Skip to main content
Digital Marketplace

Beta Help us improve the Digital Marketplace - send your feedback

SOMERFORD ASSOCIATES LIMITED

Hashicorp Vault Enterprise Manage access to secrets and protect sensitive data

HashiCorp Vault Enterprise simplifies security automation and secret lifecycle management. Vault secures, stores and tightly controls access to tokens, passwords, certificates and encryption keys in order to protect your sensitive data.

Features

  • Secrets Management in any environment
  • Encryption-as-a-Service in any environment
  • Leverage Trusted Identities in any environment
  • API-driven codification, protection and automated access to secrets
  • Identity Plugins - seamlessly integrate any trusted identity provider
  • Extend and integrate - manage access through a centralized workflow
  • Detailed audit logs Disaster recovery and replication
  • Access control policy enforcement through RBAC
  • Encryption key Distribute, rotate, enable, and disable keys
  • Data protection Protect data in-transit and at rest

Benefits

  • Store, access, and deploy secrets across applications, systems and infrastructure
  • Encrypt data in-transit and at rest
  • Authenticate and access different clouds, systems and endpoints
  • Secrets management and data protection
  • Collaboration and operations features for teams
  • Multi-data centre, scale, governance and policy features for organisations
  • Reduction of secret sprawl across systems
  • Reduces risk of Secrets leakage leveraging Dynamic Secrets
  • Automating the process of issuing Certificates

Pricing

  • Free trial available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@somerfordassociates.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

9 1 1 8 5 6 1 6 7 5 3 1 8 9 7

Contact

SOMERFORD ASSOCIATES LIMITED Penny Harrison
Telephone: 07897075103
Email: info@somerfordassociates.com

About your service

Service categories

Systems Infrastructure Software

System and service management

IT automation and configuration management

  • Workload management
  • Datacentre system and application control
Multi cloud support
No

Service scope

Software add-on or extension
No
Cloud deployment model
  • Public cloud
  • Private cloud
  • Hybrid cloud
Service constraints
None
System requirements
Not Applicable

User support

Email or online ticketing support
Yes
Support response times
Silver Support Tier - 9-5, Monday - Friday, Local Business Hours

Gold Support Tier - 24/7 Sev 1 Urgent
User can manage status and priority of support tickets
Yes
Online ticketing support accessibility
WCAG 2.2 AA
Phone support
Yes
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
No
Onsite support
Yes, at extra cost
Support levels
We provide support from priority 1 to priority 4 cases on any existing configuration or part of the platform that is in total or partial failure as well as not working as expected. We also provide configuration guidance and recommendations for use cases. Each customer receives their own Account Manager who works closely with Support and ensures that cases can be followed up. Somerfords Support desk is available as a value added service in addition to the maintenance and support purchased alongside the license.
Support available to third parties
Yes

Onboarding and offboarding

Getting started
We provide documentation for HashiCorp Vault Enterprise at https://developer.hashicorp.com/vault
We provide a learning portal https://developer.hashicorp.com/vault/tutorials with videos and self-guided tutorials.
We also provide virtual paid training through the Hashicorp Enterprise Academy. Schedule and registration can be found here: https://events.hashicorp.com/hashicorp-enterprise-academy
Service documentation
Yes
Documentation formats
HTML
End-of-contract data extraction
If you decide to end the HashiCorp Vault Enterprise contract, you could migrate to the self-managed Vault Community Edition which allows you access to data and features not restricted by Enterprise entitlements.
End-of-contract process
When the contract is coming to an end you have the option to renew the subscription.

If you do not wish to renew, you will have to migrate your data to Vault Community Edition if you wish to keep access to the secrets stored in HashiCorp Vault Enterprise after the contract ends. You will lose access to HashiCorp support and Enterprise specific features.
Documentation accessibility standard
EN 301 549

Using the service

Web browser interface
Yes
Supported browsers
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
Application to install
Yes
Compatible operating systems
  • MacOS
  • Windows
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
None as access is browser based.
Service interface
Yes
User support accessibility
WCAG 2.2 AA
Description of service interface
UI, API or CLI are available to interface with the service
Accessibility standards
WCAG 2.2 AA
Accessibility testing
N/A
API
Yes
What users can and can't do using the API
Full service capability Is accessible through the API
API documentation
Yes
API documentation formats
  • Open API (also known as Swagger)
  • HTML
API sandbox or test environment
No
Customisation available
No

Scaling

Independence of resources
HashiCorp Vault Enterprise instances are deployed and managed by the customer. Tenancy is therefore govenered by the customer's chosen operational architecture and practices.
https://cloud.hashicorp.com/docs/vault/security-overview#cluster-hardening

Analytics

Service usage metrics
Yes
Metrics types
Performance and usage data via requests and clients.
Please refer to the documentation for full list. https://developer.hashicorp.com/vault/docs/internals/telemetry
Reporting types
  • API access
  • Real-time dashboards
Resource tagging
No
FOCUS resource tagging
No

Resellers

Supplier type
Reseller providing extra features and support
Organisation whose services are being resold
Hashicorp

Staff security

Staff security clearance
Conforms to BS7858:2019
Government security clearance
Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
User control over data storage and processing locations
Yes
Datacentre security standards
Supplier-defined controls
Penetration testing frequency
At least once a year
Penetration testing approach
Another external penetration testing organisation
Protecting data at rest
Encryption of all physical media
Data sanitisation process
No
Equipment disposal approach
A third-party destruction service

Data importing and exporting

Data export approach
Not applicable
Data export formats
Other
Other data export formats
Personal data can be exported in a data portable format.
Data import formats
Other
Other data import formats
Not applicable

Data-in-transit protection

Data protection between buyer and supplier networks
TLS (version 1.2 or above)
Data protection within supplier network
  • TLS (version 1.2 or above)
  • Other
Other protection within supplier network
N/A

Availability and resilience

Guaranteed availability
HashiCorp Vault Enterprise is deployed and managed by the customer on their own infrastructure. This is not applicable.
Approach to resilience
We offer HashiCorp Validated Designs which include both Solutions Design Gudies and Operating Guides which enable our customers to deploy and operate their HashiCorp Vault Enterprise installations in accordance with HashiCorp good practice.

https://developer.hashicorp.com/validated-designs/vault-solution-design-guides-vault-enterprise
https://developer.hashicorp.com/validated-designs/vault-operating-guides-adoption
Outage reporting
HashiCorp Vault Enterprise is deployed and managed by the customer on their own infrastructure. Customers can make use of HashiCorp Vault Enterprise APIs in order to determine health and availability of their HashiCorp Vault Enterprise deployments.

Identity and authentication

User authentication needed
Yes
User authentication
  • Multi-Factor Authentication (MFA)
  • Username or password
Access restrictions in management interfaces and support channels
HashiCorp Vault Enterprise is deployed and managed by the customer. Access restrictions are implemented using namespaces and granular RBAC via ACL for your users. HashiCorp never has access to your data as you're hosting HashiCorp Vault Enterprise on your infrastructure.

HashiCorp's Support Portal implements Role Based Access Control for named customer contacts.
Access restriction testing frequency
Never
Management access authentication
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Username or password

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
User-defined
Access to supplier activity audit information
No audit information available
How long system logs are stored for
User-defined

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
  • ISO/IEC 27001
  • Other
Other security governance standards
HashiCorp security has achieved SOC 2 report, ISO 27001, ISO 27017 (cloud security) & ISO 27018 (cloud) certifications.
Information security policies and processes
All individuals with access to HashiCorp Resources are required to report any misuse or violations of this standard to Security (security@hashicorp.com), including:
Unauthorised access, disclosure, modification or deletion of HashiCorp data, Insufficient controls or weaknesses, and improper risk classifications. Please report to the IT and Security team immediately.
Software Security Code of Practice
Yes

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
The engineering team is constantly working on new features and maintenance. Once released, the customer can decide if they want to upgrade to the latest versions.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
HashiCorp uses the Common Vulnerability Scoring System (CVSS) for all vulnerabilities within scope of this standard. Each vulnerability must be assessed by the Security Team to determine the CVSS rating by completing the NIST CVSS v3.1 Calculator.
For a High severity vulnerability we aim to have a response timeline of 5 business days.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
At least annually or when significant changes have occurred, HashiCorp will conduct an independent review of the approach to managing information security and its implementation. Additional third party reviews may be performed at least annually as necessary.
Information systems should be regularly reviewed for compliance with HashiCorp’s information security policies and standards. The security team will use approved tools to check systems and networks for technical compliance as part of regular vulnerability assessment and penetration testing activity.
Incident management type
Supplier-defined controls
Incident management approach
All HashiCorp employees and contractors must report any suspected incident or suspicious event within 24 hours of detection of an incident. Customers, community members, and vendors with access to HashiCorp Resources, or who act on behalf of HashiCorp must also report any suspected incident or suspicious event involving HashiCorp Resources within 24 hours of discovery.
Information security weaknesses, incidents, and events must be reported as soon as possible. Employees must notify the security team through email or slack. External parties who experience an incident or event should report it to the security team via email.
Post-quantum cryptography secure
Yes

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks
No

Pricing

Discount for educational organisations
No
Free trial available
Yes
Description of free trial
Contact HashiCorp Sales, or your HashiCorp Account Team to discuss a trial of HashiCorp Vault Enterprise.

Discount percentage by annual call-off contract value (excluding VAT)

Less than £250,000
1%
Between £250,000 and £500,000
1%
Between £500,001 and £1,000,000
1%
Between £1,000,001 and £2,500,000
1%
Between £2,500,001 and £5,000,000
1%
Over £5,000,001
1%

Non-mandatory Standards and certifications

ISO/IEC 27001 certification
No
ISO 28000:2022 certification
No
ISO 9001 certification
Yes
Who accredited the ISO 9001 certification
SGS
ISO 9001 accreditation date
Tuesday 15 March 2022
What the ISO 9001 doesn’t cover
As our staff are a fully remote workforce the company physical office location is not covered. Clause 7.1.5 (calibration) is not in the scope. ISO 9001 does not cover financial processes.
Quality management systems (QMS)
Yes
CSA STAR certification
No
PCI certification
No
Cyber essentials
Yes
Please provide your Cyber Essentials Certificate Number
F416f438-c625-443c-8b8d-a1b8f3b804e3
Cyber essentials plus
Yes
Please provide your Cyber Essentials Plus Certificate Number
8d0e7cb8-30a3-4374-b713-d15f8d7f0c7d
Other security certifications
Yes
Any other security certifications
IASME Cyber Assurance Level 1 Certificate

Social value

Section B - Commitment for Future: Delivery

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
    • Plans for positive actions with community groups.

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
    • Offering a range of quality opportunities with routes of progression if appropriate, e.g. T Level industry placements, students supported into higher level apprenticeships.
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Other measures to offer development opportunities for the target cohort(s) in the contract workforce
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
    • Creation of outreach activities to create a pipeline of employees for the future contract delivery
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@somerfordassociates.com. Tell them what format you need. It will help if you say what assistive technology you use.