The Complete Enterprise Cloud Platform

• New hardware, top performance.

  Each Tier 3 data center Node is made up of best-in-class, enterprise-grade hardware.

• 70% max allocation to accommodate spikes.

  Each virtual machine host server is closely monitored to ensure that CPU and RAM never surpass 50-70% utilization to allow for enough headroom for spikes at peak traffic.

• High speed networking throughout.

  Network speed between application tiers will never be an issue as we deliver up to 10Gbps per vNIC, employ load balancers that deliver up to 1Gbps, and leverage firewalls that delivery up to 6Gbps.

• Low-latency, high-throughput storage.

  For all Tier 3 storage options, the I/O throughput will reach 6 Gbps, latency is less than 5ms, and storage performance has a maximum IOPS of 20,000.

• Every data center is audited regularly.

  Our global data centers are SSAE 16 audited and available for customer audits upon request.

• Data deletion on discarded drives.

  We protect your sensitive information through policies and procedures to wipe undamaged drives prior to discarding them.

• Automatic data replication only to in-country data centers.

  Data replication is a critical part of a working disaster recovery strategy, and we only ship data backups to data centers within the same country.

• Role-based system access.

  Users of the Tier 3 cloud are aligned with specific roles (e.g. Account Administrator, Server Administrator) that govern what they can do in the system, and more granular permissions can be added to individual server groups.

• System and user audit logs.

  All activities against cloud servers are logged and stored indefinitely. This ensures that you can quickly identify who has performed what actions in the cloud.

• Physical Security

  Tier 3 data centers enforce strict controls to secure access to the physical hardware. This includes fully-secured server cages and 24/7 monitoring.

• Separation of physical assets.

  Servers in the Tier 3 cloud are assigned to specific roles (e.g. terminal access, backup storage) in order to reduce the attack surface and require each server to run with the fewest possible OS services and open ports. Customers have no access to physical hardware or hypervisor layer.

• Zone-based firewalls.

  Creates customer-specific VLANs that don’t permit traffic to flow between networks (except if specifically authorized by the account holder).

• VPN-only access to servers.

  By default, no Tier 3 server gets connected to the Internet, unless public ports are explicitly opened by the customer. Each customer uses a certificate-based VPN connection to securely log into cloud servers.

• Role-based system access.

  Users are assigned area roles (such as “account” or “server”), resource type permissions (e.g. “blueprints”), and permissions to individual servers and groups. This lets customers assign users a minimal, but functional, set of permissions.

• Robust network security controls.

  Intrusion Detection Systems (IDS) and Intrusion Detection and Prevention (IDP) are provided through our enterprise-class Juniper SRX firewall hardware. These products protect customer environments from harm using detection and prevention features (also called “screens”). These screens focus on specific - and common – types of attack traffic. For a complete list of screens deployed, visit this list from Juniper.net. In very unique and specific cases, deep content inspection services are available upon request. Read this KB article for more details on our capabilities in this area.

Network Architecture

The network is engineered to be highly available, secure, and fast.

• Multi-backbone peering

  Our ISP-neutral Internet connection provides high availability in the case of downtime for a given provider.

• Carrier-class Juniper SRX hardware

  Tier 3 data centers rely on best-in-class, fully-redundant hardware for firewalls and switches on the perimeter as well as between customers/subnets. Interconnects within the data center use 100% 10GB networking.

• Site-to-site VPN

  Data centers are connected through a site-to-site VPN that encrypts the data as it passes among any of our 10 global locations.

• Secure and segregated networks

  Each customer gets their own VLAN(s) and an unlimited number of private subnets to further define security zones.

Customer Network Integration

The Tier 3 cloud should be a logical and physical extension of your own data center. Multiple options exist for connecting on-premises assets to the Tier 3 cloud.

• Site to Site VPN

  Set up a secure IPSec point-to-point VPN tunnels or MPLS VPN tunnels between networks.

• Client VPN

  Connect to the Tier 3 cloud from a client machine through software like OpenVPN.

• Intra Data Center Direct Connect

  Using a Tier 3 co-location partner for your own data center? Connect to Tier 3 assets using Single Mode Fiber (SMF, 1310nm) 1Gbps (1000base-LX) or 10Gbps (10G-LR) fiber. Also use 1 Gbps copper if the cross connect is less than 100m in length.

Traffic Management

The network contains robust network traffic management technology as well as self-service firewall policies.

• Built in IDP/IDS

  The Juniper SRX firewalls deployed in our global data centers provide intrusion detection services and protection by screening incoming traffic for potential attacks. A complete list of screens deployed is listed on Juniper.net. Read this KB article for more details.

• Pervasive Load Balancing

  Web application load balancing with SSL offloading uses Citrix Netscaler.

Sub-Accounts

Account holders may create sub-accounts which can be billed and managed separately from the parent. Blueprints are designed with a setting to allow “private shared” privacy which means that sub-accounts can see the Blueprints of a parent account.

Billing System

View detailed billing history for each account and sub-account. Within each invoice, see charges for Groups, Servers, storage, VPN, network bandwidth, external IP addresses, and more.

Single Sign-On (SSO)

Single Sign-On (SSO) is provided between a customer’s Identity Provider (IdP) and the Tier 3 Control Portal. Tier 3 supports service-provider-initiated SSO via SAML authentication. Customers access a specific URL that initiates a redirect to the customer’s IdP. The IdP authenticates the user and securely sends the authentication details to the Control Portal where the user is logged in without providing Tier 3-specific credentials.

Group Monitoring

Create and customize monitors for CPU, Bandwidth, Disk, Memory, Drive, and PING. Additional monitors supported by contacting the Tier 3 NOC.

Group Power Actions

Power on, power off, reboot, pause, reset, and shutdown any or all servers in a group with a single command.

Group Software & Script Execution

Install a software package from the public or private library, or execute a script against the group’s servers.

Group Capacity and Server Defaults

Set the operating system, memory, CPU, and storage preference for any new servers in a group. Configure the maximum capacity that can be provisioned for a group.

Role-Based Access Policies

Accounts may contain a variety of users and the Tier 3 cloud platform encourages segmentation based on necessary permissions. All activities within the platform are checked against the active user’s area (i.e. “Server Administrator” or “Account Administrator”), resource type permissions (e.g. “Blueprints”, “Server”, “Cloud Storage”, “Group”, “Invoices”), and individual resource permissions. Only if the aggregate of their permissions allows access to a particular action will the platform allow it.

Robust Monitoring & Reporting

Define or inherit server monitors of interest and thresholds for alert. Default monitors include PING, CPU, memory, disk storage, secondary drive storage, and bandwidth. Include additional monitors by contacting the Tier 3 NOC. Monitoring is also provided through a partnership with thought-leader New Relic. Web Fabric users get a free New Relic account for web application monitoring, and Tier 3 infrastructure users can install New Relic agents on servers and apply their licenses to the cloud environment.

Access and Activity Logs Kept Forever

Platform records user access and activities in log files. All actions performed through the Control Portal – such as server provisioning, server reboot, blueprint deployment – are auditable.

Regular Patching

Tier 3 customers who use Microsoft Windows see automatic server patching at least twice per month. Customers can request specific release windows by contacting the Tier 3 NOC.

Run Repeatable Tasks on a Schedule

Scheduled tasks let users choose a time, frequency, and expiration date for a power command (“Pause”, “Power On”, “Reboot”, “Shutdown”) against a server or group of servers.

Self-service Networking

Create additional VLANs and define firewall rules. Firewall rules are created between VLANs and comprise a source IP address range, destination IP address range, and a list of ports to open.

• Provision and Administer Servers

  The API includes all of the operations necessary to create, modify, delete, snapshot, archive, restore, and issue power commands against a server.

• Manage Server Groups

  Create, archive, delete, and issue power commands against groups of servers.

• Deploy Complex Environments

  Use the API to retrieve and publish blueprints that make up self-contained server environments.

• Read Network Details and Manage Public IP Addresses

  Get the details of a network including the gateway, network mask, list of IP addresses and host data center. Add or release a public IP.

• Manage your Tier 3 Account(s) and Users

  Create, update, suspend, and delete accounts in the Tier 3 cloud platform. Also create, update, suspend, and delete individual users within an account.

• Review Detailed Billing Information

  Lookup current server/group charges, estimated monthly charges, past invoices, and more in this easy-to-use billing API.