MIRRORMAZE COMMUNICATIONS LTD

Skylight

Skylight delivers secure, unattributable internet access via zero-install, cloud-hosted Virtual Desktops. Our browser-based secure environment isolates threats remotely, eliminating local software risks. Features include False Online Persona management using customisable digital footprints. Automated video recording provides immutable audit trails, ensuring superior operational security and evidentiary compliance.

Features

• Untraceable attribution via unattributable proxies in over 127 countries.
• Unlimited Virtual Desktops created using Cloud Automation from trusted templates.
• Client-managed encryption keys guarantee zero-knowledge access.
• Simultaneous multi-user collaboration within a single environment.
• Immutable, automated video recording of every session for compliance.
• Simultaneous control of multiple False Online Personas from one dashboard.
• Clientless, browser-based access requires no software installation or config.
• Fully UK-based service desk with cleared staff.
• Eliminates need for dedicated "dirty internet lines" and separate laptops.
• Install own Operating System and tools in your Skylight environment

Benefits

• Prolong the life of online profiles
• Capture online chat messages and content set to disappear
• Customise every aspect of users' digital footprint
• Accessible via any browser
• Remote Access
• Safely dispose of compromised devices
• Securely import high risk files from the internet
• One dashboard for simultaneous use of multiple online profiles
• Emulate real-world social-media use across multiple devices
• Compliant with legal requirements

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at jacques.delaporte@mirrormaze.io. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

703593503583578

Contact

Jacques de la Porte
07739155589
jacques.delaporte@mirrormaze.io

About your service

• Service categories:

  Applications

  Content workflow and management

  • EDiscovery and forensics
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
• Service constraints: None - multi-cloud hosting with full support
• System requirements:
  • Reliable internet connection (10Mbps minimum)
  • HTML5 enabled browser

User support

• Email or online ticketing support: Yes
• Support response times: Email support is available within normal business hours (Monday to Friday 09:00-17:00). Emails and tickets are responded to within 1 working hour. Out of hours support is available at additional cost.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Standard support is included in the contract and provided within normal business hours (Monday - Friday, 9-5, excluding UK Public Holidays).; ; Out of office hours support can be provided at additional cost.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We provide onboarding documentation with the option for remote or onsite onboarding training.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: Users have access to their data throughout their use of Skylight. If at the end of a contract the user requires a bulk extract of all data, an authenticated link to their bulk extract can be provided to the user.
• End-of-contract process: At the end of the contract access to Skylight is terminated through the disabling of accounts. User accounts, data and audit logs are securely deleted after 30 days. More detail can be provided on request.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: The documentation is available via the application

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: Skylight provides a RESTful API allowing integration with existing Case Management Systems (CMS) and Security Information and Event Management (SIEM) tools. The API supports automated retrieval of audit logs, user activity data, and evidential recordings, as well as programmatic management of user permissions and environment provisioning
• Accessibility standards: None or don’t know
• Description of accessibility: We are committed to ensuring our platform is accessible to all users and are currently working towards full compliance with the Web Content Accessibility Guidelines (WCAG) 2.1 AA standard. To support users in the interim, we offer assisted support via email and telephone to help users navigate any inaccessible parts of the service.
• Accessibility testing: While we have not yet completed formal approved assistive technology testing, accessibility and inclusive design are important priorities for our organisation.; ; Our solutions are developed in line with recognised accessibility standards and good practice, and we actively consider the needs of users who rely on assistive technologies during design and delivery.; ; We recognise the value of structured assistive technology testing in improving usability and inclusivity, and we are committed to progressing this as part of our ongoing accessibility improvement programme. We remain open to working with clients and accessibility specialists to ensure our services meet the needs of all users.
• API: Yes
• What users can and can't do using the API: Skylight provides a RESTful API allowing integration with existing Case Management Systems (CMS) and Security Information and Event Management (SIEM) tools. The API supports automated retrieval of audit logs, user activity data, and evidential recordings, as well as programmatic management of user permissions and environment provisioning
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Skylight offers granular customisation of digital footprints, allowing users to define specific operating system configurations, browser settings / extensions, and device types to match operational requirements. Customers can also integrate their own operating system images, install their own tools and configure bespoke Exit Nodes anywhere in the world.

Scaling

• Independence of resources: Resource demands are managed automatically by the backend infrastructure of Skylight. Customers can request dedicated environments thus guaranteeing a 100% access to resources.

Analytics

• Service usage metrics: Yes
• Metrics types: We provide comprehensive usage telemetry to ensure total transparency in billing and resource allocation. Through a dedicated management dashboard, administrators can monitor real-time consumption metrics, including total query volumes, API call frequency, and active user sessions. These metrics are granular, allowing for departmental "chargeback" reporting by tracking usage across specific teams or investigative units. By surfacing these telemetry data points, we enable organisations to optimise their subscription tiers, prevent unauthorised overages, and maintain a clear audit trail of platform engagement, ensuring the service remains cost-effective and aligned with internal budgetary controls.
• Reporting types: Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Skylight offers a range of data that can be exported. Case Management and auditing data can be exported via a Reporting function or the API. High risk files downloaded from the internet via Skylight can be exported safely and securely via Skylight's File Transfer. A technical overview of this feature is available on request.
• Data export formats:
  • CSV
  • ODF
  • Other
• Other data export formats:
  • PDF
  • Various (for files downloaded from the itenrent)
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
• Other protection between networks: We secure data moving between the user’s browser and our platform using TLS 1.2+ encryption following NCSC guidelines, ensuring all traffic over the public internet or PSN/LECN is protected from interception. Skylight uses CloudFlare to inspect incoming traffic and mitigate DDoS or injection attacks. By employing a 'Zero-Footprint' browser model, we ensure no sensitive data is stored unintentionally on the client-side device. All data is transmitted via encrypted HTTPS endpoints, maintaining a secure link between the customer's protected network and our service
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
• Other protection within supplier network: Within our infrastructure, data is protected through AES-256 encryption at rest and strict logical separation. Although a multi-tenant SaaS, we use VPC isolation and micro-segmentation to ensure that one customer’s data and audit logs can never be accessed by another.; ; Administrative access to our internal production environment is governed by Just-In-Time (JIT) permissions and Multi-Factor Authentication (MFA).

Availability and resilience

• Guaranteed availability: The guaranteed level of availability is 99.5% this does not include planned maintenance windows or local internet bandwidth issues users may experience such as download speeds dropping below below the minimum requirement.; ; SLA's can be found in the service definition document.
• Approach to resilience: Our service employs a highly resilient, cloud-native architecture designed for 99.9% availability. By utilizing multiple Availability Zones (AZs) within the UK, we ensure that a single data centre failure does not interrupt service.; ; As a browser-accessed application, resilience is further enhanced through stateless session management; if a user's local connection drops, their investigative progress is preserved server-side, allowing instant resumption upon reconnection. We perform automated daily backups with off-site replication to ensure data integrity. Our Disaster Recovery (DR) plan is tested annually, targeting a 4-hour Recovery Time Objective (RTO) to maintain mission-critical OSINT operations.
• Outage reporting: We maintain a proactive incident notification framework to ensure users are informed of service status in real-time. In the event of a service degradation or unplanned outage, automated email alerts are dispatched to designated technical leads and administrators within 30 minutes of detection.; ; These alerts provide a clear description of the issue, the impact on OSINT modules, and an estimated Recovery Time Objective (RTO). Follow-up communications are issued at regular intervals until full service restoration. Post-incident reports are also provided via email, detailing the root cause and the preventative measures implemented to ensure long-term resilience.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Username or password
  • Other
• Other user authentication: Our platform utilizes a robust identity framework supporting Single Sign-On (SSO) via SAML 2.0 and OpenID Connect (OIDC). This allows seamless integration with existing government and corporate identity providers (e.g., Azure AD, Okta).; ; For deployments without SSO, we enforce Multi-Factor Authentication (MFA) via TOTP or SMS as a mandatory security baseline. Access is governed by Role-Based Access Control (RBAC), ensuring users only access modules aligned with their specific mission remit. All authentication attempts are logged with full telemetry—including IP address and device fingerprint—providing a comprehensive audit trail for internal security governance.
• Access restrictions in management interfaces and support channels: Our internal management interfaces are strictly isolated from the public internet and protected by a 'Zero Trust' architecture. Administrative access requires a combination of biometric MFA and connection via a secure, encrypted VPN or "Jump Server" with IP-whitelisting. We enforce the Principle of Least Privilege; our engineers use time-bounded, just-in-time (JIT) access that expires automatically. All administrative actions are recorded in immutable audit logs. This ensures that only authorised personnel can perform configuration changes, and no single person can alter the production environment without oversight.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Dedicated link (for example VPN)
  • Username or password
  • Other
• Description of management access authentication: Administrative access to our production environment is strictly controlled via a "Zero Trust" framework, isolated from the public internet. Authentication requires Multi-Factor Authentication (MFA)—specifically hardware-backed tokens (FIDO2) or phishing-resistant authenticator apps—combined with a secure VPN or Jump Server restricted by IP-whitelisting.; ; We employ Just-In-Time (JIT) elevation, ensuring staff only possess administrative privileges for the duration of a specific task. Every administrative session is tied to a unique identity with all actions recorded in immutable audit logs. This ensures a "Least Privilege" model where no permanent, high-privileged "super-user" accounts exist.

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: CSA CSM version 4.0
• Information security policies and processes: Our security framework is built on ISO 27001 principles and the NCSC Cloud Security Principles, governed by an Internal Security Board that conducts quarterly policy reviews. We maintain a comprehensive suite of "living" documents, including an Information Security Management System (ISMS), Incident Response Plan, and Data Protection Policy. All employees undergo mandatory, annual security awareness training. Some are cleared to DV. Our processes include regular vulnerability scanning, annual independent CREST-approved penetration testing, and a strict "Security by Design" approach to all development. This ensures a proactive, risk-based culture that protects sensitive investigative data at every layer.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Our change management follows a rigorous CI/CD pipeline aligned with ITIL 4 standards. All code changes are subject to mandatory Peer Review and automated Static Analysis (SAST) before merging. We utilize an automated 'build-test-deploy' workflow where updates must pass a comprehensive suite of unit, integration, and security tests in a mirrored Staging environment prior to production.; ; Production deployments require formal authorization and are executed as 'Blue-Green' or 'Canary' releases to ensure zero-downtime and instant roll-back capability. Every change is logged with a unique ID, providing a full audit trail from developer commit to live deployment
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Our proactive vulnerability management aligns with NCSC best-practice timescales. We aggregate threat intelligence from NCSC feeds, vendor bulletins, and internal CTI. Continuous automated scanning covers all environments, including third-party libraries (SCA).; ; We operate an 'Update by Default' policy: 'Critical' and 'High' vulnerabilities in internet-facing services are mitigated or patched within 5 working days of release, exceeding Cyber Essentials Plus requirements. 'Important' patches are deployed within 7 days, and all others within 14 days. All patches undergo automated regression testing in Staging before production deployment, ensuring security without compromising the resilience of mission-critical investigative workflows
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Our platform employs a proactive, 24/7 protective monitoring strategy aligned with NCSC Cloud Security Principle 11. We utilise a range of security tooling offered within AWS, including, but not limited to, Guard Duty and Cloud Trail via the AWS Security Hub to aggregate and correlate real-time telemetry from Firewalls, IDS/IPS, WAF, and OS-level logs. CloudFlare provides additional protective monitoring.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Skylight employs an ITIL 4-aligned Incident Management practice to restore normal service operation swiftly. ; Our lifecycle includes:; Identification & Logging: Automated monitoring (SIEM) and a 24/7 service desk capture incidents.; Categorisation & Prioritisation: Triaged by impact/urgency to meet agreed SLAs.; Investigation: Technical teams apply playbooks to isolate and remediate issues, focusing on maintaining non-attributable egress integrity.; Communication: Regular stakeholder updates via a dedicated status portal.; Resolution & Closure: Verified recovery before formal closure.; Continual Improvement: Post-Incident Reviews (PIR) drive root-cause analysis and service hardening, ensuring mission-critical OPSEC remains uncompromised.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: We offer a free trial for 14 days of up to 5 accounts.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 20%
• Between £500,001 and £1,000,000: 25%
• Between £1,000,001 and £2,500,000: 30%
• Between £2,500,001 and £5,000,000: 35%
• Over £5,000,001: 40%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 6a779534-5700-4cb6-b7d0-87e603550834
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain
    • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
    • Advertising of supply chain opportunities openly and to ensure they are accessible to a diverse range of businesses, including advertising all subcontracting opportunities on Contracts Finder
    • Structuring of the supply chain selection process to ensure fairness (e.g. anti-corruption) and encourages participation by a diverse range of businesses, including with regard to new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutual
    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of issues relating to entering the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at jacques.delaporte@mirrormaze.io. Tell them what format you need. It will help if you say what assistive technology you use.