Nublue

Platform.sh Managed Cloud Hosting

Managed platform.sh based container hosting model suitable for Open Source projects. Features enable flexible development and CI in PHP & NodeJS.

This Platform as a Service (PaaS) offering provides an accelerated and highly automated environment within which projects based on Open Source technology are developed, tested and delivered into production.

Features

• Fully featured solution running on Platform.sh
• 24/7 Support and Monitoring via UK Service Desk
• Multiple environments for each domain (Staging, QA, User Stories)
• Git version control repository provide
• Fully managed backup with minimum 1 month retention
• Automated provisioning for fast deployment
• Choice of data locations available
• Offices in Manchester, Lancaster and London

Benefits

• Enhanced integrated agile development workflow
• Control for developers to spin up environments on demand
• Fully managed infrastructure lets you focus on development
• 24/7 365 monitoring
• Multiple data migration methods and tools
• Fully managed service to reduce client staff overheads
• Provide application level support as part of managed hosting contract
• Optimised for many Open Source Applications

£1,750 an instance a year

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@nublue.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

937313623261742

Contact

Natalie Kennedy
0800 033 7074
tenders@nublue.co.uk

Service scope

• Service constraints: No high availability (HA) option is available.; No load-balanced option.; Linux only environments for hosting web applications.
• System requirements:
  • Git Knowledge
  • Applications based on PHP

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Monday to Friday - 9-5 - 1 business hour; Saturday, Sunday, Public Holidays - 9-5 - 3 business hours
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), 7 days a week
• Web chat support: Web chat
• Web chat support availability: 9 to 5 (UK time), 7 days a week
• Web chat support accessibility standard: WCAG 2.1 A
• Web chat accessibility testing: N/a
• Onsite support: Yes, at extra cost
• Support levels: Infrastructure support is included with per project pricing.; Support available to third parties
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: User accounts generated.; Access level defined.; Tutorial videos for using the web UI available on YouTube.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • ODF
  • PDF
• End-of-contract data extraction: This depends entirely upon the needs of the user. Access can be provided to extract data themselves, or we can provide copies of the data according to client requirements if that is preferred. We do not attempt to hold client data at the end of a contract and will always work as far as possible to accommodate the needs of a user to obtain their data.; ; All source code is stored in Git and available at all times. Data (database, file assets) are available for extraction at any point using the standard Drupal Drush tool.
• End-of-contract process: The contract includes any agreed services for a defined period of time. At the end of the contract, all services included in the contract are deactivated and decommissioned. Any extension to these dates would be agreed in advance and require an additional cost to complete. Any data required by the customer from the solutions before the services have terminated will be co-ordinated and enabled as required before the end of the contract.

Using the service

• Web browser interface: No
• API: Yes
• What users can and can't do using the API: A RESTful API is available over HTTP.; Examples of API integrations are available on GitHub.; API automation tools; Ansible; Puppet
• API automation tools:
  • Ansible
  • Puppet
• API documentation: Yes
• API documentation formats: HTML
• Command line interface: Yes
• Command line interface compatibility:
  • Linux or Unix
  • Windows
  • MacOS
• Using the command line interface: Can add new projects; Can execute backups

Scaling

• Scaling available: Yes
• Scaling type:
  • Automatic
  • Manual
• Independence of resources: Each instance is provisioned independently through Amazon Web Services.
• Usage notifications: Yes
• Usage reporting:
  • Email
  • Other
• Other usage reporting: Via Support Service Desk

Analytics

• Infrastructure or application metrics: Yes
• Metrics types: HTTP request and response status
• Reporting types: Reports on request

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Amazon, Cloudflare, Platform.sh, eNom, Nominet

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
• Equipment disposal approach: A third-party destruction service

Backup and recovery

• Backup and recovery: Yes
• What’s backed up:
  • Source Code (in Git)
  • Database
  • File assets
• Backup controls: The service is fully managed and automated on a daily schedule.; ; Ad-hoc data backups can be performed using the Drush tool.
• Datacentre setup: Multiple datacentres with disaster recovery
• Scheduling backups: Supplier controls the whole backup schedule
• Backup recovery: Users contact the support team

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Service operates consistently, 24 hours a day, 7 days a week. Availability for support for issues not covered by our 24/7 monitoring operates as per support hours detailed under the User Support section. Ability to contact support outside of hours for critical issues can be included for a cost as part of the agreement. SLAs and agreements for any refunds due would be discussed as part of any solution contract depending on the requirements and budget of the client.
• Approach to resilience: Hosting is provided by Amazon Web Services, however, alternatives are available if required. Our unique implementation details are available upon request.
• Outage reporting: We report service outages via multiple channels to nominated stakeholders. (Typically The Product Owner) Automated notifications - Monitoring alert - JIRA alert - Email - Text Manual notification - Call - Online chat

Identity and authentication

• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: We can operate a detailed hierarchy of access permissions. Your hosting is 'self managed', allowing a superuser to manage others permissions. By default access to Nublue Ltd systems are restricted to private company IPs via VPN and root/superuser access is restricted to Nublue Ltd usage only.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Devices users manage the service through: Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

• Access to user activity audit information: You control when users can access audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: You control when users can access audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: Between 1 month and 6 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Centre for Assessment Ltd
• ISO/IEC 27001 accreditation date: 27/11/2023
• What the ISO/IEC 27001 doesn’t cover: Our certification covers all assets, staff and facilities involved with the provision of strategic digital services, specialising in the design, development, marketing, hosting and support of websites on behalf of customers from Nublue's Manchester and Lancaster offices.
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Nublue Ltd is part of the CTI Holdings Ltd group. Under this group, the CTI Digital Information Services Team (IST) has been established to manage information services within the organisation, chaired by a Technical Director or Director. The IST is made up of appropriate senior organisational managers. It exists, in part, to: Ensure that Nublue Ltd and its staff and students meet the requirements of extant UK legislation and regulations in relation to Information Security; Ensure that there is clear direction and visible management support for security initiatives within the organisation; Ensure that appropriate risk management assessments are resourced an undertaken; and Promote security through appropriate commitment and adequate resourcing.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We practice an ITIL V3 process for all changes requests.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Updates to server software a fully automated ensuring that high-priority fixes are deployed as soon as they are available.
• Protective monitoring type: Undisclosed
• Protective monitoring approach: We have established practices for managing and recovering from incidents, and restoring a secure service.
• Incident management type: Undisclosed
• Incident management approach: We have established practices for managing and recovering from incidents, and restoring a secure service.; ; Users report by phone / email or raising a ticket.; ; Incident reports are provided by ticket - with root cause analysis where needed.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
• Who implements virtualisation: Third-party
• Third-party virtualisation provider: Platform.sh
• How shared infrastructure is kept separate: LX Containers hosted on AWS VM hosts.

Energy efficiency

• Energy-efficient datacentres: Yes
• Description of energy efficient datacentres: We use Amazon Web Services - their policy can be found here - https://aws.amazon.com/about-aws/sustainability/

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  We’re investing in strategies to become carbon neutral through the schemes operated externally. Employees are encouraged to use modes of public transport where they are required to travel for business, or to care share. Where feasible, meetings are also facilitated remotely utilising a number of online communication tools. Day to day, more of our employees are working from home, reducing our overall carbon emissions; but when travelling into the office we also promote use of the company’s cycle to work scheme, along with rail and tram season tickets. Further we aim to purchase products and services from third party suppliers that share similar environmental positioning goals as our own.

  Tackling economic inequality

  We’re mindful of differing needs of all sections of the community when it comes to employment opportunities - we don’t use any auto-decision making in our recruitment process and no vacancies or roles require a University degree which could otherwise limit employment opportunities for those in deprived areas. Offering true flexible working, whether it be reduced hours or altered working hours to fit with childcare and increased working from home. A training and development fund is provided each year for employees to take advantage of and an allotted number of days which can be used for Continued Professional Development, to gain recognised qualifications. Training days are hosted for clients to join and learn new skills (outside of projects) and we continue to operate ‘Lunch and Learn’ sessions internally, for employees to not only learn topics relevant to their role, but their knowledge across wider business services.

  Equal opportunity

  Our ED&I policy aims to ensure that everyone is aware of our commitment to equality, diversity and inclusion in all our activities; treating all employees and job applicant equally,; All employees are required to undertake mandatory training modules annually. These are: “Equality and Diversity in the Workplace” and “Unconscious Bias”. Ouremployee-led intersectional ED&I Committee was founded in order to guide us on our journey to becoming a truly diverse and inclusive employer, by promoting community and wellbeing for all, championing inclusion throughout the company, celebrating diversity and keeping the Board accountable. They’ll also identify any specific training that they believe would be beneficial for employees to have.

  Wellbeing

  During employment our workforce receive a range of benefits that aid their financial, physical and mental wellbeing. This includes flexible working hours, cycle to work scheme, life cover and annual subscription to Leafyard (mental wellbeing platform). We have a health cash plan to encourage employees to keep healthy, accessing annual health checks and the ability to claim back for everyday health costs (e.g. eye tests, dental etc.); in addition to access to remote GP services and private health care cover. Our employee assistance programme includes a wellbeing portal which gives all employees access to support for stress, mental health difficulties, financial and legal advice. Across all technologies offered, we make active contributions to digital communities and have fostered great relationships within our partner network; both of which our employees are encouraged to be part of as subject to their role and ongoing CPD.

Pricing

• Price: £1,750 an instance a year
• Discount for educational organisations: Yes
• Free trial available: No

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@nublue.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.