Softcat Limited

Salesforce - MuleSoft Anypoint Platform

MuleSoft’s Anypoint Platform, a leading solution for API-led connectivity, creates an application network of apps, data, and devices, on-premise and in the cloud – empowering IT and business to create seamless digital experiences, products, and services with the #1 hybrid platform for integration, full lifecycle API management, and automation. SFDCSMS2022GC13

Features

• Connectivity to over 200+ leading SaaS and on-premise applications
• Operational control from a central web-based portal
• High availability. Ensures zero message loss reliability
• Graphical and custom-code integration
• Hardened with thousands of automated tests and bug fixes
• Extensive API Management, Analytics, and Governance
• EDI/B2B Integration
• Batch Integration
• Real time and IoT integration
• Automate business processes

Benefits

• Re-architect SOA infrastructure from legacy systems to create business agility
• Hybrid environment, connecting SaaS and on premise systems seamlessly
• Create a seamless Application Network of apps, data & devices
• Unified connectivity, design, run, analyse on a single platform
• Leverage reusable building blocks to increase developer productivity
• Future Proof, Anypoints' flexibility evolves as you do
• Promote reusability, modularity & collaboration, increasing developer productivity & speed
• A platform for speed, innovation & growth
• Remove mundane, repetitive tasks with reusable, personalised bots

£70,080 a unit

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at psitq@softcat.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

839011275645815

Contact

Charles Harrison
01628 403403
psitq@softcat.com

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: MuleSoft will use commercially reasonable efforts to make the Cloud Offerings available 24 hours a day, 7 days a week, except for: (a) scheduled downtime of the management console (b) any unavailability caused by Force Majeure. The customer is totally responsible for the Mule runtimes or management outside of CloudHub.
• System requirements:
  • MuleSoft has no specific requirements
  • If persisting, the customer is responsible for prerequisites and licences

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: There are two levels of support: GOLD: 1 Business Day. PLATINUM: Response times are defined by the severity of the issue being reported. S1 - 2 hours; S2 - 4 Business Hours; S3-S4 - 8 Business Hours. Full details and definitions can be found here: https://www.mulesoft.com/legal/support-maintenance-terms
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: No
• Support levels: MuleSoft support is staffed by expert developers and support issues will be escalated to core Mule developers if that is required. Two levels of support offered, Gold and Platinum. Gold provides UK office hours support, 8x5 and twenty support incidents. Platinum provides 24x7 support and includes unlimited incidents. MuleSoft also has a customer success organisation that provides advice and best practice as part of a customers subscription. Our Customer Success team and customers work to mutually agreed goals to ensure success with MuleSoft. Equally they may organise the correct resources within MuleSoft be that cloud infrastructure, Infosec, engineering or cloud operations as examples when customers have support issues that require additional focus. MuleSoft licensing is a subscription, support is not a separate charge it is included in the chosen subscription type.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: The MuleSoft customer success organisation will provide a welcome pack and onboarding guide, our services team will provide roles-based training and professional services engagements to ensure customer has the tools and knowledge to drive their business outcomes.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: MuleSoft does not store customer data; Mule, by default, is stateless. However, there are occasions where state is required in an application. For those instances, the customer is responsible for providing that state store i.e. databases. ; ; Depending on the specific nature of the implementation of the user's application, there may be work required to migrate data away from MuleSoft to other integration platforms. MuleSoft will work with users on a case-by-case basis to put an exit plan into effect.
• End-of-contract process: At the end of the contracted period the license will expire and there will be no further access to the service. There is nothing further in the contract that commits MuleSoft to any work to support or assist with off boarding. MuleSoft's Professional Services would be willing to work with you to assist with off boarding should that be necessary at your cost.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.1 AA or EN 301 549
• Description of service interface: The interface is a modern and intuitive design, with help functions throughout. The interface can be configured as maybe required or left as default.
• Accessibility standards: WCAG 2.1 AA or EN 301 549
• Accessibility testing: No public information is available
• API: Yes
• What users can and can't do using the API: The CloudHub REST API provides access to most operations you can perform with the management user interface. You can: Create an application on CloudHub; Change the application properties, including, worker numbers and environment variables; Deploy a new version of your application; Delete your application; Get statistics about your application; Create CloudHub notifications; Create email alerts triggered by your applications.
• API documentation: Yes
• API documentation formats:
  • HTML
  • Other
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: N/A

Scaling

• Independence of resources: Applications are run by one or more instances of MuleSoft, called workers. These workers have: Capacity: Each worker has a specific amount of capacity to process data, customers select when deploying. Isolation: Each worker runs in a separate container from every other application. Manageability: Each worker is deployed and monitored independently by our cloud infrastructure. Each worker is a dedicated instance of Mule that runs your integration application. Further customers are logically segregated from other customers and they are guaranteed resource allocation. MuleSoft's Director of Cloud Operations is responsible for monitoring the use of assets and for planning required capacity.

Analytics

• Service usage metrics: Yes
• Metrics types: CPU; HTTP request and response status; Memory; Number of active instances; Other; Other metrics; ; Configurable alerts; Business Insights; Cloud worker status; API Analytics; Logs; Application Data (if configured); Queues (Anypoint MQ); Schedules; Deployment settings
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Reseller (no extras)
• Organisation whose services are being resold: Mulesoft, Salesforce

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: Less than once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Other
• Other data at rest protection approach: Anypoint MQ and Object Store V2 are encrypted using AES-256 symmetric key encryption.; ; MuleSoft does not persist data. Integrations and APIs are stateless; payloads are transient not persisted. MuleSoft does provide some features that allow customers to store temporary state.; ; MuleSoft runtimes are designed to be stateless. Where application data is stored in databases or object stores the features of our Enterprise Security are often used: ; • Secure Token Service Oauth 2.0 Provider ; • Credentials Vault ; • Message Encryption Processor ; • Digital Signature Processor ; • Mule Filter Processor ; • Mule CRC32 Processor
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed
• Equipment disposal approach: In-house destruction process

Data importing and exporting

• Data export approach: Mulesoft by default only handles customer data to process it as transactions. The base data is not held by Mulesoft, it is stateless and the data remains in the source and target systems.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • AVRO
  • CSV
  • Flatfile
  • Json
  • Excel
  • Xml
  • Ndjson
  • Text
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • Avro
  • Csv
  • Flatfile
  • Json
  • Excel
  • Xml
  • Ndjson
  • Text

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
  • Other
• Other protection between networks: Virtual Private Cloud (VPC); Virtual Private Network (VPN); Customers may provide a AWS Transit Gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Legacy SSL and TLS (under version 1.2)
  • Other
• Other protection within supplier network: VPC's and VPN's can be used to isolate and protect networks. A VPC increases the isolation of your Mule runtimes while the VPN is used for securing the network connection. Anypoint Enterprise Security is a collection of security features that enforces secure access to information in Mule applications. These security features provide security to Service-Oriented Architecture implementations and Web services. The following bridge gaps between trust boundaries in applications: Secure Token Service Oauth 2.0 Provider Credentials Vault Message Encryption Processor Digital Signature Processor Mule Filter Processor Mule CRC32 Processor.

Availability and resilience

• Guaranteed availability: CloudHub builds upon the capabilities provided by AWS to deliver 99.99% availability each calendar month. CloudHub is designed to be highly available and scalable through redundancy, intelligent healing, and zero downtime updates. CloudHub services have at least one layer of redundancy; are available in multiple data centres, monitors workers and self-heals from problems. See https://www.mulesoft.com/legal/support-maintenance-terms, which discusses MuleSoft performance commitments. The customers can view the live status and detailed service history for the Runtime Manager console, CloudHub platform services, and the CloudHub worker cloud on status.mulesoft.com.
• Approach to resilience: Available on request. See https://www.mulesoft.com/legal/support-maintenance-terms, which discusses MuleSoft performance commitments. The customers can view the live status and detailed service history for the Runtime Manager console, CloudHub platform services, and the CloudHub worker cloud on status.mulesoft.com.
• Outage reporting: There is a status portal where users can review the current systems status and optionally subscribe for email or SMS. An ATOM or RSS feed is also provided.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
  • Other
• Other user authentication: For the management plane MFA is recommended along with user name and password as a minimum. Integration with an external Identity Management Provider is also supported. ; ; There are several common authentication protocols that APIs generally use. In most cases, you can implement at least one authentication method in your Anypoint Connector. Below are the choices: Basic Authentication; OAuth 1.0 & 2.0; HTTP Basic Authentication; SAML; Kerberos; NTLM; LDAP. Connector Developer Kit Authentication Methods: Basic Authentication; OAuth 1.0; OAuth 2.0; HTTP Basic Authentication; SAML; Kerberos; NTLM; LDAP.
• Access restrictions in management interfaces and support channels: Our IT infrastructure and production environment are separated. Only MuleSoft support and MuleSoft devops has access to the production environment. DevOps has access to production because they build and maintain the cloud environments. Support has access in order to help customers solve issues. Support has a process in which the customer has to provide permission for support to access a customer’s worker. It is important to note that all access is audited and monitored, and customer data is not persisted on systems.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
• Description of management access authentication: Our IT infrastructure and production environment are separated. Only MuleSoft support and MuleSoft devops has access to the production environment. DevOps has access to production because they build and maintain the cloud environments. Support has access in order to help customers solve issues. Support has a process in which the customer has to provide permission for support to access a customer’s worker. It is important to note that all access is audited and monitored, and customer data is not persisted on systems.

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: Between 6 months and 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: Between 6 months and 12 months
• How long system logs are stored for: Between 6 months and 12 months

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: Coalfire Systems, Inc
• PCI DSS accreditation date: 29/12/2021
• What the PCI DSS doesn’t cover: This service is PCI DSS compliant. All controls for PCI DSS are in scope for this service, there is nothing not covered.
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: Yes
• Any other security certifications: MuleSoft is assessed for SOC 2 annually

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: ISO/IEC 27001

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: Mulesoft has formal processes for placing a system into production. This procedure includes a build checklist, server hardening checklist and pre-production testing. Baseline configurations for servers, network devices, and databases are consistent with industry-accepted CIS (Center for Internet Security) system hardening guidelines.; ; Change control procedures are required by the company’s Change Management Policy and include steps for testing, review, authorization, communication, verification, and back-out procedures. All changes to the infrastructure components are tested in a dedicated environment using production class equipment before being deployed into production. Changes are reviewed and approved by Technical Operations management prior to deployment to production.
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: Salesforce has policy in place. Periodic vulnerability scans are performed on all Salesforce information system and hosted applications. Frequency and comprehensiveness of scans is defined by security categorization of the system, data sensitivity and/or specific regulatory requirements. Automated mechanisms employed compare results of vulnerability scans over time to determine trends in information system vulnerabilities. ; ; Identified vulnerabilities are assigned on priority basis with an associated internal service level agreement for remediation based upon risk. Salesforce management reviews vulnerability and patching status on a bi-weekly basis. Patches are deployed for known vulnerabilities at least monthly, or as need based on the criticality.
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: Salesforce uses a number of different methods to monitor threats. Our environment is continuously monitored. All security related logs for all systems in the MuleSoft environment must be configured so that they are turned on, available for at least 3 months online, and 1 year offline. Logs are centralized and shipped off to a MSS, which admins cannot modify. Logs are collated and continuously analyzed. MuleSoft is alerted as necessary. Threat Stack to perform Host Based IDS, and File Integrity Monitoring. We regularly monitor external security advisory lists, such as CERT, FD, Bugtraq and SANS.
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: Salesforce has a formal Incident Management Process that guides the Salesforce Computer Security Incident Response team in investigation, management, communication, and resolution activities.; ; Salesforce will promptly notify the customer in the event of any security breach of the Service resulting in an actual or reasonably suspected unauthorized disclosure of Customer Data. Notification may include phone contact by Salesforce support, email to customer's administrator and Security Contact and public posting on trust.salesforce.com.; ; Salesforce.com is a member of the prestigious Forum of Incident Response and Security Teams (FIRST) and complies with the FIRST framework and best practices for incident response.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

• Connection to public sector networks: No

Social Value

• Fighting climate change:

  Fighting climate change

  In 2021, Salesforce achieved net zero across its full value chain and reached 100% renewable energy. This means Salesforce has purchased enough renewable energy to match all electricity it uses globally. ; ; Since first committing to this goal in 2013, Salesforce has been working to accelerate the global transition to clean and renewable sources of electricity with the aim for a future where renewable energy is powering the world around the clock.; ; Furthermore, Salesforce is on a mission to help conserve, restore, and grow 1 trillion trees by 2030.; ; Efforts include helping drive toward a 1.5°C future with its Climate Action Plan. Salesforce is focusing on six sustainability priorities — emissions reduction, carbon removal, trillion trees & ecosystem restoration, education & mobilisation, innovation, and regulation & policy — offering others a blueprint to accelerate their journey to Net Zero. In line with these priorities, Salesforce helped found 1t.org, a global movement to conserve, restore and grow 1 trillion trees by 2030 and launched an Ocean Sustainability Program to help protect our ocean.
• Covid-19 recovery:

  Covid-19 recovery

  Businesses are under pressure to find ways to innovate quickly, while providing seamless user experiences and increased security to accommodate the all-digital, work-from-anywhere world.; ; At Salesforce, we have responded to our customers’ needs faster than ever. We launched Work.com in May to help organisations navigate the complexity of safe office return. It included apps for manual contact tracing, employee wellness checks, shift scheduling, employee learning platform and command centre to help leaders visualise the data and make informed decisions. We built an entirely new suite of solutions in just eight weeks." More details: https://www.salesforce.com/news/stories/how-salesforce-built-work-com-in-8-weeks/. We also launched Vaccine Cloud in 2021 to help monitor health in the community.; ; Returning to the office; As the pandemic changed the way we work and live, we used our technology like Work.com and expertise to safely reopen our offices world-wide, and welcome our employees in a safe environment.; The Salesforce's approach is more than just reopening offices, for Brent Hyder (former Salesforce President and CPO) it is ‘’an opportunity to create a workspace and an employee experience that makes us more connected, healthy, innovative and productive.’’; For more information: https://www.salesforce.com/news/stories/global-return-to-the-office-the-salesforce-approach/; ; Vaccine Cloud; Introduced in early 2021, this cloud-based solution is designed to help organisations, workplaces, schools, and non-profits make data-driven decisions based on health status so they can open safely. ; Vaccine Cloud helps businesses and organisations quickly scale vaccine operations. The solution features capabilities ranging from recipient registration and scheduling to inventory management and public health outreach. Salesforce built Vaccine Cloud because legacy systems were built too simplistic to handle this epidemic; Vaccine Cloud is a technology that helps:; • Mitigate short-term risks and stabilise operations; • Plan and orchestrate a return-to-work; • Engage customers, partners, and suppliers at every-point
• Tackling economic inequality:

  Tackling economic inequality

  Based on World Economic Forum’s “The Future of Jobs Report 2020,” 50% of employees will need new skills in the next five years to keep up with the technology. ; More than 3 million people are already skilling up with Trailhead.; Anyone ready to take their skills to the next level can sign up for a free Trailhead account at www.Trailhead.com ; ; Trailhead offers free learning, helping to create new pathways into tech for diverse talent. This shapes a more inclusive future. ; ; 9 out of 10 customers rely on our partner apps and experts. 70% of Salesforce implementations are led by 1 of 132,000 Salesforce experts. Our partnership ecosystem is predicted to create 9.3M jobs and $1.6T in new business revenue by 2026, according to IDC (source:https://www.salesforce.com/news/press-releases/2021/09/20/idc-salesforce-economy-2021/?sfdc-redirect=430). ; ; Sustainable supply; Sustainability is integral to Salesforce’s procurement strategy and our supplier relationships. On Trailhead we outline our expectations of suppliers.; ; Our commitment to Equality extends to our supply chain. Our suppliers are critical for our success and innovation, share our values, operate with integrity, respect, and transparency.; ; Partnering with small businesses and diverse suppliers is not just the right thing to do; it is smart business. We seek certified diverse suppliers bringing innovation to positively impact local communities, ecosystems, and the environment. ; ; We are active partners with diverse community-based organisations to provide development, education, and resources. We are proud members and sponsors of Disability:IN, the National LGBT Chamber of Commerce, the National Minority Supplier Development Council, the National Veteran Business Development Council, and the Women’s Business Enterprise National Council. As we expand our initiative globally, we are proud to join the Minority Supplier Development UK and Supply Nation.; ; Learn more: https://www.salesforce.com/company/supplier-diversity/
• Equal opportunity:

  Equal opportunity

  The Valuable 500 is a global call to action for 500 world’s most influential businesses to include disability on their agenda and end bias toward disability. ; We joined the group in 2019 to create inclusive workplaces where everyone feels valued, respected and comfortable. ; ; Equality is a core value at Salesforce. It empowers us to innovate, build deeper connections with our customers, and ultimately become a better company.; ; We strive to create a workplace that reflects the diverse communities around us. Together we can build a more equal workplace and world for all.; ; We set a goal in 2019 to have 50% of our U.S. employees from underrepresented groups by 2023. In 2020, we included additional public representation goals to continue to accelerate this work, and we’re evaluating new goals to help hold us accountable.; ; Our Equality Groups are employee-led organisations that build community, educate allies, and drive equality. We continue to offer recognition and compensation for globally elected Equality Group leaders. More information: https://www.salesforce.com/company/equality/equality-groups/ .; ; Equality Examples; ; New gender inclusive benefits; Transgender people face barriers and inequality — including access to healthcare. We want to help remove some of those barriers to ensure our transgender and non-binary employees can get the care they need and live as their true, authentic selves by providing critical financial and emotional support they deserve.; ; Equal pay; Salesforce has spent $16 million to date to ensure equal pay for equal work among its global workforce. In 2015, the company committed to investigating and addressing any gender pay gaps. Since then, Salesforce has continued to improve upon its processes and broaden the scope of assessment to include bonuses, promotions, and stock, as well as race and ethnicity in the United States, in addition to gender globally.
• Wellbeing:

  Wellbeing

  We bring mental health conversations into the workplace. ; For example, our CPO Brent Hyder hosted a virtual Mental Health Town Hall for our global employee base, featuring leaders from across the spectrum talking about mental health.; ; We recognize that health equity concerns are especially problematic in the context of mental health. We see how the problems facing humanity such as nutrition insecurity, housing insecurity, climate action, health equity, mental health, wellbeing, and workforce development all intersect.; These are complex problems and we have to work all together towards solutions that span more than one axis.; ; Pledge 1% is a global movement that inspires, educates, and empowers every entrepreneur, company, and employee to be a force for good. Over 10,000 members in 100 countries have used Pledge 1%’s flexible framework to ignite half a billion dollars in new philanthropy.; ; Pledge 1% founding partners include Salesforce, Atlassian, and Rally, three companies that know first-hand how pledging a small portion of future success today can have an enormous impact tomorrow. In 2014, they came together with the Entrepreneurs Foundation of Colorado to accelerate a shared vision of every business around the globe integrating philanthropy into its corporate DNA. In 2016, Pledge 1% became a special initiative of Tides, a leading global philanthropic partner and non-profit accelerator.; ; Salesforce.org powers the purpose of people dedicated to solving our world’s biggest problems. A global community of nonprofits and educational institutions relies on our technology to help them operate effectively, raise funds, and build more meaningful relationships with those they serve.; - $1.5 Billion in technology given for free; - $23 Million in Pro Bono value to the sector in FY21; - 87% customers have improved their ability to achieve their mission

Pricing

• Price: £70,080 a unit
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Please access the link to access the Anypoint platform trial for up to 30 days.; ; Exact terms are ; ; https://www.mulesoft.com/legal/terms/trial
• Link to free trial: https://anypoint.mulesoft.com/login/#/signup?apintent=generic

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at psitq@softcat.com. Tell them what format you need. It will help if you say what assistive technology you use.