidents or suspected incidents are raised to internal service desk and reviewed by the information security manager. They are allocated a risk reference, entered into the information security risk log and tracked until closure. In the case of major incidents, an Incident Response Team will be formed as required with key personal required to investigate and take necessary actions, and a major incident report will be produced.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Citation ISO Certification Limited
• ISO/IEC 27001 accreditation date: Monday 27 May 2024
• What the ISO/IEC 27001 doesn’t cover: Our ISMS is certified and tested to ISO27001 standards annually and covers our entire organisation.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Citation ISO Certification Limited
• ISO 9001 accreditation date: Thursday 11 April 2024
• What the ISO 9001 doesn’t cover: Our ISMS is certified and tested to ISO9001standards annually and covers our entire organisation.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 5c6de739-c45d-4eee-916a-013a0c2ce8f7
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 26018f8f-da19-4856-8fd2-b719e0c21047
• Other security certifications: Yes
• Any other security certifications: ISO 22301

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@idoxgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.