BDQ

HYCU Data Backup Solution software

HYCU provides data protection and cyber resilience software for hybrid and multi-cloud environments. It helps organisations back up, recover, and govern critical data and applications, supporting ransomware recovery, disaster recovery, and compliance through automated policy management, reporting, and rapid restore capabilities.

Features

• Agentless backup for cloud and virtualized environments
• Application-aware protection for databases and enterprise workloads
• Policy-based automation for backup and recovery workflows
• Built-in ransomware detection and immutable backup options
• Multi-cloud and SaaS coverage with centralized management
• Granular recovery for files, objects, and application-level items

Benefits

• Faster recovery times with simplified, automated restore processes
• Reduced operational overhead through agentless deployment and management
• Improved ransomware resilience with immutable, secure backups
• Lower total cost with unified platform across environments
• Stronger compliance with consistent policies and audit-ready reporting
• Restore only what’s needed, faster than full instance recovery

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at enquiries@bdq.cloud. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

908790715612485

Contact

Dominic Bush
+44 (0)844 8265 236
enquiries@bdq.cloud

About the service

• Service categories:
  • Application Development and Deployment
    • Data management
      • Database management systems
        • Low-Code Database Management Systems
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes
• What software services is the service an extension to: It integrates with platforms like Google Cloud, VMware, Kubernetes, and SaaS apps to provide backup and recovery.; ; It runs as a separate data protection layer, managing policies, backups, and restores across those environments.
• Cloud deployment model: Public cloud
• Service constraints: Like most backup/recovery platforms, HYCU can have practical constraints buyers should understand upfront:; ; Platform coverage varies by workload: Not every app/service has identical protection depth.; ; Granularity depends on the source: Some restores are item-level, others are full-volume.; ; RPO/RTO depend on architecture: Storage target, network, and retention settings matter.; ; Cloud egress/transfer costs may apply: Restores can trigger provider data charges.; ; Security features may be edition-based: Immutability/ransomware options can vary by license.; ; Operational maturity still required: You’ll need testing, monitoring, and policy tuning.
• System requirements:
  • Supported hypervisor, cloud platform, or SaaS source environment required
  • Administrative access to protected workloads and backup target storage
  • Supported OS and browser for management console access
  • Network connectivity between HYCU and protected systems required
  • Sufficient storage capacity for backups, retention, and growth
  • Supported database/application versions for application-aware backups

User support

• Email or online ticketing support: Yes
• Support response times: Response times depend on your HYCU support tier, but a typical structure is:; ; Business hours (Mon–Fri): fastest response for standard issues; ; Weekends/public holidays: reduced coverage, response times may be longer; ; Critical/P1 incidents: priority response, often 24/7 (if included)
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Onsite support can be provided through partners such as BDQ.; ; HYCU provides tiered support options to meet different operational needs:; ; Standard Support typically includes online ticketing and email support during business hours (Monday–Friday). It covers troubleshooting, break/fix assistance, and general product guidance. This level is usually included with the base subscription (or offered as the lowest-cost option) and does not normally include a dedicated Technical Account Manager (TAM).; ; Premium/Enhanced Support provides faster response targets, priority handling, and extended-hours coverage depending on the package. It may include improved escalation processes for higher-severity incidents. This level generally costs an additional annual fee or a percentage uplift on the subscription.; ; Enterprise / 24x7 Support is designed for mission-critical environments. It typically offers 24/7 coverage for P1/critical issues, the fastest response targets, and structured escalation management. This is the highest-cost tier and is priced as an annual uplift or premium support package.; ; A dedicated TAM or Cloud Support Engineer is usually available for Enterprise customers or as an optional add-on via professional services, depending on contract and region.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We help users start using HYCU through a combination of onboarding guidance, documentation, and remote enablement. Buyers can access user documentation and setup guides covering deployment, configuration, and best-practice backup and recovery workflows. We typically provide remote support to assist with initial installation, connecting protected platforms (cloud, virtual, SaaS), and setting policies for backup schedules, retention, and restores. Online training and knowledge resources may be available depending on the customer agreement and support tier. Onsite training is not usually included as standard, but can be arranged through professional services or delivery partners where required.
• Service documentation: Yes
• Documentation formats: HTML
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Onboarding and offboarding documentation is provided as online, web-based documentation that users can access through a standard browser. It is typically available to customers and partners via HYCU’s documentation resources and support channels, and can be shared internally for operational use. Onboarding guidance covers deployment, connecting supported platforms, configuring policies, and running initial backups and test restores. Offboarding guidance covers safely disabling protection, exporting reports where required, retaining or deleting backup data in line with customer policies, and removing access credentials and service accounts. Access to documentation may depend on product entitlement and support arrangements.
• End-of-contract data extraction: When a contract ends, users can extract their data by restoring required workloads or files from HYCU-managed backups back into their chosen environment (for example, a new platform, storage location, or replacement backup solution). Buyers can export reports and job history for audit purposes, where supported. If backups are stored in customer-controlled storage (such as cloud object storage or on-premises repositories), customers retain access to that storage and can manage retention, migration, or deletion according to their policies. Offboarding typically includes disabling schedules, revoking service account/API credentials, and securely removing HYCU components once data extraction and retention requirements are complete.
• End-of-contract process: At the end of the contract, the service subscription and associated support entitlement expire unless renewed. Buyers can complete any required restores or data extraction before termination, and should confirm retention requirements for any backups held in customer-controlled storage. Backup schedules and automated jobs can be disabled, and access credentials (service accounts/API keys) should be revoked to prevent further operations. HYCU software components can then be decommissioned from the environment in line with customer change control. Any remaining backup data is retained or deleted according to the buyer’s policies and the storage platform used. If required, buyers can export reporting and audit information prior to offboarding.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• Description of service interface: HYCU provides a service interface through its web-based management console (UI) and also offers API-based integration for automation and orchestration.
• Accessibility standards: None or don’t know
• Description of accessibility: HYCU is accessed through a secure, web-based management console (browser). Administrators can configure protection policies, run backups, monitor job status, manage retention, and perform restores, including granular recovery of specific files or application items. Users can view dashboards, reports, and alerts based on their assigned roles. Access is controlled using authentication and role-based permissions. Buyers can integrate HYCU with supported cloud, virtual, and SaaS platforms using API credentials and service accounts. End users typically do not install a desktop application or directly manage infrastructure-level backup configuration.
• Accessibility testing: Accessibility testing with assistive technology users has not been formally documented. We aim to support accessibility best practice through standard web browser compatibility and will work with buyers to assess requirements and make reasonable adjustments where possible.
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: HYCU provides an API that enables buyers to automate and integrate backup and recovery operations within supported environments. Using the API, users can typically authenticate, discover protected resources, trigger backup jobs, monitor job status, retrieve logs and reporting data, and initiate restore operations (including selecting specific objects where granular restore is supported). The API can also support integration with orchestration and ITSM workflows for alerting and operational automation.; ; Users can make changes through the API such as updating protection settings, scheduling, retention parameters, and associating workloads with policies, subject to role-based permissions. This allows repeatable configuration across multiple systems and reduces manual administration.; ; Limitations may apply depending on the protected platform, HYCU version, and licensing. Not all UI functions are always exposed through the API, and some advanced configuration, onboarding steps, or security settings may require initial setup in the management console. API access may require specific credentials/service accounts, network access to the HYCU management instance, and adherence to rate limits and permission controls.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: Users can customise HYCU primarily through the web management console (and in some cases via API), based on role-based access.; ; What can be customised; ; Backup policies (frequency, schedules, retention); ; Protected workloads and scope (which systems/apps are included); ; Recovery options (full restores vs granular restores where supported); ; Storage targets and repositories (cloud/object storage, disk, etc.); ; Security settings (encryption, immutability where available); ; Alerts, notifications, and reporting dashboards; ; Access controls (roles, permissions, service accounts); ; How users can customise; ; Configure policies and settings in the HYCU browser-based UI; ; Apply templates/policy rules across multiple workloads; ; Automate changes using API-driven workflows (where enabled); ; Who can customise; ; Typically administrators/backup operators with the right permissions; ; End users usually have view-only or restore-only access, if granted

Scaling

• Independence of resources: HYCU is typically deployed as a customer-dedicated instance (for example, a virtual appliance/management instance running in your environment). Because compute, storage targets, and network throughput are allocated to each customer, your backup and restore performance is not impacted by other organisations’ usage in a shared multi-tenant service.; ; Any capacity constraints are therefore driven by the buyer’s own sizing choices—such as repository performance, bandwidth, retention settings, and the number of protected workloads. Where cloud storage is used, service levels are also dependent on the underlying cloud provider’s performance and quotas.

Analytics

• Service usage metrics: Yes
• Metrics types: HYCU typically provides service usage and operational metrics through its management console, such as backup job status, success/failure rates, protected resources, storage consumption, retention status, and restore activity.
• Reporting types: Real-time dashboards
• Resource tagging: Yes
• FOCUS resource tagging: No

Supplier type

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: HYCU

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Data Erasure
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Users export their data by restoring it from HYCU backups to a target they control, such as cloud storage, a new platform, or an on-premises environment. Where supported, users can perform full restores or granular restores (for example, specific files or application items) instead of recovering an entire instance. Users can also export reporting and audit information, such as job history and backup status, to support operational and compliance needs. If backups are stored in customer-owned repositories (for example, object storage), users retain access and can manage data migration or retention directly.
• Data export formats:
  • CSV
  • Other
• Other data export formats: PDF
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • JSON
  • XML
  • PDF
  • YAML

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Availability commitments for HYCU depend on the deployment model and contract terms. HYCU is commonly deployed as a customer-dedicated instance within the buyer’s cloud or datacentre, so overall service availability is primarily determined by the buyer’s chosen hosting platform, network design, and storage target resilience.; ; Where an availability SLA is provided, it is typically documented in the commercial agreement and may align to the underlying cloud provider’s availability commitments for the selected region and services. If availability falls below the agreed level, remedies are usually provided as service credits or a subscription fee refund, calculated against the affected service period, in line with the SLA terms and claim process.
• Approach to resilience: HYCU is designed for resilience by supporting customer-dedicated deployments and leveraging the resilience of the underlying hosting platform. The HYCU management instance can be deployed in highly available cloud or datacentre infrastructure, with backups written to resilient storage targets such as replicated object storage or redundant on-prem repositories. Backup and recovery policies can be automated and monitored to reduce operational risk, and restore workflows support both full and granular recovery to minimise downtime. Resilience can be improved further by using multi-zone or multi-region storage, network redundancy, and regular recovery testing.; ; Datacentre resilience (power, cooling, physical security, and multi-site redundancy) is provided by the buyer’s chosen cloud provider or datacentre facilities. Detailed datacentre architecture and resilience controls can be provided on request, depending on the buyer’s deployment and hosting requirements.
• Outage reporting: HYCU can report outages and service issues through multiple channels:; ; Management console dashboards: Users can view backup job status, failures, and alerts.; ; Email alerts: Notifications can be configured for failed jobs and critical events.; ; API / integrations: Where enabled, users can pull status/alerts via API and integrate with monitoring/ITSM tools.; ; HYCU does not typically provide a public status dashboard, as it’s usually deployed as a customer-dedicated instance rather than a shared SaaS service.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is restricted using authentication, authorisation, and network controls. The HYCU management console and API require authenticated access, with role-based permissions to limit what each user can view or change (for example, admin vs operator vs read-only). Administrative actions and configuration changes are logged for auditability. Access can be further restricted using customer network controls such as firewalls, private connectivity/VPN, and IP allowlists. Support access is controlled through named support contacts and ticketing systems, with verification of requester identity and entitlement before sensitive actions are taken or information is shared.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We follow documented information security policies and processes covering: access control and least privilege; identity and credential management; encryption in transit and at rest; secure configuration and change management; vulnerability management (patching, scanning, remediation); secure software development practices; incident response and breach management; logging, monitoring and alerting; backup and recovery testing; supplier and third-party risk management; and security awareness training. Policies are reviewed regularly and updated to reflect changes in risk, technology, and regulatory requirements. Evidence of policies and supporting controls can be provided on request, subject to contractual terms and NDA.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We use documented configuration and change management processes to control service updates. Service components (for example, management instances, integrations, and policies) are tracked through their lifecycle using asset/configuration records, version control, and change logs. Each change is recorded with scope, owner, approvals, implementation details, and rollback steps. Changes are assessed for security impact by reviewing access permissions, authentication, encryption settings, network exposure, and data handling. Changes are risk-rated, tested before release, and validated after deployment. Emergency security changes follow an expedited process with retrospective review and full auditability.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We use a documented vulnerability management process to identify, assess, and remediate security risks. Potential threats are assessed using risk-based triage (severity, exploitability, exposure, and business impact) and validated through internal testing. Patches are prioritised and deployed based on criticality: urgent fixes are accelerated, while lower-severity updates follow scheduled maintenance and change control. Threat intelligence is gathered from vendor security advisories, CVE/NVD sources, cloud platform notifications, dependency alerts, and security research/community reporting. Remediation actions are tracked to closure, with audit logs and verification to confirm successful patching and risk reduction.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We use protective monitoring to detect and respond to security events. Potential compromises are identified by monitoring authentication activity, administrative actions, configuration changes, backup/restore behaviour, and system health. Alerts are generated for suspicious patterns such as repeated failed logins, unexpected privilege changes, unusual data movement, abnormal backup deletions, and job failures that may indicate ransomware or compromise. When a potential compromise is detected, we triage and investigate, contain risk (for example, revoke credentials or restrict access), and support recovery actions including clean restores. We respond based on incident severity, with priority handling for P1 events.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: We follow documented incident management processes to identify, manage, and resolve service issues and security incidents. Pre-defined procedures are used for common events such as backup failures, restore issues, access problems, and suspected compromise, including triage, escalation, containment, and recovery steps. Users report incidents through the support portal and/or email (and by phone for critical incidents where covered by the support tier). We provide incident updates through the ticketing system and issue an incident report on request or for major incidents, including timeline, impact, actions taken, and recommended preventative measures.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: HYCU commonly offers a free trial or proof-of-concept (POC) period, subject to terms and eligibility. Trials are typically time-limited and intended to demonstrate functionality in your environment.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: Provided
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Plans to engage the contract workforce in deciding the most important workplace issues to address
  • Ensuring new workers are informed of their right to join a trade union
  • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
  • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
  • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
  • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
  • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
  • How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.
  • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

  • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
  • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
  • Working conditions which promote an inclusive working environment and promote retention and progression
  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
  • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition
• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
  • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at enquiries@bdq.cloud. Tell them what format you need. It will help if you say what assistive technology you use.