INSIGHT DIRECT (UK) LTD

Salesforce MuleSoft Anypoint Platform Education and Not for Profit

Salesforce's MuleSoft Anypoint Platform, a leading solution for API-led connectivity, creates an application network of apps, data, and devices, on-premises and in the cloud – empowering IT and business to create seamless digital experiences, products, and services with the #1 hybrid platform for integration, full lifecycle API management, and automation.

Features

• API-Led Connectivity: Architecture for creating reusable, composable enterprise building blocks
• Universal API Management: Centralised governance for APIs across any environment
• Anypoint Exchange: Central hub for discovering and reusing pre-built assets
• MuleSoft Composer: No-code tool for business users to automate integrations
• AI Einstein Integration: AI for automated mapping and code development
• Event-Driven Architectures: Power real-time AI agents using full-lifecycle AsyncAPI support
• Deploy Anywhere: Flexible hosting across on-premises, cloud, or hybrid environments
• Anypoint Flex Gateway: High-performance management for distributed microservices and applications
• MuleSoft Agent Fabric: Securely manage and govern complex AI technologies
• Enterprise Security: Built-in compliance, threat protection, and edge-to-edge encryption policies

Benefits

• Re-architect SOA infrastructure from legacy systems to create business agility.
• Hybrid environment, connecting SaaS and on-premise systems seamlessly
• Create a seamless Application Network of apps, data & devices
• Unified connectivity, design, run, analyse on a single platform
• Leverage reusable building blocks to increase developer productivity
• Future Proof, Anypoint’s flexibility evolves as you do
• Quickly design, build & manage the entire API lifecycle
• Promote reusability, modularity & collaboration, increasing developer productivity & speed
• Create integrations using natural language and no-code tools
• Govern APIs: Manage APIs built anywhere from one place.

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at pstenderteam@insight.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

944042335597033

Contact

Public Sector Tender Team
0344 846 3333
pstenderteam@insight.com

About your service

• Service categories:

  Application Development and Deployment

  Data management

  Database management systems

  • Relational Database Management Systems
  • Low-Code Database Management Systems
  • Navigational Database Management Systems
  • Fixed Record Database Management Systems
  • Object-Oriented Database Management Systems
  • Multivalue Database Management Systems
  • Non-Schematic Database Management Systems
  • Document-Oriented Database Systems
  • Key-Accessible Database Systems
  • Graph Database Management Systems
  • In-Memory Shared Data Managers
  • Data Lake Management Systems

  Database administration and development

  • Database Administration
  • Database Replication
  • Data Modelling
  • Database Development and Optimization

  Data integration and intelligence

  • Data Ingestion and Transformation Software
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: Salesforce will use commercially reasonable efforts to make the Cloud Offerings available 24 hours a day, 7 days a week, except for: (a) scheduled downtime of the management console (b) any unavailability caused by Force Majeure. The customer is totally responsible for the Mule runtimes or management outside of CloudHub.
• System requirements:
  • MuleSoft has no specific requirements.
  • If state requires persisting, the customer is responsible for licences.

User support

• Email or online ticketing support: Yes
• Support response times: There are three levels of support: GOLD: 1 Business Day. PLATINUM: Response times are defined by the severity of the issue being reported. S1 - 2 hours; S2 - 4 Business Hours; S3-S4 - 8 Business Hours. TITANIUM: S1 - 45 business minutes; S2 - 4 business hours; S3-4 - 8 business hours. Full details and definitions can be found here: https://www.mulesoft.com/legal/support-maintenance-terms
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: No
• Support levels: Salesforce support is staffed by expert developers and support issues will be escalated to core MuleSoft developers if that is required. Three levels of support offered, Gold, Platinum and Titanium. Gold provides UK office hours support, 8x5 and twenty support incidents. Platinum and Titanium provide 24x7 support and includes unlimited incidents. MuleSoft also has a customer success organisation that provides advice and best practice as part of a customers subscription. Our Customer Success team and customers work to mutually agreed goals to ensure success with Salesforce. Equally they may organise the correct resources within Salesforce, be that cloud infrastructure, Infosec, engineering or cloud operations as examples when customers have support issues that require additional focus. MuleSoft licensing is a subscription, support is not a separate charge it is included in the chosen subscription type.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: The Salesforce customer success organisation will provide a welcome pack and onboarding guide, our services team will provide roles-based training and professional services engagements to ensure customer has the tools and knowledge to drive their business outcomes.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: MuleSoft does not store customer data; MuleSoft, by default, is stateless. However, there are occasions where state is required in an application. For those instances, the customer is responsible for providing that state store i.e. databases. ; ; Depending on the specific nature of the implementation of the user's application, there may be work required to migrate data away from MuleSoft to other integration platforms. MuleSoft will work with users on a case-by-case basis to put an exit plan into effect.
• End-of-contract process: At the end of the contracted period the license will expire and there will be no further access to the service. There is nothing further in the contract that commits Salesforce to any work to support or assist with off boarding. Salesforce's Professional Services would be willing to work with you to assist with off boarding should that be necessary at your cost.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Documentation is provided online, accessible through the same interfaces as the service itself, known to work with screen and braille readers etc.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: The interface is a modern and intuitive design, with help functions throughout. The interface can be configured as may be required or left with the default settings.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: None
• API: Yes
• What users can and can't do using the API: The CloudHub REST API provides access to most operations you can perform with the management user interface. You can: Create an application on CloudHub; Change the application properties, including, worker numbers and environment variables; Deploy a new version of your application; Delete your application; Get statistics about your application; Create CloudHub notifications; Create email alerts triggered by your applications.
• API documentation: Yes
• API documentation formats:
  • HTML
  • Other
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: Applications are run by one or more instances of MuleSoft, called workers. These workers have: Capacity: Each worker has a specific amount of capacity to process data, customers select when deploying. Isolation: Each worker runs in a separate container from every other application. Manageability: Each worker is deployed and monitored independently by our cloud infrastructure. Each worker is a dedicated instance of Mule that runs your integration application. Further customers are logically segregated from other customers, and they are guaranteed resource allocation.

Analytics

• Service usage metrics: Yes
• Metrics types: CPU; HTTP request and response status; Memory; Number of active instances; Other; ; Other metrics; ; Configurable alerts; Business Insights; Cloud worker status; API Analytics; Logs; Application Data (if configured); Queues (Anypoint MQ); Schedules; Deployment settings
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Reseller (no extras)
• Organisation whose services are being resold: Salesforce Inc.

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest: Other
• Other data at rest protection approach: Anypoint MQ and Object Store V2 are encrypted using AES-256 symmetric key encryption.; ; MuleSoft does not persist data. Integrations and APIs are stateless; payloads are transient not persisted. MuleSoft does provide some features that allow customers to store temporary state.; ; MuleSoft runtimes are designed to be stateless. Where application data is stored in databases or object stores the features of our Enterprise Security are often used: ; • Secure Token Service Oauth 2.0 Provider ; • Credentials Vault ; • Message Encryption Processor ; • Digital Signature Processor ; • Mule Filter Processor ; • Mule CRC32 Processor
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: MuleSoft by default only handles customer data to process it as transactions. The base data is not held by MuleSoft, it is stateless and the data remains in the source and target systems.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • AVRO
  • CSV
  • FLATFILE
  • JSON
  • EXCEL
  • XML
  • NDJSON
  • TEXT
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • AVRO
  • CSV
  • FLATFILE
  • JSON
  • EXCEL
  • XML
  • NDJSON
  • TEXT

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
  • Other
• Other protection between networks: VPCs and VPNs can be used to isolate and protect networks. A VPC increases the isolation of MuleSoft runtimes while the VPN is used for securing the network connection. Anypoint Enterprise Security is a collection of security features that enforces secure access to information in Mule applications. These security features provide security to Service-Oriented Architecture implementations and Web services. The following bridge gaps between trust boundaries in applications: Secure Token Service Oauth 2.0 Provider Credentials Vault Message Encryption Processor Digital Signature Processor Mule Filter Processor Mule CRC32 Processor.
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Legacy SSL and TLS (under version 1.2)
  • Other
• Other protection within supplier network: Customer data is protected within the Salesforce service through a mature, standards-based defence-in-depth security architecture. Logical and physical access is strictly controlled, logged and monitored, and the access controls used are regularly audited for compliance with our certifications by third parties. Network security controls such as firewalls, intrusion detection, anti-malware, anti-ddos, file integrity monitoring are augmented with extensive monitoring to provide a robust prevention, detection and response model. Internal and external, as well as third-party vulnerability scanning and application penetration testing are also in place.

Availability and resilience

• Guaranteed availability: CloudHub builds upon the capabilities provided by AWS to deliver 99.99% availability each calendar month. CloudHub is designed to be highly available and scalable through redundancy, intelligent healing, and zero downtime updates. CloudHub services have at least one layer of redundancy; are available in multiple data centres, monitors workers and self-heals from problems. See https://www.mulesoft.com/legal/support-maintenance-terms, which discusses MuleSoft performance commitments. The customers can view the live status and detailed service history for the Runtime Manager console, CloudHub platform services, and the CloudHub worker cloud on status.mulesoft.com. Refund information can be obtained from the Salesforce Main Services Agreement available at https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Salesforce_MSA.pdf
• Approach to resilience: Available on request. See https://www.mulesoft.com/legal/support-maintenance-terms, which discusses MuleSoft performance commitments. The customers can view the live status and detailed service history for the Runtime Manager console, CloudHub platform services, and the CloudHub worker cloud on status.mulesoft.com.
• Outage reporting: There is a status portal where users can review the current systems status and optionally subscribe for email or SMS. An ATOM or RSS feed is also provided.; ; https://status.mulesoft.com/

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
  • Other
• Other user authentication: For the management plane MFA is recommended along with username and password as a minimum. Integration with an external Identity Management Provider is also supported. ; ; There are several common authentication protocols that APIs generally use. In most cases, you can implement at least one authentication method in your Anypoint Connector. Below are the choices: Basic Authentication; OAuth 1.0 & 2.0; HTTP Basic Authentication; SAML; Kerberos; NTLM; LDAP. Connector Developer Kit Authentication Methods: Basic Authentication; OAuth 1.0; OAuth 2.0; HTTP Basic Authentication; SAML; Kerberos; NTLM; LDAP.
• Access restrictions in management interfaces and support channels: Our IT infrastructure and production environment are separated. Only MuleSoft support and MuleSoft devops has access to the production environment. DevOps has access to production because they build and maintain the cloud environments. Support has access in order to help customers solve issues. Support has a process in which the customer has to provide permission for support to access a customer’s worker. It is important to note that all access is audited and monitored, and customer data is not persisted on systems.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
• Description of management access authentication: Our IT infrastructure and production environment are separated. Only MuleSoft support and MuleSoft devops has access to the production environment. DevOps has access to production because they build and maintain the cloud environments. Support has access in order to help customers solve issues. Support has a process in which the customer has to provide permission for support to access a customer’s worker. It is important to note that all access is audited and monitored, and customer data is not persisted on systems.

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: Between 6 months and 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: Between 6 months and 12 months
• How long system logs are stored for: Between 6 months and 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
  • Other
• Other security governance standards: ISO 27017; ISO 27018; SOC 1,2, 3; PCI DSS; UK NHS DSPT; EU Cloud Code of Conduct
• Information security policies and processes: Salesforce's Information Security Management System (ISMS) and information security policies are based on the ISO 27002 framework of best practices and are ISO 27001 certified. ; ; As required by this certification, the ISMS is endorsed by Senior Management. The Chief Trust Officer/CISO has responsibility for the information security policies and ISMS. The Salesforce Security Steering Committee approves/authorizes all changes to the policies, the Statement of Applicability (SoA), the information security manual, and any separate policy statements. ; ; During the ISO 27001 audit process (as well as other audits such as SOX and SSAE 16 SOC 1), senior management for various departments are involved in verifying that policies and procedures are in place and adhered to. Policies are reviewed/approved at least annually.; ; Companywide security awareness training highlights the importance of the security policies to employees and reinforces the company’s number 1 value of Trust.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Changes to infrastructure components are made through code using industry standard Infrastructure as Code (IaC) software and assessed for their security impact before being deployed. Individuals who wish to deploy an IaC change into production are required to follow defined procedures and standards, and to complete mandatory change management training before participating in the change management process. A change must be approved and routed through the change owner before the change can be implemented. A ticketing system is used as part of the change management procedure which records the components and the changes made.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Salesforce includes threat modelling into its software development lifecycle to help ensure the risks associated with potential threats are mitigated as early as possible. Multiple threat intelligence sources are used to help understand the current and evolving threat landscape. ; ; Vulnerability scans are performed on all Salesforce information systems and hosted applications. Patches are deployed in timeframes based on CVSS scores and risk level. ; ; All vulnerabilities discovered during penetration tests are entered into the salesforce central ticketing system and are assigned an internal vulnerability ranking according on the OWASP risk rating framework based on likelihood and impact.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Salesforce Threat Intelligence and Detection team monitors the Salesforce services 24x7 for threats and unauthorized intrusions in collaboration with the Security Incident Response teams. Extensive logging and monitoring is conducted across all Salesforce Services and environments (at application, network and database layers). All suspicious activities are flagged and reported to Salesforce CSIRT for investigation, management, communication, and resolution of security events and incidents in line with the NIST Incident Response model.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Salesforce has an Incident Management Process that guides the Salesforce Computer Security Incident Response team in investigation, management and resolution activities which includes developing standard pre-defined procedures for dealing with common events. ; ; Salesforce will promptly notify the customer in the event of any security breach of the Service resulting in an actual or reasonably suspected unauthorized disclosure of Customer Data. Notification may include phone contact by Salesforce support, email to customer's administrator and Security Contact and public posting on trust.salesforce.com.; ; Customers can email security@salesforce.com or use the https://security.salesforce.com/contact page to report incidents.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Please access the link to access the Anypoint platform trial for up to 30 days.; ; Exact terms are ; ; https://www.mulesoft.com/legal/terms/trial
• Link to free trial: https://anypoint.mulesoft.com/login/#/signup?apintent=generic

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Atlas
• ISO/IEC 27001 accreditation date: Sunday 13 April 2025
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Atlas
• ISO 9001 accreditation date: Tuesday 1 April 2025
• What the ISO 9001 doesn’t cover: N/A
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Be7ce590-de10-486e-8431-2e10891a8979
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: Cd8b1a78-44c7-4bb0-84d6-59a7506f3bba
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Ensuring new workers are informed of their right to join a trade union
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at pstenderteam@insight.com. Tell them what format you need. It will help if you say what assistive technology you use.