UNIT4 Multi-tenancy SaaS Delivery Model Accreditation

Transcription

1 UNIT4 Multi-tenancy SaaS Delivery Model Accreditation Agresso Business World ERP June 2012 ACCREDITATION REPORT

2 Introduction Cloud computing can provide flexibility and cost reductions by eliminating the need for hardware. It also comes with its own set of challenges, such as compliance with national/international laws and regulations regarding data stored outside the company firewall. But before jumping onto the cloud computing bandwagon, companies should understand the distinction between cloud computing providers in terms of the way they store data, either separately for each client (the "single tenant" model) or with multiple clients using the same database (the "multi-tenant" model). In the traditional multi-tenant model of "software as a service" (SaaS), many clients use the same database, with partitions between them and other clients. Their data is separated and they cannot access one another s information. Although cloud providers take actions to keep data secure and monitor its integrity, their customers are not always aware of what is being done and how that protects them from data breaches, hackers, etc. The UNIT4 multi-tenant model brings the advantages of the traditional model (release/version controls, unified security/audit/communication controls, etc.) but also lets each customer have its own database, which eliminates the disadvantages of a single database (which escalates security risk and discourages portability/change). In light of such considerations, this report will assist organizations that are looking to determine the best-fit SaaS service provider for their implementation needs. Based on information provided to TEC by UNIT4 and its clients, this report focuses on real-life implementation projects delivered by the service provider to three existing clients. UNIT4 is now TEC Accredited for the multi-tenant SaaS delivery model. Please note that TEC Accreditation and the associated Accreditation Report are valid for a period of one year. Renewal of TEC Accreditation status requires that at least one new and valid customer reference check be submitted to TEC on an annual basis. This ensures that service providers continue to meet the standards established by TEC.

3 Overview Founded in 1980 in the Netherlands, UNIT4 offers business software solutions and professional services for companies around the globe. UNIT4 has offices and partners in over 25 countries worldwide, and offers solutions for enterprise resource planning (ERP), human resources (HR), financials, business intelligence (BI), and performance management. The two main products offered by UNIT4 are Agresso Business World ERP, and Coda Financials, which can be delivered on-premise, single-instance hosted, or via multi-tenant cloud computing. UNIT4 offers various solutions via the SaaS model: Vita Cloud Angel for Agresso Business World, Coda Cloud Rebel for Coda Financials, Shared Journey for groups of organizations that want to improve their delivery of shared services, and FinancialForce.com (backed by salesforce.com) for cloud accounting and professional services applications. UNIT4 has achieved TEC Accreditation for the multi-tenant SaaS delivery model for its Agresso Business World ERP solution, for which it claims change management and security advantages over its competitors, among them SAP, Oracle, and Microsoft Dynamics. General services range from project management and business process mapping to application support and customization. UNIT4, which targets its solutions to organizations facing continuous change requirements, and which has previously demonstrated to TEC how it supports this, is now claiming change-management differentiation based on the configuration of its multi-tenant cloud delivery model. As with its ERP solution s foundation, the UNIT4 has elected not to default to the common database model used by the majority of cloud software providers. Instead, UNIT4 reinvented multi-tenancy by offering a change-oriented platform that allows for each customer to have its own independent, individual database (as opposed to traditional multi-tenancy solutions, where more customers use the same database). This provides a higher level of customer security than found in a single database approach to multi-tenancy, and yet still allows UNIT4 to provide the simultaneous release and version control, data access, and communications features that define this type of deployment. More on this unique model and its five core advantages to both the customer base and the vendor will be released by TEC in a Vendor Spotlight report scheduled for publication in Fall During the accreditation process, we examined satisfaction levels for three UNIT4 clients for general services as well as services specific to multi-tenant SaaS implementations. This report provides results for each of the following sections: overall quality of the project delivered multi-tenant SaaS-specific services (information about multi-tenancy, data security, archiving and backup, and compliance) general services likelihood of client recommendation As the charts in this report demonstrate, the average level of satisfaction is quite high for the general services provided by UNIT4, as well as for the services related to its multi-tenant SaaS delivery model. As for the likelihood of customer recommendation, the average is very high. Note that not all clients interviewed required all services offered by UNIT4, and some areas are therefore flagged as Not Applicable. For more details about UNIT4 and the services it offers, see UNIT4's profile in TEC s IT Directory.

4 Service Provider Details The following sections of this report provide you with an understanding of UNIT4 and the types of professional services it offers related to the multi-tenant SaaS software delivery model. This includes an overview of UNIT4 s industries served, types of business software solutions offered, and active clients. Company Snapshot With its two main products, along with its other solutions (see complete list below), UNIT4 provides solutions for many types of industries, ranging from education and financial services, to professional services. Depending on the needs of the client and its industry, UNIT4 can provide combinations of its various solutions, and also offers the option for clients to share certain products in the cloud through its Shared Journey offering. Industries Served by Multi-tenant SaaS Solutions Business Services and Consulting; Education; Finance and Banking; Insurance; Non-profit Organization; Public Administration and Defense; Publishing and Media; Engineering and Architecture Solutions Offered by UNIT4 as a Multi-tenant SaaS Delivery Model Approximate Number of Current Active Clients Using Multi-tenant SaaS Solutions Provided by UNIT4 Agresso Business World (ERP), Agresso Talent Management (HRM), OCRA (consolidation and cash flow planning), FastNet (real estate management system), WebInfo/InfoKey (BI and reporting), MAP (project planning/calculation) 200+ clients, with more than 100,000 users

5 Professional Services The following sections address the types of professional services UNIT4 offers its clients. We will briefly review the general services offered by UNIT4 to its clients and then go into more detail on the services specific to the multi-tenant SaaS delivery model. General Services This section covers UNIT4 s general services. According to UNIT4, the following services are provided to its customers as part of its professional services offering. Implementation services (e.g., assisting customers in creating business processes, auditing the implementation) Industry templates provided for workflows, documentation, reports, etc. Add-ons provided for functionality not provided in the core solution Support for modifications (screen configurations, graphical user interface tailoring, etc.) Project management and consulting Business needs assessment and mapping (i.e., business process to functional requirement) Business process modeling and re-engineering Data cleansing, conversion, and data migration Change management and performance optimization Training and application support UNIT4's first client went live in 1998 on a UNIT4 solution provided through cloud computing. Since then, UNIT4 has enhanced its cloud offering to provide multi-tenant SaaS to its customers, and has taken measures to ensure that information is safe and easily accessible by the client. UNIT4 has an information security management system compliant with the latest version of the ISO/IEC 27001/27002 standards for data security, and is in the process of obtaining SSAE 16 certification, another important standard for information security. All data resides on UNIT4 s machines, and only its staff has access to the data centers (but no access to the client's instance of the solution). Service level agreements are provided and UNIT4 also provides the option for its employees to sign non-disclosure agreements (NDAs) when working with client data. Security levels are monitored by UNIT4 and verified by external independent information security companies. External audits by the customer are also permitted, as long as the auditor is approved by UNIT4. The table below contains a summary of the services provided by UNIT4 to its clients using the multi-tenant SaaS delivery model. Subsequent sections of this report summarize the responses we received from three of UNIT4 s references regarding levels of satisfaction with these services.

6 Information about multi-tenancy Services provided for multi-tenancy SaaS delivery model Data security Archiving and backup Compliance Documentation on procedures and rules for granting and approving internal and external access to tenant data is available. Procedures are in place to avoid duplicating production data in nonproduction environments. Data compromised as the result of a failure can be retrieved for a tenant without impacting other tenants. The data of a tenant can be frozen or locked for legal purposes without affecting the data of the other tenants. Service level agreements describing guarantees and warranties for uptime and security (including response plan for security issues and the way they are handled) are provided. Unique encryption keys for each client can be created to ensure data security. Each tenant can opt for different archiving and backup options than the other tenants (including the option to permanently delete archived data when requested by tenant). A policy is in place to address requests from governmental or thirdparty organizations to access the tenant data. Procedures and documentation to protect the customer s intellectual property are provided. The data created by one tenant cannot be accessed by other tenants. A clear and simple procedure for data retrieval exists in cases where a customer decides to end the contract. User rights and responsibilities for data access are legally and contractually defined prior to implementation. Clients have access to information regarding changes to data storage (e.g., when data are moved to another data center), uptime, physical location of data storage, etc. Data transfer is secure between SaaS and onpremise applications for each tenant, with no impact on other tenants. All data is completely removed from the data center for a tenant at the end of the contract without impacting the other tenants. Continuous monitoring for compliance related to data access and storage is performed, with results being shared with tenants. Results of internal or external security audits, as well as statistics on security incidents (e.g., data breaches or downtime) and security certifications are shared with tenants. Customers can perform independent vulnerability tests using third parties of their choice. Incompatibility between client needs and local/international regulations for data security are identified and addressed.

7 Service Provider Client Reference Summary Three UNIT4 clients responded to TEC s questions regarding UNIT4's service quality for the multi-tenant SaaS delivery model of their solution. Their responses give you an understanding of the types of UNIT4's clients and projects, and how the service provider was rated by its clients. Client Reference Snapshot The following table provides a high-level snapshot of the three clients TEC surveyed about their experience with UNIT4. CLIENT REFERENCES: SNAPSHOT AND PROJECT OVERVIEW CLIENT ONE CLIENT TWO CLIENT THREE INDUSTRY Insurance Electronics and High-tech Education CONCURRENT USERS users users 1,001 10,000 users BUSINESS AREA Accounting and Finance Human Resources Engineering and Design Accounting and Finance Administration COMPANY HEADQUARTERS Sweden Sweden Sweden Project Breakdown For the purposes of this report, we define a project as the ensemble of services offered by UNIT4 to each client. We have identified the following four areas for evaluation, with specific components for multi-tenant SaaS deployment: overall quality of the project delivered multi-tenant SaaS-specific services information about multi-tenancy data security archiving and backup compliance general services recommendation The following sections of this report provide an overview of the responses provided by each client.

8 Overall Quality of the Project Delivered This section of the report details client responses to the project, based on the overall quality of the project delivered by UNIT4 (taking into account all services received by clients, in the context of services specific to the multi-tenant SaaS delivery model as well as general services). The following graph displays the average level of client satisfaction. Overall level of satisfaction per client and the average

9 Multi-tenant SaaS-specific Services Based on the services received during the implementation of their projects, the following sections detail client responses for multi-tenant SaaS-specific criteria. We separated the criteria into four categories based on the challenges they address: 1) information about multi-tenancy, 2) data security, 3) archiving and backup, and 4) compliance. Information about multi-tenancy Information about multi-tenancy includes information related to customer rights and responsibilities, uptime or security audit results, documentation, etc Client One Client Two Client Three Average Clients level of satisfaction with the information they received about multi-tenancy SaaS Clients level of satisfaction with the information received about multi-tenancy SaaS CLIENT ONE CLIENT TWO CLIENT THREE Quality of service-level agreements for uptime and security (including response plans for security issues and the way they are handled by the provider) Very Very Quality of procedures and documentation to protect intellectual property in the multi-tenant SaaS environment Very Manner in which the vendor provided access to information regarding changes to data storage (e.g., in the case where data are moved to another data center), uptime, physical location of data storage, etc. Very Very Quality of the overall security strategies and methodologies the vendor uses to keep your data safe in the cloud Very

10 Data Security This section relates to the options offered by UNIT4 to its customers for data access (e.g., from mobile devices) and transfer (e.g., between cloud and on-premise solutions) Client One Client Two Client Three Average Clients level of satisfaction with the level of security for data access and transfer Clients level of satisfaction with the level of security for data access and transfer CLIENT ONE CLIENT TWO CLIENT THREE Option to enforce limited access from mobile devices to sensitive data based on your specific needs Somewhat Very Very Manner in which the vendor provided guarantees that the data created by one customer cannot be accessed by other customers Performance of secure data transfer between cloud and on-premise applications Manner in which the service provider allowed you to perform independent vulnerability tests using third parties of your choice Very Very Very Very Option to receive alerts from the service provider when privacy breaches may have impacted your data Somewhat Very

11 Archiving and Backup This section relates to the options that UNIT4 offered its clients for archiving information, performing backups, and recovering lost or compromised data Client One Client Two Client Three Average Clients level of satisfaction with the level of security for data access and transfer Clients level of satisfaction with the archiving and backup options CLIENT ONE CLIENT TWO CLIENT THREE Ability to opt for personalized archiving and backup options (including the option to permanently delete archived data when requested by the customer) Clear and simple procedure for data retrieval at the end of the contract Option to have all data completely removed from the data center at the end of the contract Very Somewhat Somewhat Very Somewhat Very

12 Compliance This section relates to criteria that indicate how UNIT4 helped its clients address compliance and legal issues specific to the multi-tenant SaaS delivery model (e.g., incompatibility between client needs for data storage and local regulations) Client One Client Two Client Three Average Clients level of satisfaction with the way UNIT4 helped resolve compliance challenges Clients level of satisfaction with archiving and backup options CLIENT ONE CLIENT TWO CLIENT THREE Clear legal and contractual definition of user rights and responsibilities for data access provided prior to implementation Manner in which the service provider shared results of continuous monitoring for compliance related to data access and storage Support for identifying and addressing incompatibilities between your needs and local/international regulations for data security (e.g., mobile or remote access for sales or field service employees may have been subject to regulations you weren t aware of) Very Very Somewhat Not Applicable Somewhat Not Applicable

13 General Services Based on general service delivery and support received during the implementation project, this section indicates how UNIT4's clients responded Client One Client Two Client Three Average Clients level of satisfaction with general services Clients level of satisfaction with general services received CLIENT ONE CLIENT TWO CLIENT THREE Implementation services (e.g., assistance in creating business processes, auditing the Very implementation, etc.) Quality of industry templates provided (for workflows, documentation, reports, etc.) Very Quality of add-ons for functionality not provided in core solution Very Support for modifications (screen configurations, Somewhat graphical user interface tailoring, etc.) Very Project management and consulting services Very Not Applicable Business needs assessment and mapping (i.e., business processes to functional requirements) services Business process modeling and re-engineering services Data cleansing, conversion, and data migration services Change management and performance optimization services Training and application support services Very Somewhat Very Not Applicable Very Very Somewhat Very Somewhat Very Somewhat

14 Recommendation Based on the overall project, this is the recommendation of the three service providers clients. Client recommendations CLIENT ONE CLIENT TWO CLIENT THREE Likelihood of using the provider in the future Would definitely use Would definitely use Would use Likelihood of recommending the provider to others Likely to recommend Would definitely recommend Would recommend Conclusion The three UNIT4 clients referenced in this report represent different industries and company sizes, and all three are satisfied or very satisfied with the services they received, regarding both general and cloud-specific services. Business areas represented include accounting and finance, administration, engineering, and human resources. Indeed, UNIT4 s multi-tenant SaaS solutions can be used by companies acting in various industries, with different needs, and can scale to adapt to ranges of users from under 100 up to 10,000 users. For cloud-specific services, the highest overall level of satisfaction is achieved for the degree to which UNIT4 shares information with regarding multi-tenancy, customer rights and responsibilities, uptime and security audits results, etc. For archiving, backup, and recovery of data, all three customers were satisfied overall, with two of the three indicating that they were somewhat satisfied with the procedure for data retrieval at the end of the contract. As far as security of data access and transfer is concerned, all three customers expressed a high level of satisfaction, especially with the manner in which UNIT4 provided them with guarantees that their data cannot be accessed by other customers using the same cloud solution. Satisfaction levels with legal and compliance services are high (note that this criterion was inapplicable for one client), especially for contractual definitions of user rights and responsibilities regarding data access. In conclusion, along with professional services delivered during implementation, UNIT4 also provides services to ensure that its customers understand the benefits and challenges of multi-tenancy, as well as guaranteeing uptime and data integrity, and helping clients deal with cloud computing legal issues that they may not be aware of. The ratings in this report are based on data provided to TEC by three of UNIT4 s client references, and are published for general information purposes only. This report should not replace an in-depth reference review process. In the context of a selection process, we recommend that you exercise due diligence and conduct a thorough evaluation based on your organization s unique business needs and characteristics.

15 TEC Accreditation Program In response to our software-buying community s requests to evaluate the quality of services provided by our members, TEC developed its Accreditation Program. TEC Accreditation provides information on local and regional VARs, channel partners, vendors, implementers, and consultants. Each company has responded to TEC s accreditation criteria and provided the requested feedback from client references. About Technology Evaluation Centers Technology Evaluation Centers (TEC), the leading advocate for the enterprise software purchaser, helps private- and public-sector organizations choose the best enterprise software solutions for their unique business needs quickly, impartially, and cost-effectively. TEC delivers an unmatched range of online software evaluation and selection services that minimize the costs, risks, and duration of software selection projects, and bridges the gap between enterprise decision makers and the vendor/value-added reseller (VAR) community. TEC s proven approach combines extensive online IT research; a proven software selection methodology; state-of-the-art Web-based software selection technology; and the experience of its analysts and software selection experts. Technology Evaluation Centers Inc. 740 St. Maurice, 4th Floor Montreal, Quebec Canada, H3C 1L5 Phone: , ext. 404 Toll-free: Fax: selectionservices@technologyevaluation.com Web site: TEC, TEC Advisor, and ERGO are trademarks of Technology Evaluation Centers Inc. All other company and product names may be trademarks of their respective owners. Technology Evaluation Centers Inc. UNI062012