securevirtual Ltd IaaS: Cloud Server Hosting

securevirtual Ltd IaaS: Cloud Server Hosting SERVICE DEFINITION DOCUMENT G-Cloud 7 Catalogue Prepared for: G-Cloud Prepared by: securevirtual Date of issue: 6 th October 2015 Reference: - Status: Release Version: 1.0

Contents Contents... 2 1 Introduction and background to sv... 4 2 Cloud Hosted Servers - Service Summary... 4 2.1 SVi Platform... 5 2.2 Highly resilient dual data centre infrastructure with 99.5% to 100% uptime SLA. 5 2.3 Physical security and resilience... 6 2.4 Data protected against loss and corruption... 6 2.5 Enterprise class security... 6 2.6 Scalable and future proof... 6 2.7 Advanced monitoring and response services... 6 2.8 Best in class, personalised support and consultancy... 7 2.9 Low set-up expenditure with predictable monthly costs... 7 2.10 Dual Data Centre Example Illustration... 8 2.11 Hosted Cloud Servers Summary Key Features... 9 2.12 Hosted Cloud Servers Summary Key Benefits... 9 3 Information Assurance... 9 4 Backup/ Restore and Disaster Recovery... 9 5 On boarding and Off boarding processes... 10 5.1 On-Boarding... 10 5.2 Off-boarding... 10 6 Pricing... 10 6.1 Minimum Order Value... 10 6.2 Minimum Contract Term... 10 6.3 Cloud Server Hosting Resource Pool Model Pricing... 10 6.3.1 Cloud Hosted Servers... 10 6.3.2 Storage... 10 6.3.3 Network Components... 11 6.3.4 Monitoring... 11 6.3.5 Server and Resources Pricing Discounts... 11 6.3.6 Setup Costs... 11 6.3.7 Software Licensing... 11 6.3.8 Connectivity... 11 6.4 Cloud Consultancy Price List... 12 6.4.1 Consultancy Day Rate Pricing... 12 6.5 Pre-Purchased On Demand Consultancy Services... 12 6.5.1 Time of Day Cost Multipliers... 12 6.5.2 Payment... 13 6.5.3 Response times... 13 6.5.4 SFIA Level 4 to 7 consultants... 13 6.6 Pricing Discounts... 13 6.6.1 Term Discounts... 13 6.6.2 Consultancy Day Rate Volume Discounts... 13 6.6.3 Other Discounts... 13 6.7 Trial Accounts... 14 7 Service Management... 14 8 Service Constraints... 14 8.1 Support... 14 8.2 Maintenance... 14 9 Service Levels... 15 9.1 Standard service levels... 15 9.2 Compensation model... 15 10 Training... 15 11 Ordering and invoicing process... 15 11.1 Order Process... 15 11.2 Invoicing... 15 12 Termination process... 15 13 Technical requirements... 16 14 Customer Responsibilities... 16 IaaS - Cloud Server Hosting Service Definition v1.0 Page 2 of 16

15 Other services we offer on G-Cloud... 16 16 Get in touch... 16 IaaS - Cloud Server Hosting Service Definition v1.0 Page 3 of 16

1 Introduction and background to sv securevirtual is an established privately owned business with many years experience in providing Cloud Services to customers. We develop long lasting partnership relationships with our customers and deliver managed IaaS cloud solutions, business critical application hosting and consultancy services. In addition, securevirtual are a RIPE registered ISP and can provide a range of connectivity services to our Infrastructure platform if this is a requirement. SecureVirtual (sv) delivers cloud-based Infrastructure services on our own platform using the latest technologies from industry partners such as Microsoft, VMware, Dell & Cisco. sv brings the experience of delivering our own solutions and services to customers looking to migrate to the cloud from their legacy on premises solutions. 2 Cloud Hosted Servers - Service Summary The securevirtual Infrastructure platform is called SVi, and operates across multiple UK based data centres. It is designed to be fully scalable and resilient. In addition, as an ISP, securevirtual ensure that there are no carrier dependencies or limitations in respect to platform connectivity, which is one of the most important features of any cloud service. sv Hosted Virtual Servers are available on shared infrastructure as standard, or dedicated host infrastructure if required (subject to additional fees and consultation). Our resilient and scalable svi platform offers customers a secure and safe way to operate business critical applications, or run their entire business using a discrete network. IaaS - Cloud Server Hosting Service Definition v1.0 Page 4 of 16

2.1 SVi Platform The SVi platform as shown in outline below, offers customers a fully resilient, scalable and secure platform to host their business critical applications and business services (servers, hosted desktops, backups, etc). There are multiple layers of resilience at every level of the architectural design. In particular, the connectivity the backbone of any good cloud platform is not reliant on any one or even two carriers to provide continuation of service. 2.2 Highly resilient dual data centre infrastructure with 99.5% to 100% uptime SLA No single point of failure and 100% uptime SLA for dual data centre infrastructure services Each data centre is Tier 3 or higher with no single point of failure Dual data centre services can handle complete loss of one data centre Both data centres are completely independent from each other in all aspects, including power and connectivity. sv is set up as an ISP with multiple independent Internet connections at each data centre. Active/active BGP across both data centres gives uninterrupted Internet access to public IP addresses, even on complete loss of a data centre Multi data centre distributed firewall cluster provides uninterrupted service, even on complete loss of a data centre Virtualised servers are automatically restarted on alternative hardware in the event of physical server failure, or at the second data centre N+1 or greater redundancy of all network, server and storage hardware components IaaS - Cloud Server Hosting Service Definition v1.0 Page 5 of 16

2.3 Physical security and resilience Generator back-up with 24 hours of in site fuel at full load N+1 minimum UPS conditioned clean power Diverse mains power supplies with A+B feeds VESDA Smoke detection system State-of-the-art fire detection and suppression system 24-Hour CCTV monitoring throughout + 24 hour on site security staff Sophisticated alarm systems Security card and PIN access system to all zones Biometric or photo ID identification of all persons entering data centres Leak detection Cooling via N+1 minimum AC 2.4 Data protected against loss and corruption All data stored on enterprise class storage devices with fully redundant hot-swap components Option to have data continuously replicated to second data centre giving 5 minute RPO in the case of sudden loss of the primary data centre. Option to snapshot servers and data to allow roll-back to point in time Option to back up data to the opposite data centre with retention policies 2.5 Enterprise class security Data is protected within a central secure multi data centre environment in ISO 27001 certified Tier 3 or higher data centres. Regular DR and vulnerability tests are performed. Multiple levels of anti-virus and threat protection, with automatic signature updates All data protected from unauthorised access from the Internet by an enterprise class firewall cluster Strict ISO27001 information security management protocols are followed by securevirtual 2.6 Scalable and future proof Fully managed infrastructure which can be scaled up quickly and easily as you grow securevirtual architecture is based on a scale-out model (add extra resources in parallel) rather than a scale-up model (replace each resource with a bigger one when capacity is reached), meaning there is no theoretical limit on scalability and no sudden upgrade cost to move past a specific size of resource usage Resources can be increased or added on a temporary basis to handle demand fluctuations and projects Frees client staff from infrastructure maintenance to focus on strategic use of IT for business productivity and innovation Infrastructure is updated and enhanced on an on-going basis, including regular hardware upgrades and refreshes to the latest technology Microsoft license rental option always gives access to the latest versions Virtualised infrastructure gives flexibility to change and adjust the solution on an on-gong basis as required 2.7 Advanced monitoring and response services Virtual servers include monitoring of performance, resource usage, and availability as standard Optional advanced and bespoke monitoring down to application specific responses and counters Alerts can be configured for exceeding thresholds or specific events, with option to set up pre-agreed responses and actions by securevirtual technical team on receiving monitoring alerts IaaS - Cloud Server Hosting Service Definition v1.0 Page 6 of 16

2.8 Best in class, personalised support and consultancy 24/7/365 monitoring and support from a dedicated Mini-Team Quarterly review of the solution to identify and propose areas of improvement Access to IT experts, from first-line up to Architect and IT Director level via our Consultancy-on-demand system 2.9 Low set-up expenditure with predictable monthly costs Services are charged on a per-unit-per-month basis IaaS - Cloud Server Hosting Service Definition v1.0 Page 7 of 16

2.10 Dual Data Centre Example Illustration The below diagram shows an example of the SVi platform as if it were in use for an IaaS project. sv can provide tailored diagrams for customers (from our consultancy services) to provide them with an overview of their platform architecture should this be a requirement. IaaS - Cloud Server Hosting Service Definition v1.0 Page 8 of 16

2.11 Hosted Cloud Servers Summary Key Features Up to 100% uptime SLA for dual datacentre infrastructure services Minimum Tier3, 27001 certified datacentres, no single point of failure Virtualised servers are automatically restarted on hot standby hardware Enterprise class security systems, physical security and resilience Multiple anti-virus and threat protection systems, automatic signature updates Fully managed infrastructure - scalable and future proof Resources can flexibly controlled, to handle demand fluctuations and projects Microsoft license rental option always gives access to the latest versions Server monitoring & alerting: performance, resource usage, availability - as standard Optional advanced, even bespoke monitoring down to application specifics 24/7/365 monitoring and support from a dedicated Mini-Team Disaster recovery - full range of options available. Regular central infrastructure upgrade cycle at no additional costs to the business. 2.12 Hosted Cloud Servers Summary Key Benefits Customer data is protected against loss and corruption Location agnostic - access wherever there is an internet connection. Reduce expenditure on hardware. Extend hardware refresh cycles. Increased security by centralising control and limiting access. Minimal capex requirements. Reduce Carbon Footprint using less power by harnessing Cloud platforms Reduce risks of IT hardware failure Reduce risks to loss of work & increase employee productivity Improve planning and managing budgets with predictable monthly costs Increase time for IT staff to concentrate on higher value projects than Infrastructure support. Improve IT staff retention - working on higher value, increased learning projects. Increased reliability, backed up by 100% infrastructure uptime SLA. Support available up to 24/7/365 long after office staff go home. 3 Information Assurance Any customer using sv IaaS services can be assured that: Data will only be stored only in UK datacentres, sv Datacentres comply to ISO27001 levels or higher, sv host infrastructure is wholly owned and managed by sv. 4 Backup/ Restore and Disaster Recovery As standard, each server (VM) is backed up nightly, to a different data centre to the primary host location. In the event there is a loss of the primary data centre, a server could be restored to the secondary providing the customer has purchased sufficient standby compute power and storage to restore to (or has alternative arrangement as a backup centre to restore to). There are many scenarios for a customer wanting to invoke a DR situation and sv does not intend to list all of these. sv prefer to work with the customer to work out their requirements for DR, including any RTO and RPO requirements and then work with the customer to formulate a solution, since almost any eventuality and solution is achievable. IaaS - Cloud Server Hosting Service Definition v1.0 Page 9 of 16

5 On boarding and Off boarding processes 5.1 On-Boarding On receipt of a G-Cloud Order Form, securevirtual will assign a number of individuals from the following business functions to make sure the set-up process is smooth and hassle free: Account Management: to set up the account and contact details in the system, act as an escalation point and commercial interface, assist with invoicing and queries relating to commercial documentation. Technical Project Delivery: assign a specific team member or members (depending on size of deployment) to gather information on the users, setup the accounts, and provide any training which may be required, including any initial testing (UAT) before rolling out to the rest of the users. 5.2 Off-boarding Upon termination, the customer and sv will engage to work out the best way of returning the customer with any data that may be stored on the hosted infrastructure. 6 Pricing Standard service pricing for servers, server resources, storage and additional support hours are shown below. 6.1 Minimum Order Value 1 Server 6.2 Minimum Contract Term 12 months 6.3 Cloud Server Hosting Resource Pool Model Pricing 6.3.1 Cloud Hosted Servers 6.3.2 Storage Pricing excludes Server Operating System licensing which should be provided by the client, or can be purchased from securevirtual at the prevailing software vendor rates. Service Description Cost Per Month Virtual Machine Monthly Standing Charge 97 Virtual Machine Cost per GB RAM 29 Virtual Machine Cost per 1 full vcpu 58 Service Description Cost Per Month GB of Transaction data storage (Tier1 Storage) 2.80 GB of Transaction log data storage (Tier1 Storage) 2.80 GB of OS data storage (Tier2 Storage) 1.40 GB of Application data storage (Tier2 Storage) 1.40 GB of Low IO data (Tier3 Storage) 0.70 GB of Offsite Server Image Backup data storage + bandwidth 1.40 GB of Replication of server to second datacentre - once nightly 0.50 (where server capacity has been reserved for DR purposes) GB of Archive data - dual data centre, non-mounted 0.84 IaaS - Cloud Server Hosting Service Definition v1.0 Page 10 of 16

6.3.3 Network Components 6.3.4 Monitoring Service Description Cost Per Month Mb Multi homed pipe to the Internet on a 100Mb circuit 55 Mb Firewalling of Internet traffic on HA firewall cluster 52 Mb VPN to office network on 100Mb circuit to Internet 76 Public IP addresses (IPV4) 10 Network Load Balancing (first two devices) 150 Network Load Balancing (each subsequent device) 50 Service Description Cost Per Month IP address ping + email notification (up to 3 email addresses) 5.00 Telnet login + email notification (up to 3 email addresses) 7.50 Web URL available + email notification (up to 3 email 10.00 addresses) Web page contains specific text + email notification (up to 3 20.00 email addresses) Web application log in + one action + email notification (up to 40.00 3 email addresses) If more email addresses are required for notification please advise and pricing can be adjusted to suit 6.3.5 Server and Resources Pricing Discounts For a 24 month contract, sv will apply a 10% discount to all prices. 6.3.6 Setup Costs As a rule of thumb, setup costs will usually be the equivalent of the first month s rental for an IaaS Solution. For a single server, setup costs will be charged at 1-2 days consultancy depending on the complexity of the setup requirements. In all cases sv would expect customer engagement to confirm a setup cost, which will be based on the Consultancy Price List as found in section 6.4. 6.3.7 Software Licensing Customers are responsible for ensuring they are license compliant. sv can provide server licensing for almost any operating system (Windows/Linux) or database (Microsoft SQL, MySQL, etc) on a per unit, per month basis at the prevailing vendor monthly licensing rental rates. (E.g. Microsoft GSPLA). These prices are not published by securevirtual so cannot be provided within this document, so please enquire for the latest pricing. 6.3.8 Connectivity In terms of access to cloud services, organisations will need to have reliable, redundant connections to their data and compute power. As an ISP, sv can offer all types of connectivity, including but not limited to: ADSL, Fibre Broadband (FTTC/FTTP), Fibre Ethernet Circuits, WiFi, and MPLS. sv can provide direct connections (bypassing the Internet) to our Infrastructure, offering greater security, better uptime, and more resilience (since the breakout to the Internet can take multiple routes using multiple carriers). sv offers a carrier agnostic approach to delivery of connectivity and are directly connected to most major UK network providers. IaaS - Cloud Server Hosting Service Definition v1.0 Page 11 of 16

6.4 Cloud Consultancy Price List Our IT consultancy service gives you access to a pool of IT specialists which can assist you in delivering your IT projects. For each project we will undertake a project analysis which will detail the time we recommend you will need at each SFIA level. 6.4.1 Consultancy Day Rate Pricing SFIA Level Strategy & architecture Business change Solution development & implementation Service management Procurement & management support Client Interface 1. Follow n/a n/a n/a n/a n/a n/a 2. Assist n/a n/a n/a n/a n/a n/a 3. Apply n/a n/a 547-930 547-930 n/a 547-930 4. Enable n/a 821-1395 821-1395 821-1395 821-1395 821-1395 5. Ensure/Advise 1094 1625 1094 1625 1094 1625 1094 1625 1094 1625 1094 1625 6. Initiate/Influence 1367-2325 1367-2325 1367-2325 1367-2325 1367-2325 1367-2325 7. Set Strategy/Inspire 1641-2790 1641-2790 1641-2790 1641-2790 1641-2790 1641-2790 All rates shown exclude VAT For more information on our consultancy services and specific project pricing please contact our commercial team. 6.5 Pre-Purchased On Demand Consultancy Services Customers using sv Cloud Server Hosting can purchase blocks of time. The price list below is based on SFIA Level 3 consultants allowing technical assistance on a reactive basis. This pre purchase method reserves availability with our consultancy team allowing for a fast response to your immediate technical problems without the need to organise purchase orders and wait for lead times. Block Credits Hours Cost per hour Cost per Credit Block Total Cost A 4 1 142 35.50 142 B 40 10 124 31.00 1,240 C 80 20 114 28.50 2,280 D 160 40 103 25.75 4,120 E 400 100 93 23.25 9,300 F 800 200 83 20.75 16,600 G 2000 500 78 19.50 39,000 H 4000 1000 73 18.25 73,000 Cost per hour based on Monday-Friday 08:00 17:30 6.5.1 Time of Day Cost Multipliers Consultancy blocks are broken down into credits which are each equivalent to 15 minutes of consultancy time. During working hours these are priced at 1 credit per 15 minutes, outside of working hours more than 1 credit will be used for each 15 minute slot. The number of credits per 15 minutes slot is listed in the table below: IaaS - Cloud Server Hosting Service Definition v1.0 Page 12 of 16

6.5.2 Payment Time Monday to Friday Weekends Public Holidays 08:00 17:30 1 1.5 2 17:30 00:00 1.5 2 2.5 00:00 08:00 2 2.5 3 There are two ways to pay for Consultancy blocks of time: 1) Blocks A-G can be purchased in full, in advance and do not expire. They can be called off when required. Then simply purchase an additional block when you run low on credits. 2) Blocks D-H can be paid for in monthly instalments, but when purchased in this way are time fixed within a 12 month period, meaning that any unused credits at the end of that period will expire. Each month will be invoiced for the higher of 1/12 of the total block cost, or the balance of the pro rata amount used to date, until the whole block s cost has been invoiced. IaaS Services customers cannot use the reactive consultancy or support without a prepurchased block. 6.5.3 Response times We aim to respond to a pre-purchased credits request as soon as possible 24 hours a day and guarantee a response within four hours between 9am and 5:30pm on working days. For those companies in need of shorter guaranteed response times, please contact us for a quotation. 6.5.4 SFIA Level 4 to 7 consultants If an existing customer of securevirtual has a project which needs technical expertise beyond SFIA level 4 consultants we can charge our other consultant levels out using the credit system by applying multipliers, detailed in the table below, instead of using the standard day rates to accommodate smaller/ad-hoc projects. There is no guaranteed availability for SFIA level 4 to 7 consultants. SFIA Job Role Rate Multipliers Level 4 Senior Developer / Senior Consultant 1.5 5 Systems Analyst / Project Manager 2 6 Architect 2.5 7 IT Director 3 Levels 4-7 only available Monday-Friday 09:00 17:30 unless pre-arranged Additional fees will apply to any out of hours working using the multipliers detailed in Section 6.5.1 6.6 Pricing Discounts 6.6.1 Term Discounts Standard discount for a 24 month agreement is 10% on services, and if customer takes a 2 year service supply agreement, sv will apply 10% to any pre-paid consultancy blocks. 6.6.2 Consultancy Day Rate Volume Discounts Volume discounts are applied as per the table in section 6.5. 6.6.3 Other Discounts sv will consider but will not be bound by requests for annual payment in advance for IaaS services. sv will consider applying a discretionary discount for such an arrangement if it is deemed of significant value to sv to do so e.g. because it reduces administrative overhead significantly through reduced invoicing, etc. IaaS - Cloud Server Hosting Service Definition v1.0 Page 13 of 16

6.7 Trial Accounts sv will offer trial servers for evaluation purposes, at no cost, for the first 30 days, sv reserve the right to limit the number of trial servers per customer. 7 Service Management An Account Manager will be assigned to each customer to look after the commercial aspects and relationship management ensuring that the customer always remains happy which is our no.1 service performance measurement. The account management team will arrange regular service review meetings or calls, to ensure continued service delivery which meets customer expectations. Service delivery and performance of sv services are measured and monitored by the business through various mechanisms to make sure that they are providing the level of service and performance as expected and against any defined deliverables. Meeting and exceeding customer expectations is core value of sv. 8 Service Constraints 8.1 Support Inclusive support for sv Cloud Hosted Servers is limited to the infrastructure support only. i.e. sv support the hardware element of the solution. Any user level support with respect to, but not limited to, the following types of requests can be provided for an additional Consultancy fee (using the pre-paid blocks as detailed in the Pricing Section): User help, e.g. with Microsoft Office functional use and settings (e.g. setting up rules and folders in Outlook). Helping with issues relating to printing Assisting users locked out because they have forgotten their credentials (or let them expire). Software and application support (application needs to be an approved one which sv can support). Integration issues between local LAN and WAN architecture and the hosted service 8.2 Maintenance sv hopes that there would never be a need for emergency maintenance but there will be a requirement for occasional planned maintenance. For any maintenance requirements, sv aim to provide a minimum 30 minute warning for emergency work, and 5-10 days notice for non-emergency planned maintenance (or by arrangement with specific customers, depending on the nature). IaaS - Cloud Server Hosting Service Definition v1.0 Page 14 of 16

9 Service Levels 9.1 Standard service levels 99.5% to 100% Infrastructure uptime availability (excluding maintenance) 4 hour response during UK working hours (0900-1700) UK based helpdesk with direct access to your infrastructure 9.2 Compensation model Should sv Infrastructure not meet agreed service levels, then the following will apply: % Monthly Uptime of Reimbursement rate a service (% of total monthly charge for the affected service) <100.0% 1 < 99.0% 5 < 97.5% 7.5 < 95.0% 10 < 92.5% 20 < 90.0% 30 10 Training Training will be provided as required by the nominated user or users where access is required to an sv control panel or any bespoke systems and processes. Functional training on the day to day use of servers and applications is excluded. 11 Ordering and invoicing process 11.1 Order Process Following receipt of a valid order, if Pre-Sales involvement has been required then there will be a handover between the relevant internal teams e.g. sales/technical presales team and the project delivery team. Once the order has been validated, the Technical Service Delivery team log it on our system with a unique reference and a project lead will be assigned. The project lead will then arrange a Kick-Off meeting with all key stakeholders to agree an outline programme of work as per the customer requirement. Any additional integration services with respect to customer systems and applications including any 3 rd party suppliers, for example, Hosted Exchange, will be negotiated separately from a consultancy perspective, at an additional cost. 11.2 Invoicing Invoicing will be as per sv standard terms or as agreed in the Order Form, however, general invoice policy at sv is for services to be paid for in advance of the month of service. 12 Termination process As per the terms of the G-Cloud 7 framework, call-off terms and sv terms (plus any additional agreed terms between client and sv). Standard notice is no less than 90 days before the initial period end date and 90 days thereafter. Upon termination, the customer and sv will engage to work out the best way of providing the customer with any data that may be stored on the hosted infrastructure. IaaS - Cloud Server Hosting Service Definition v1.0 Page 15 of 16

13 Technical requirements The technical requirements such as, but not limited to, minimum specifications of local machines, Internet and connectivity requirements, firewall port rules, etc, will need to be discussed with the client prior to order placement ideally, but can form part of the service delivery process but this may delay delivery if the customer requirements to operate the service are not in place pre-order. 14 Customer Responsibilities The customer will require an internet connection to access the services. Preferably, the connection to the internet should be a resilient (dual circuit, auto failover) solution. securevirtual are a RIPE registered ISP and can provide connectivity services to our Infrastructure platform if this is a requirement. The customer require an internal or 3 rd party appointed (if not sv) technical authority to ensure that the hosted servers can integrate with legacy and local systems. We would anticipate all requirements would be discussed and understood before any order placement. The customer is responsible for ensuring that their users of the service are compliant with any law, any sv fair use polies and software vendor licensing and service terms. 15 Other services we offer on G-Cloud IaaS: Cloud Desktop as a Service SCS: Cloud Consultancy Services 16 Get in touch Email: sales@securevirtual.com Call: 020 8099 1501 Web: www.securevirtual.com IaaS - Cloud Server Hosting Service Definition v1.0 Page 16 of 16