Nublue

Umbraco Managed Cloud Hosting

Scalable Umbraco Hosting. Managed Microsoft Azure, Amazon Web Services, and Platform.sh solutions; including monitoring, support SLA, managed Git version control, maintenance, and backups.

Features

• Optimised Managed Umbraco Hosting Stack
• Microsoft Azure, Amazon Web Services (AWS) or Platform.sh
• High Availability scalable hosting platforms
• AWS best practice solutions
• 24/7 solution monitoring
• Dedicated support phone number and email
• Automated provisioning for fast deployment
• 99.99% availability SLA
• Data stored in UK as standard
• Offices in Manchester, London and Lancaster

Benefits

• UK Based Support Team
• Fully managed infrastructure lets you focus on development
• 24/7 365 monitoring
• Easy to reach by phone or email
• Azure and AWS certifications in the team
• Multiple data migration methods and tools
• Fully managed service to reduce client staff overheads
• Unlimited technical support by LPI trained team
• Provide application level support as part of managed hosting contract

£500 an instance

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@nublue.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

939837635413079

Contact

Tom Ashworth
0800 033 7074
tenders@nublue.co.uk

Service scope

• Service constraints: Hosting specifically optimised for Umbraco installations.; ; Planned maintenance will be agreed in advance and any required downtime will be scheduled with timescales to suit both parties.
• System requirements: Umbraco

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Monday to Friday - 9-5 - 1 business hour; Saturday, Sunday, Public Holidays - 9-5 - 3 business hours
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), 7 days a week
• Web chat support: Web chat
• Web chat support availability: 9 to 5 (UK time), 7 days a week
• Web chat support accessibility standard: WCAG 2.1 A
• Web chat accessibility testing: N/a
• Onsite support: Yes, at extra cost
• Support levels: We only provide fully managed solutions so there are no tiers of support to provide apart from these. Any costs associated with the support required and provided will be included in the cost of the solution itself. Support is triaged by our support team and directed to the appropriate teams for resolution. Specific account managers can be assigned if required for your needs as part of your agreement.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: This is highly dependant on the needs of the user and will be discussed on a case by case basis. Simple management and access tasks would be covered on initial sign up. More complicated queries would be handled via the support team upon request. Scheduled meetings for discussion, planning or training are also encouraged. Documentation is provided again for simpler tasks, but can also be developed depending upon individual client needs.
• Service documentation: Yes
• Documentation formats:
  • PDF
  • Other
• Other documentation formats:
  • Google Docs or Microsoft Word
  • Informational Guides on our website
• End-of-contract data extraction: This depends entirely upon the needs of the user. Access can be provided to extract data themselves, or we can provide copies of the data according to client requirements if that is preferred. We do not attempt to hold client data at the end of a contract and will always work as far as possible to accommodate the needs of a user to obtain their data.
• End-of-contract process: The contract includes any agreed services for a defined period of time. At the end of the contract, all services included in the contract are deactivated and decommissioned. Any extension to these dates would be agreed in advance and require an additional cost to complete. Any data required by the customer from the solutions before the services have terminated will be co-ordinated and enabled as required before the end of the contract.

Using the service

• Web browser interface: Yes
• Using the web interface: If required a Plesk control panel can be set up to allow users to manage their hosting through a web interface. This would allow them to perform basic hosting administration, such as (but not limited to) creating webspace for domains; administering settings, configuration, and environment per-domain; managing and creating databases; managing and creating on-demand backups; managing email setups.
• Web interface accessibility standard: WCAG 2.1 A
• Web interface accessibility testing: N/a
• API: No
• Command line interface: Yes
• Command line interface compatibility: Linux or Unix
• Using the command line interface: Command line access can be provided depending upon the needs of the client, for instance to allow operation of Git or to run shell commands. Root access to solutions is not provided as this is a managed service.

Scaling

• Scaling available: Yes
• Scaling type:
  • Automatic
  • Manual
• Independence of resources: Each instance is provisioned independently.
• Usage notifications: Yes
• Usage reporting:
  • Email
  • Other
• Other usage reporting: Via Support Service Desk

Analytics

• Infrastructure or application metrics: Yes
• Metrics types:
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
• Reporting types: Reports on request

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Microsoft, Amazon, Platform.sh, Cloudflare, Nominet

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
• Equipment disposal approach: A third-party destruction service

Backup and recovery

• Backup and recovery: Yes
• What’s backed up:
  • Full solution backup
  • Granular backups on or off server of database(s)
  • Granular backups on or off solution of files
  • Backups on or off solution of email
• Backup controls: Users cannot control high-level backup schedules. Changes to the schedule provided are possible upon request and may result in an additional cost depending upon the request.; ; Users can make on-demand backups on the solution itself if a hosting control panel is provided as part of the solution. These backups utilise disk space within the solution and so an upgrade to available resources to accommodate this may be required.
• Datacentre setup: Multiple datacentres with disaster recovery
• Scheduling backups: Supplier controls the whole backup schedule
• Backup recovery:
  • Users can recover backups themselves, for example through a web interface
  • Users contact the support team

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Service operates consistently, 24 hours a day, 7 days a week. Availability for support for issues not covered by our 24/7 monitoring operates as per support hours detailed under the User Support section. Ability to contact support outside of hours for critical issues can be included for a cost as part of the agreement. SLAs and agreements for any refunds due would be discussed as part of any solution contract depending on the requirements and budget of the client.
• Approach to resilience: Hosting is provided by Microsoft Azure, Amazon Web Services, or Platform.sh; however, alternatives are available if required. Our unique implementation details are available upon request.
• Outage reporting: We report service outages via multiple channels to nominated stakeholders. (Typically The Product Owner) Automated notifications - Monitoring alert - JIRA alert - Email - Text Manual notification - Call - Online chat

Identity and authentication

• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: We can operate a detailed hierarchy of access permissions. Your hosting is 'self managed', allowing a superuser to manage others permissions. By default access to Nublue Ltd systems are restricted to private company IPs via VPN and root/superuser access is restricted to Nublue Ltd usage only.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Devices users manage the service through: Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

• Access to user activity audit information: You control when users can access audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: You control when users can access audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: Between 1 month and 6 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Centre for Assessment Ltd
• ISO/IEC 27001 accreditation date: 27/11/2023
• What the ISO/IEC 27001 doesn’t cover: Our certification covers all assets, staff and facilities involved with the provision of strategic digital services, specialising in the design, development, marketing, hosting and support of websites on behalf of customers from Nublue's Manchester and Lancaster offices.
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Nublue Ltd is part of the CTI Holdings Ltd group. Under this group, the CTI Digital Information Services Team (IST) has been established to manage information services within the organisation, chaired by a Technical Director or Director. The IST is made up of appropriate senior organisational managers. It exists, in part, to: Ensure that Nublue Ltd and its staff and students meet the requirements of extant UK legislation and regulations in relation to Information Security; Ensure that there is clear direction and visible management support for security initiatives within the organisation; Ensure that appropriate risk management assessments are resourced an undertaken; and Promote security through appropriate commitment and adequate resourcing.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Hosting is provided in a default configuration with restricted access. Changes to configuration are performed by Nublue in many cases, allowing us to control and manage updates. Significant required updates are planned in advance and scheduled with the client. Major updates are tested across an evolving suite of environments for safety before deployment.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We automate patch deployment in a staged manner across our infrastructure. We keep platforms as uniform as possible in terms of underlying stack, so that we can halt updates/determine safety of the update process in a staged, safe manner. Emergency updates and patches will be applied out of hours where possible.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We utilise Naemon monitoring, as well as Twilio, Cerberus, Maldetect, Modsecurity, Fail2ban and New Relic. Service operates consistently: 24 hours a day, 7 days a week. Issues noted by our monitoring are acknowledged within 15 minutes and worked on immediately. Stopping the initial threat vector is prioritised, and we then work with the client for further remediation once this has been completed.
• Incident management type: Supplier-defined controls
• Incident management approach: Any issue discovered by our monitoring creates an issue, that alerts our support team to a problem. This is then acknowledged and investigated. Out of hours alerts will escalate to the full team if not acknowledged in time. All issues are documented and reported, and reviewed the following morning if it occurs out of office hours. Clients will be contacted if there are further actions required; if actions were required from ourselves; or if there is a recurring issue.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: No

Energy efficiency

• Energy-efficient datacentres: Yes
• Description of energy efficient datacentres: We use Microsoft Azure - their policy can be found here - https://azure.microsoft.com/en-gb/global-infrastructure/sustainability/; ; We also use Amazon Web Services - their policy can be found here - https://aws.amazon.com/about-aws/sustainability/

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  We’re investing in strategies to become carbon neutral through the schemes operated externally. Employees are encouraged to use modes of public transport where they are required to travel for business, or to care share. Where feasible, meetings are also facilitated remotely utilising a number of online communication tools. Day to day, more of our employees are working from home, reducing our overall carbon emissions; but when travelling into the office we also promote use of the company’s cycle to work scheme, along with rail and tram season tickets. Further we aim to purchase products and services from third party suppliers that share similar environmental positioning goals as our own.

  Tackling economic inequality

  We’re mindful of differing needs of all sections of the community when it comes to employment opportunities - we don’t use any auto-decision making in our recruitment process and no vacancies or roles require a University degree which could otherwise limit employment opportunities for those in deprived areas. Offering true flexible working, whether it be reduced hours or altered working hours to fit with childcare and increased working from home. A training and development fund is provided each year for employees to take advantage of and an allotted number of days which can be used for Continued Professional Development, to gain recognised qualifications. Training days are hosted for clients to join and learn new skills (outside of projects) and we continue to operate ‘Lunch and Learn’ sessions internally, for employees to not only learn topics relevant to their role, but their knowledge across wider business services.

  Equal opportunity

  Our ED&I policy aims to ensure that everyone is aware of our commitment to equality, diversity and inclusion in all our activities; treating all employees and job applicant equally,; All employees are required to undertake mandatory training modules annually. These are: “Equality and Diversity in the Workplace” and “Unconscious Bias”. Ouremployee-led intersectional ED&I Committee was founded in order to guide us on our journey to becoming a truly diverse and inclusive employer, by promoting community and wellbeing for all, championing inclusion throughout the company, celebrating diversity and keeping the Board accountable. They’ll also identify any specific training that they believe would be beneficial for employees to have.

  Wellbeing

  During employment our workforce receive a range of benefits that aid their financial, physical and mental wellbeing. This includes flexible working hours, cycle to work scheme, life cover and annual subscription to Leafyard (mental wellbeing platform). We have a health cash plan to encourage employees to keep healthy, accessing annual health checks and the ability to claim back for everyday health costs (e.g. eye tests, dental etc.); in addition to access to remote GP services and private health care cover. Our employee assistance programme includes a wellbeing portal which gives all employees access to support for stress, mental health difficulties, financial and legal advice. Across all technologies offered, we make active contributions to digital communities and have fostered great relationships within our partner network; both of which our employees are encouraged to be part of as subject to their role and ongoing CPD.

Pricing

• Price: £500 an instance
• Discount for educational organisations: Yes
• Free trial available: No

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@nublue.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.