Node4

Virtual Data Centre (VDC)

Node4's Virtual Data Centre (VDC) offers a robust Infrastructure as a Service (IaaS) platform, combining automated, secure, and scalable cloud technology with expert, 24x7 managed services. Operating from UK-based data centres, it adheres to stringent ISO standards and integrates comprehensive data protection, including DDoS, encryption, backup and replication.

Features

• Advanced IaaS platform, leveraging latest cloud technology for superior performance
• Fully managed, 24x7 support from accredited service team ensures reliability
• Hosted in UK data centres, complying with ISO 27001 standards
• Integrated DDoS protection, firewalling, and secure instances
• Standard encryption of data at rest and ransomware-protected backups
• Offers Public Cloud cost efficiencies without hidden or unpredictable charges
• Includes free Internet bandwidth, network services, and sensible pricing models
• Powered by standard virtualisation, high-performance SSD storage, and computing
• Self-service options for backup and disaster recovery across UK locations
• Managed services for patching, monitoring, security, and operational support included

Benefits

• Enhanced security and compliance with industry-leading ISO information security standards
• Continuous protection against cyber threats with built-in DDoS mitigation strategies
• Reduced operational costs with inclusive network services and internet bandwidth
• Streamlined budget management through predictable pricing and no hidden costs
• Scalable resources tailored to meet dynamic organisational infrastructure needs
• 24x7 expert support minimises downtime, enhancing service reliability and continuity
• Advanced encryption and immutable storage safeguard critical data effectively
• Simplified disaster recovery with integrated, easy-to-manage backup solutions
• Hassle-free maintenance with comprehensive managed services, reducing internal workload
• Expert database management, ensuring optimal performance and reduced support overhead

£0.03 to £1,388.89 a unit a month

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidmanagement@node4.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

803625095897559

Contact

David Cheetham
0345 123 2222
bidmanagement@node4.co.uk

Service scope

• Service constraints: Customer may not and is not licensed to install or use software or technology in any way that infringes any Third-Party Software Vendor’s intellectual property, technology or licencing usage rights. ; Where the relevant software License prescribes, Third Party Software Vendors (or their agents) may have a right to conduct audits on the deployment/usage of their software in the Services.; Node4 will endeavour to perform essential maintenance during periods of lower usage and will endeavour to give the Customer ten days prior notice. In the event of an emergency, change or Service Affecting Incident notice may be less than 24 hours.
• System requirements:
  • Customers using own licenses are responsible for ensuring mobility rights
  • Connectivity Requirements and Firewalling (if not supplied by Node4)
  • Patching & Update maintenance of OS (if not by Node4)

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Node4 shall prioritise all Service Tickets based on its reasonable assessment of the Priority level (P1 to P4); and respond to all Service Tickets in accordance with the initial response times specified below: ; Response Acknowledgement - P1=30 Mins, P2=1 Hour, P3=2 Hours, P4=4 Hours; Commencement – P1=1 Hour, P2=2 Hours, P3=4 Hours, P4=N/A; Frequency of Updates – P1=1 Hour, P2=2 Hours, P3 and P4 =12 Hours if Resolve / Target to Fix exceeded; Resolve / Target to Fix – P1=4 Hours, P2=8 Hours, P3=12 Hours, P4=36 Hours.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.1 AA or EN 301 549
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Web chat
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.1 AA or EN 301 549
• Web chat accessibility testing: Standard testing with accessibility software.
• Onsite support: Yes, at extra cost
• Support levels: Support level options are as follows: -; Business Hours; Standard business hours support 9am to 5:30pm weekdays, excluding bank and national holidays; 24 x 7; Priority 1 and 2 – Support hours 24/7 ; Priority 3, 4 and Service Request – Support hours between 9am and 5.30pm weekdays, excluding bank and national holidays.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Users are provided with quick start guide(s) delivering detailed instructions for configuring and administering elements for the service. ; In addition, there is a range of VDC Concierge services that provide guided interactive sections from a 1 hour basic introduction through to 12 Hours of consulting time with additional blocks of 4 hours available on request. ; The 1 Hour basic concierge session is Free of Charge to new VDC clients. ; A third option is the VDC Landing Zone which provides a foundational build of the Virtual Data Centre to get customers up and running quickly. Following an initial architecture workshop, Node4 will build and configure all the supporting services required, including Virtual Machines, Databases, Networking, Disaster Recovery, Backup and Security Guardrails.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: Node4 provides the Customer with the ability to retrieve data held on the Node4 systems via electronic transfer or provide a hard copy of data on to a device provided by the Customer.
• End-of-contract process: Virtual Data Centre is a consumption billed service invoiced on a monthly in arrears basis not a contract. ; Users simply shutdown and delete resources including data repositories to end their utilisation of the service. Users may choose to delete their entire VDC tenancy when no further use at any future time is anticipated.; Only outstanding usage during the month will be billed.

Using the service

• Web browser interface: Yes
• Using the web interface: Virtual Data Centre (VDC) is a fully self-service delivery model. The Web portal allows users to: -; ; Create and Manage Virtual Data Centres (OrgVDC); Create and Manage Virtual Firewalls (Edge Gateways); Create and Manage Virtual Networks (OrgVDC Networks); Create and Manage Virtual Applications (vApps); Create and Manage Virtual Machines (VMs); Create and Manage Backups; Create and Manage Disaster Recovery (Replication Service); Perform User Management; Users cannot access the underlying virtualisation platforms nor the underlying network infrastructure.
• Web interface accessibility standard: WCAG 2.1 AA or EN 301 549
• Web interface accessibility testing: Standard testing with accessibility software.
• API: Yes
• What users can and can't do using the API: The API for our VMware Cloud Director-based Virtual Data Centre service offers extensive functionality, enabling users to automate and manage various aspects of their virtual data centers effectively. Key capabilities include:; Deployment and Management: Users can automate the deployment of virtual machines (VMs), vApps, and independent disks. They can also manage network configurations and storage profiles, ensuring a flexible and dynamic environment.; ; Resource Monitoring and Optimization: The API provides tools for monitoring and reporting on VM performance, resource usage, and operational health. This enables users to optimize their VDC resources efficiently.; ; User and Role Management: Administrators can manage user accounts, roles, and permissions, ensuring secure access control within the VDC environment.; ; Customization and Integration: The API allows for the integration of third-party tools and the customization of VDC services to meet specific organizational requirements.; In terms of what cannot be done via the API;; Limited Direct Hardware Control: While the API provides robust control over virtualized environments, it does not offer direct control over the underlying physical hardware.; Dependency on VMware Cloud Director Versions: Certain API functionalities are dependent on the version of VMware Cloud Director being used, which might limit access to newer features until an upgrade is performed.
• API automation tools:
  • Ansible
  • Chef
  • SaltStack
  • Terraform
  • Puppet
  • Other
• Other API automation tools: Powershell/PowerCLI
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• Command line interface: No

Scaling

• Scaling available: Yes
• Scaling type: Automatic
• Independence of resources: Resource management tools are used at the Hypervisor layer which deploy learning and predictive analysis features. These tools constantly optimise the shared cloud environments to avoid resource bottlenecks.; ; Virtual Data Centre (VDC) is architected such that there are clear barriers between groups of customers. This segregation further reduces the risk of an issue on any single node or cluster of nodes affecting an individual customer.
• Usage notifications: Yes
• Usage reporting: Email

Analytics

• Infrastructure or application metrics: Yes
• Metrics types:
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

• Backup and recovery: Yes
• What’s backed up:
  • Virtual Machines with the VDC environment
  • Virtual Disk within the VDC environment
  • Application Aware Backups (SQL)
• Backup controls: Users control backups through a web interface enabling the option to select the backup service for virtual machines
• Datacentre setup: Multiple datacentres with disaster recovery
• Scheduling backups: Supplier controls the whole backup schedule
• Backup recovery:
  • Users can recover backups themselves, for example through a web interface
  • Users contact the support team

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • Other
• Other protection between networks: If client requires secure (encrypted) networking facilities, Node4 has a number of security and networking services that can meet client specific requirements.
• Data protection within supplier network: Other
• Other protection within supplier network: Node4 can, however, provide customer specific solutions which use IPSec encryption through encrypted MPLS (Cisco DMVPN for example) or SD WAN type services.

Availability and resilience

• Guaranteed availability: The component is considered available if all Hypervisor hosts hosting the Customer Virtual Machines are operating in a normal state.; ; If a Hypervisor node fails, and the Virtual Machines are migrated to another node, then downtime shall be considered as the time between a) the time the Hypervisor node is detected as no longer functioning and b) the time the Virtual Machines start to power on another host. ; Availability levels apply to the Hypervisor platform and are not measured per virtual machine.; The following equation will be used to calculate the Compute Resource (Shared) availability. ; References to hours are to the number of hours in the applicable Monthly Review Period:; ((Total minutes – Total minutes Unavailable)/Total minutes) x 100; ; Node4 will provide the Customer with service credits, as set out in the T&C's.
• Approach to resilience: Platform is based on industry standard reference architecture; Node4 operate fully resilient Datacentres, core DWDM network and our Cloud platforms use our own buildings and assets.; ; Detail on how we do this is sensitive and therefore information is only available on request.
• Outage reporting: Node4 may raise faults against alarms on the Node4 infrastructure affecting the Virtual Data Centre service. If a fault affects your services then we will use reasonable endeavours to promptly inform the named contact(s) via our helpdesk system primarily, or by telephone in circumstances where the fault means that that they would not receive email. ; The start time of a fault is the time it is detected by Node4 and a Service Ticket number is allocated. For services affecting multiple customers we will post updates on www.n4status.com

Identity and authentication

• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Access is only granted to those that require access. Access can only be provided by those with the correct permission to authenticate. Management networks are isolated.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Devices users manage the service through:
  • Dedicated device on a segregated network (providers own provision)
  • Dedicated device on a government network (for example PSN)
  • Dedicated device over multiple services or networks
  • Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: Between 1 month and 6 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Alcumus ISOQAR
• ISO/IEC 27001 accreditation date: 29/03/2022
• What the ISO/IEC 27001 doesn’t cover: All aspects are covered.
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: ClaraNet Ltd
• PCI DSS accreditation date: 12/08/2023
• What the PCI DSS doesn’t cover: PCI controls 2d, 2e, 3, 4, 5, 6, 7, 8, 10, 11
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Node4 operates an Information Security Management System (ISMS) which conforms to ISO27001. The purpose of the ISMS is to assess and manage risk and to protect the organisation’s information assets from all threats, whether internal or external, deliberate or accidental. The CEO has approved the information security policy. The Information Security Objectives of Node4 are to: -; ; Protect information against unauthorised access; ; Assure the confidentiality of information; ; Maintain the integrity of the information; ; Ensure the availability of information as required by the business processes; ; Meet all regulatory and legislative requirements; ; Implement, maintain and test DR / BC plans in line with the security policy; Train all staff on information security; ; Continually review and improve the ISMS; ; Additional policies and procedures exist to support the Information Security Policy. These include, but are not limited to, physical and logical access controls, network security, malware controls, vulnerability management and business continuity.

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: All changes are assessed for their potential security impact through the Change Advisory Board. A Low-Risk change is one which has a possibility of causing up to a Priority 3 or 4 Incident. A High-Risk change is one which has a possibility of causing a Priority 1 or 2 Incident or a large amount of Priority 3 and 4 Incidents for multiple customers.
• Vulnerability management type: Undisclosed
• Vulnerability management approach: Vulnerability testing is performed monthly using internal and external tool sets. Vulnerabilities are assessed and remediation actions performed depending on risk. Information about potential threats is provided by the vulnerability scanning tools.
• Protective monitoring type: Undisclosed
• Protective monitoring approach: Protective monitoring is performed by the SIEM tool and monitored by the Security Operations Centre. The SIEM provides realtime alerts of any potential compromises and a process of detect, analyse and response is followed with 1 hour.
• Incident management type: Undisclosed
• Incident management approach: The following approach in used for incident management to ensure the objectives are achieved ; ; Incident Resolution is achieved in the most effective manner ; ; All Incidents are identified promptly and correctly; ; All Incidents are evaluated, categorised, and prioritised correctly; ; Communication is maintained with all Stakeholders throughout the lifecycle of all Incidents; ; All Incidents are constantly monitored throughout their lifecycle; Incidents are handled as outlined in the Incident Management Schedule Document here: - ; https://node4.co.uk/app/uploads/2022/07/Schedule-Incident-Management-07.04.2021-release.pdf

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
• Who implements virtualisation: Supplier
• Virtualisation technologies used: VMware
• How shared infrastructure is kept separate: Compute separation is provided by a hypervisor. ; Network and storage virtualisation techniques are also employed.; We operate a software defined Cisco ACI network which standardises the deployment of secure networks for our customers

Energy efficiency

• Energy-efficient datacentres: No

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Covid-19 recovery
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  In our commitment to fighting climate change, we take a holistic approach that encompasses reducing carbon emissions, enhancing energy efficiency, and promoting sustainable practices in the delivery of our cloud hosting and software services. Our strategies include:; Energy Efficiency: We optimise our datacentres and cloud infrastructure to be as energy-efficient as possible, employing the latest in green technology and design principles. This reduces our overall energy consumption and minimises our carbon footprint.; Renewable Energy: Where feasible, we power our operations with renewable energy sources, such as solar and wind, to reduce reliance on fossil fuels. This commitment extends to encouraging our suppliers and partners to also adopt renewable energy.; Carbon Offsetting: We invest in carbon offset projects, including reforestation and renewable energy projects, to compensate for our unavoidable emissions. These efforts contribute to global carbon reduction initiatives.; Sustainable Practices: We advocate for and implement sustainable practices within our organisation, including reducing waste, promoting recycling, and encouraging the digitalisation of processes to minimise paper use.; Client Engagement: We work with our clients to understand and minimise the environmental impact of their cloud and software service choices. This includes offering guidance on how to use cloud resources more efficiently and sustainably.; Innovation: We continuously explore innovative ways to reduce the environmental impact of our services, including the development of more energy-efficient software and the utilisation of AI to optimise resource usage.; Our aim is to lead by example in the fight against climate change, demonstrating that it is possible to deliver high-quality cloud services while also making a positive impact on the environment. Through these actions, we not only contribute to the sustainability of our planet but also offer our clients the opportunity to engage with a provider that aligns with their values on environmental responsibility.

  Covid-19 recovery

  In our efforts to support COVID-19 recovery, we're committed to leveraging our cloud hosting and software services to aid businesses, communities, and public sector organisations in navigating the challenges posed by the pandemic and its aftermath. Our strategies include:; Remote Work Solutions: We provide robust cloud solutions that enable seamless remote work, ensuring that organisations can continue their operations without interruption. This includes secure access to critical applications, collaboration tools, and data storage solutions, facilitating productivity and connectivity among dispersed teams.; Digital Transformation Acceleration: Recognising the increased need for digital services, we assist organisations in accelerating their digital transformation journeys. This involves migrating traditional services to the cloud, enabling them to offer their own customers more flexible and resilient services.; Educational Support: To address the surge in demand for online learning, we offer cloud-based learning platforms and tools that educational institutions can leverage to deliver high-quality education remotely. This includes solutions for virtual classrooms, online assessments, and resource sharing.; Healthcare Support: We support healthcare providers by offering cloud solutions that enhance their ability to deliver telehealth services, manage patient data securely, and scale their resources in response to fluctuating demands.; Economic Resilience: We're committed to supporting economic resilience by offering flexible pricing models and financial assistance programs for businesses affected by the pandemic, helping them to maintain their cloud services without financial strain.; Community Engagement: We engage with communities and non-profit organisations, providing technology resources and expertise to support recovery efforts, including initiatives aimed at bridging the digital divide and supporting vulnerable populations.; Our goal is to be a proactive partner in COVID-19 recovery, providing technology solutions that not only help organisations adapt to the new normal but also contribute to building a more resilient and inclusive future.

  Tackling economic inequality

  In addressing economic inequality, we are committed to leveraging our cloud hosting and software services as tools for empowerment and opportunity creation. Our approach is centered on making technology accessible and beneficial for all segments of society, particularly those who are most vulnerable or have been traditionally underserved. Here’s how we contribute:; Accessibility and Affordability: We strive to ensure our services are accessible and affordable, offering scalable solutions that cater to the needs of small and medium-sized enterprises (SMEs), non-profits, and educational institutions. This includes flexible pricing models for qualifying organisations, enabling them to leverage technology to drive their missions forward.; Skills Development and Training: Recognising the importance of digital literacy in the modern economy, we offer training programs and resources aimed at developing the digital skills of individuals from disadvantaged backgrounds. By partnering with educational institutions and community organisations, we aim to close the skills gap and open up new opportunities for employment and entrepreneurship in the tech industry.; Supporting Social Enterprises: We actively support social enterprises and organisations working to tackle economic inequality through preferential access to our cloud and software services. This support extends to collaboration on projects that leverage technology to address social issues, such as unemployment, education, and access to healthcare.; Innovation for Inclusion: We invest in developing innovative solutions that address barriers to economic participation. This includes technologies that enhance financial inclusion, support remote work and education, and enable access to essential services for underserved populations.; Economic Opportunity Creation: Through our ecosystem of partners, customers, and suppliers, we seek to create economic opportunities by prioritising diversity and inclusion in our procurement processes and by fostering an environment where small and diverse businesses can thrive.

  Equal opportunity

  Our dedication to promoting equal opportunity is woven into the fabric of our operations, services, and community engagements. We believe that technology has the power to level the playing field, providing access to information, resources, and opportunities that can transform lives regardless of background, location, or circumstance. Here’s our approach:; Diverse and Inclusive Hiring Practices: We are committed to fostering a diverse and inclusive workforce by implementing fair hiring practices that actively seek out and welcome candidates from a variety of backgrounds, including underrepresented groups. This diversity enriches our team with a wide range of perspectives and ideas, driving innovation and understanding of the diverse needs of our clients.; Workplace Equality: We ensure that all employees have equal access to opportunities for growth, development, and advancement. This includes creating a supportive work environment that respects and values each individual's contributions, and implementing policies that promote work-life balance, fair compensation, and professional development.; Technology Accessibility: Our cloud hosting and software services are designed with accessibility in mind, ensuring that individuals with disabilities have equal access to our technologies. This includes adherence to accessibility standards and guidelines, and providing tools and features that enhance usability for all users.; Community Programmes and Partnerships: We engage in community programmes and partnerships aimed at promoting equal opportunity in the technology sector and beyond. This includes supporting educational initiatives that provide technology access and digital literacy training to underserved communities, and collaborating with organisations that work towards social inclusion.; Supplier Diversity: We are committed to supplier diversity by ensuring that small and minority-owned businesses are given fair opportunities to participate in our procurement processes. This not only supports economic inclusion but also enriches our supply chain with a diversity of ideas and products.

  Wellbeing

  In addressing wellbeing, we recognise the critical importance of mental and physical health, particularly in today’s fast-paced and often stressful work environments. Our approach to wellbeing is holistic, focusing on creating a supportive and healthy work culture for our employees, and extending this ethos to our clients and the communities we serve. Here’s how we contribute:; Employee Wellbeing Programmes: We implement comprehensive wellbeing programmes that support the mental, physical, and emotional health of our employees. These include access to mental health resources, such as counselling services and stress management workshops, as well as initiatives promoting physical health, like fitness classes and ergonomic workplace assessments. We believe that a healthy team is more engaged, productive, and innovative.; Flexible Working Arrangements: Recognising the diverse needs of our workforce, we offer flexible working arrangements to help employees balance their professional and personal lives. This flexibility includes options for remote work, flexible hours, and the provision for necessary breaks to recharge, contributing to a more sustainable work-life balance.; Healthy Work Environment: We strive to create a work environment that promotes wellbeing, including safe and comfortable physical spaces, a positive and inclusive culture, and opportunities for social connection and community building among employees.; Client and Community Support: Beyond our internal initiatives, we extend our commitment to wellbeing through the services and support we provide to clients and the wider community. This includes offering products and services that encourage healthy work practices and partnering with organisations focused on mental health and wellbeing.; Continuous Learning and Development: We believe in the wellbeing benefits of lifelong learning and professional development. Our programmes are designed to support continuous growth and development, reducing the risk of burnout and increasing job satisfaction by providing meaningful opportunities for advancement and skill enhancement.

Pricing

• Price: £0.03 to £1,388.89 a unit a month
• Discount for educational organisations: No
• Free trial available: No

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidmanagement@node4.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.