ALCHEM TECHNOLOGIES, LTD.

Alchem Mercury

Mercury enables secure automated, dynamic data sharing and operations in a zero‑trust data format and environment. It manages enterprise‑wide partnerships, identifying sources across networks, applying rules and regulations, linking them to data. It accelerates collaboration, ensures compliance with policies and regulations, providing audit, alerts, and reporting for transparency and governance.

Features

• Automated compliant near-real-time data sharing across organisations/countries/internal domains
• Compliance of data policies, rules regulations in zero-trust environment
• Management of enterprise-wide dynamic data partnerships
• AI-driven ingestion, interpretation, enforcement of rules, regulations, & policies
• Automated data source discovery mapping; catalogue and ontology creation
• Real-time audit of data activity, alerting for compliance violations/misconfigurations
• ABAC application to governance, compliance, risk management
• Network discovery, scanning, identifying data sources across enterprise
• Automated rule creation, amendment, and deletion tools
• ACP240 and STANAG 4774/8 compliant supports Policy Enforcement Points etc

Benefits

• Accelerate data sharing with partners and across internal boundaries
• Enhance dynamic data sharing compliance and risk management
• Accelerate access to data for AI enablement and business operations
• Manage sensitive info and intellectual property across supply chains
• Selectively share sensitive data with partners across all boundaries
• Adapt data sharing to changing rules whilst maintaining compliance
• Create custom data sharing rules or leverage standard data regulations
• Transpose, mask, obfuscate, or integrate data when sharing
• Respond faster to risks with automated alerts, preventing breaches
• Turn unknown data sources into compliant easy-to-view catalogues, reducing blindspots

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@alchemtechnologies.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

950426472922122

Contact

Alexander Burton
07854466920
info@alchemtechnologies.com

About the service

• Service categories:
  • Application Development and Deployment
    • Data management
      • Database management systems
        • Multivalue Database Management Systems
        • Non-Schematic Database Management Systems
        • Document-Oriented Database Systems
        • Graph Database Management Systems
      • Database administration and development
        • Database Administration
      • Data integration and intelligence
        • Dynamic Data Movement Software
        • Metadata Management Software
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Mercury integrates with many applications incl:; Catalogue: Collibra; Document Management: S3, MinIO, SharePoint, Confluence, DocuSign; Productivity: majority; Compliance recording: Splunk; Databases: Snowflake, MariaDB, SQL Server, Postgress; Directory: Active Directory, Cognito. ; Designed modularly with open APIs specifications and readily integratible with other applications to enhance client data management and data compliance.
• Cloud deployment model: Hybrid cloud
• Service constraints: No
• System requirements:
  • Browser based access
  • Approval for containerised deployment to secure environments
  • Authentication server within secure environments

User support

• Email or online ticketing support: Yes
• Support response times: Response within 4 hours Mon-Fri 0900-1700. Weekend and more agile response available by negotiation.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 A
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• AI chatbot: Yes
• Web chat support accessibility standard: WCAG 2.2 A
• Web chat accessibility testing: None yet
• Onsite support: Yes, at extra cost
• Support levels: We provide two levels of technical support for our platform - Standard 8/5 - Premium 24/7 - Other combinations are POA For the Alchem Mercury platform, clients will have a - Technical Manager : who will be responsible for the overall management of the account, including reviews, escalations and general product enhancements - On-boarding consultant : to support the on-boarding process - Customer Support Engineer : provide proactive support based on tickets received or via the alerts generated from within the system. Support is provided via phone, email, chatbot, interactive help documentation or from the guides within the platform UI. We provide the following response levels - Level 1 (Platform affecting) : 1 hour - Level 2 (Client Specific) : 4 hours - Level 3 (User Specific) : 1 day - Level 4 (Feature Request) : 5 days Standard support is provided at no extra cost as part of the Platform licence. Premium support is based upon an uplift percentage of the number of users
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Alchem works closely with each customer to provide an implementation package that is specific to their needs. Contracts include access to online documentation and training material; with on-site training is available as required. Additional support in data management activities is available depending on customer need, including Automated ingestion of data sharing agreements, manual creation of data sharing agreements; automated configuration of data sharing rules; population of data libraries and ontologies; and establishment of data query, transformation, and obfuscation processes. Alchem works with the customer to configure alerts, reports and dashboards. Each customer will be assigned a Success Manager who will work with them to determine appropriate training and on-boarding needs.
• Service documentation: Yes
• Documentation formats: HTML
• Documentation accessibility standard: WCAG 2.2 A
• End-of-contract data extraction: Alchem Mercury does not retain a copy of customer or partner data that is shared through the product, and therefore there is no customer or partner data to extract at the end of a contract. Customer-specific systems data such as data sharing agreements, data catalogues, rules, queries, audit logs, and related data can be downloaded from the user interface or via APIs. Users can also make support requests to Alchem's Customer Success team, which can provide an extract of customer-specific system data. Ontology data is only available via the Customer Success team. In all circumstances, the customer will be able to extract their specific organisation's data from Mercury in a standard structured format.
• End-of-contract process: As part of Alchem's Customer Success programme, we continually engage with customers throughout the contract lifecycle, including planning for any offboarding at the end of a contract. Downloads of standard customer-specific system data is included in Mercury pricing. Professional services are available for non-standard end-of-contract requirements, as necessary.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Both offer the same functionality but are styled according to screen orientations.
• Service interface: Yes
• Description of service interface: Mercury has a prebuilt dashboard, containing individual KPI dials, which reports on the status of all objects within product. User can view the dashboards KPI’s to see a snapshot or drill through into more real time status of the objects and the system. ; In addition, the system has a set of APIs, that can be configured from inside the management console to push real-time information into service management and alerting tools such as Splunk, ServiceNow. The benefit of this approach means that the Alchem mercury product can sit as part of the total enterprise management system within an organisation
• Accessibility standards: WCAG 2.2 A
• Accessibility testing: None done at this point
• User support accessibility: WCAG 2.2 A
• API: Yes
• What users can and can't do using the API: Alchem Mercury is an API‑centric platform enabling secure integration across government and enterprise environments. All capabilities are configurable through standards‑based APIs, including creation and modification of data sharing agreements, rules, catalogues, ontologies, and queries. Mercury supports orchestration with COTS tools such as Splunk, DocuSign, and Snowflake. APIs follow OpenAPI spec 3.1, published via Swagger with full documentation. Access is token‑based, aligned with oAuth 2.0, with role‑controlled permissions, ensuring compliance and security. The service is load‑balanced, clustered for high availability, and scalable to meet demand peaks, providing resilience and transparency for public sector data management.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Alchem Mercury is designed to meet the data sharing needs of diverse customers across myriad use cases, so customisation is a key feature of the product. Customers can create unique data sharing agreements, rules, and terms based on their corporate policies and data sharing preferences. They can customise their data catalogues, ontology, and queries to share only the desired data and to share/receive data in desired formats. Customers can also customise user dashboards and integration with third-party systems to create a harmonised experience for business processes and users. Much of the customisation happens during initial Mercury implementation, such as creating template data sharing agreements based on and individual customer's corporate policies. The data catalogue and mapping to an ontology will be customised based on the data terrain of a customer (i.e. the location and structure of data). Outputs such as dashboards can be customised for each user. Each customer can establish roles to determine specific permissions to customise Mercury features. For example, users may customise dashboards and alerts and reports, while only the legal team can customise data sharing rules and standard terms.

Scaling

• Independence of resources: Alchem Mercury leverages a kubernetes cluster model with customer instance isolation. It uses autoscaling to ensure that each cluster is able to adapt (grow) and re-balance on demand. Alchem also monitors resource consumption on a continuous basis to re-distribute load as needed. Our customer support team is scaled to support customer demand.

Analytics

• Service usage metrics: Yes
• Metrics types: Alchem tracks a series of service metrics in the normal course of business, including automatically collecting metrics from Alchem Mercury. Customers can opt of metrics collection is desired.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest: Physical access control, complying with SSAE-18 / ISAE 3402
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: Alchem Mercury is designed with open API principles and all users therefore can export data, as required, that is relevant to their permissions and roles, which can be fully configured by Mercury customers.
• Data export formats: Other
• Other data export formats: JSON
• Data import formats: Other
• Other data import formats: JSON

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: We currently offer 99.7% uptime SLA with exceptions for "permissible downtime" that includes updates and upgrades with notice. Typically service credits are negotiated based on customer expectations.
• Approach to resilience: Alchem Mercury is hosted in public data clouds and is deployed across regions and datacentres to make the product resilient. Alchem also utilises software and hardware techniques to ensure an Active / Active approach to Mercury across all those cloud regions. This means we have high availability for our SaaS product. We can also deploy in secure environments using containers. We can provide documentation on request.
• Outage reporting: Alchem Mercury includes a system dashboard and APIs to provide updates on system performance. These are provided via external service, so that they are available in the event of a whole service failure and we need to ensure communication channels to our clients. In addition, email broadcasts are sent to customers in the event of system downtime.

Identity and authentication

• User authentication needed: Yes
• User authentication: Multi-Factor Authentication (MFA)
• Access restrictions in management interfaces and support channels: Alchem Mercury leverages roles-based access to assign user access to services, including backend services. Support roles have tiered levels of access to the system and infrastructure to remain appropriate to their role. Organisational data is encoded within the database and cannot be accessed by support, only via a guided support call with a user, in the event of a diagnostic is needed. The configuration element of the system is not encrypted and can be monitored and changed by the support team to support user tickets.
• Access restriction testing frequency: At least once a year
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Alchem has an established security policy that is applicable across the organisation. New employees read and sign the policy is as part of their induction process. All employees participate in an annual refresher of the security policy to ensure continued understanding and commitment. Alchem's CISO is responsible for chairing monthly meetings to review any security incidents, including identifying appropriate changes to Alchem's security policy. The CISO is also responsible for making sure any changes to the policy are cascaded to company employees. The CISO also is Alchem's security industry liaison, bringing together the latest industry news and best practices that can be adopted within Alchem. The CISO is also responsible for security testing within organisation, working with a an external party to test application security, physical security, and simulated phishing attacks. Results of these tests will be held within Alchem's ISO27001 audit logs.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Alchem maintains an enterprise architecture that follows cloud providers' best practices and Alchem Mercury is cloud-native product with a serverless-first design. Infrastructure components are provisioned and retired through the management console. As part of our approach to ISO 27001, we have regular infrastructure meetings to review our infrastructure and retire or remove non essential or out of date components. Changes follow our change management process, which are assessed by our infrastructure and security teams.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Alchem uses Amazon Inspector to automatically assess risks to service that may result from software vulnerabilities and unintended network exposure of AWS workloads. Inspector scans the Alchem's cloud environment to detect software and hardware vulnerabilities. Detected vulnerabilities are alerted through the management console and into the ticketing system for remediation by Alchem. Any component that is identified as a vulnerability, including configuration, is risk assessed and added to the CI/CD pipelines. We use Amazon Inspector risk score and prioritise when potential threats should be resolved. Priorities can be applied immediately or within a software deployment cycle.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We use three methods to identify potential threats: (1) Off the shelf active management tools, (2) In-house developed monitoring scripts, and (3) Industry alerts from NCSC. Both technical solutions create tickets in our incident management system with a priority level 1, which alerts our support team to follow our incident management plan, which outlines our approach to intrusion detection. We also actively monitor and manage threat alerts we receive from the NCSC.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: Alchem has a pre-defined process for managing incidents, which has been developed from best practices and guidance from ISO 27001. Our process has been digitised within our incident management system, so that any necessary resolution plan can be followed step by step, including the option for engaging 3rd party security management companies. Incident reporting occurs via the management portal, email, chatbot, or telephone. Incident updates are provided via our ticketing system or the management portal.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: 4 weeks of access to an Alchem environment, including all necessary data platform connectors.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 2%
• Between £250,000 and £500,000: 2%
• Between £500,001 and £1,000,000: 2%
• Between £1,000,001 and £2,500,000: 5%
• Between £2,500,001 and £5,000,000: 5%
• Over £5,000,001: 5%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: ISO QualiTrust Certification Ltd
• ISO/IEC 27001 accreditation date: Wednesday 22 January 2025
• What the ISO/IEC 27001 doesn’t cover: Nothing not covered
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: Becb7482-dba0-44a7-a387-b8a284ea68fd
• Cyber essentials plus: Yes
• Cyber Essentials Plus Certificate Number: 4cae5cc9-8020-414c-b9bb-23b3d6c44004
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Plans to engage the contract workforce in deciding the most important workplace issues to address
  • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
  • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
  • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Volunteering opportunities for staff
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
  • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering
  • Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

  Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

  • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
  • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
  • Plans for engaging a diverse range of businesses in engagement activities prior to appointing subcontractors (including activities prior to award of the main contract and during the contract term)
  • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
  • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors
  • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
  • Introducing transparency to pay and reward processes
  • Offering a range of quality opportunities with routes of progression if appropriate, e.g. T Level industry placements, students supported into higher level apprenticeships.
  • Working conditions which promote an inclusive working environment and promote retention and progression
  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

  • Understanding of the issues affecting the development of new skills by target cohort
  • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
  • Other measures to offer development opportunities for the target cohort(s) in the contract workforce
  • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
  • Understanding of issues relating to entering the contract workforce
  • Creation of outreach activities to create a pipeline of employees for the future contract delivery
  • Content of the outreach activity is designed to suit the target cohort
  • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@alchemtechnologies.com. Tell them what format you need. It will help if you say what assistive technology you use.