/ IT is a physical sport.
Four layers. One supported standard.
Thirty days. One site. A stocked on-site badge-access smart locker, installed by Surya, at no charge. If it does not earn its place, we take it back. If it does, the site comes onto one IT standard: the Microsoft platform, the devices and day to day operations, run by Surya 24 hours a day, every day of the year.
Built for organizations of 15 to 250 people whose work happens in a building - clinics, care groups and manufacturing plants - with more than one site and no large internal IT department.
/ Layer 01 - Platform
Microsoft 365 and Azure, configured to the Surya standard and kept there.
Identity, sign-in, secure access, device management, security baseline and updates run to one supported configuration across the organization. The customer owns the tenant and the licenses. Surya operates it.
- Identity and sign-in operated to the standard
- Secure access and conditional policy
- Device management and enrollment
- Security baseline and update handling
- The customer owns the tenant and the licenses
/ Layer 02 - AI foundation
The same platform prepared for Microsoft Copilot Suite.
Identity, data governance, licensing assignment and device compliance are brought to the standard so the organization can adopt Copilot and Copilot Cowork on a controlled foundation.
- Identity ready for Copilot and Copilot Cowork
- Data governance and access boundaries
- Licensing assignment on your Microsoft agreement
- Device compliance as a precondition
/ Layer 03 - Operations
24/7/365 support for end users and for the platform.
L1 and L2 support, escalation with named owners and change control on the standard. A person can reach Surya at any hour, and the platform is monitored and operated at any hour.
- L1 everyday help and L2 technical troubleshooting
- 24/7/365 coverage for end users and the platform
- Escalation with named owners for vendor and carrier issues
- Change control on the supported standard
Support runs 24 hours a day, every day of the year, for end users and for the platform. Vendor and carrier issues follow the escalation path with named owners.
/ Layer 04 - Physical
The locker at every site, plus device flows and stocking.
An on-site badge-access smart locker goes in at every site on the standard, with a controlled swap process and managed replenishment. One locker per site is included in the price; additional lockers at the same site are quoted.
An on-site badge-access smart locker goes in at every site on the standard, and one locker per site is included in the price. Around it run preparation, deployment, new hire readiness, replacement, recovery, repair routing, certified erasure, retirement and serial-level custody, with backup inventory at the Surya RTP distribution center.
- One on-site badge-access smart locker per site, included
- Preparation, deployment and new hire readiness
- Replacement, recovery and repair routing
- Certified erasure to NIST 800-88 and retirement
- Serial-level chain of custody
- Backup inventory at the Surya RTP distribution center
Surya provides, installs, owns and operates the locker. The customer purchases and owns the replacement devices inside it. Backup inventory sits at the Surya RTP distribution center.
A spare device does not resolve an application outage, an identity outage, a power loss or every network fault. Local replacement covers device failure, not every kind of interruption.
Obviously dead: straight to the locker. Might come back: a 30-minute restoration window, then the locker.
/ Site modules
The site modules under the physical layer.
Clinics and care groups
OpenFront desk
A supported setup for reception and everyday administrative work.
Specific peripherals and application connections are qualified.
Exam room
Standardized computing for clinicians at the point of care.
EHR workflow and access requirements are confirmed during scoping.
Check-in
Approved computing and peripherals for the check-in workflow.
Surya does not supply a patient intake application.
Imaging workstation
The computing environment supporting an approved imaging workflow.
Vendor compatibility and recovery requirements must be qualified. This is not the clinical imaging device itself.
Printing and labeling
Supported printers and defined configurations for agreed clinic workflows.
Specialty workflows and application dependencies require qualification.
Clinic connectivity
A defined clinic network configuration and agreed support scope.
Carriers, network appliances and failover configurations are scoped case by case.
Manufacturing plants
OpenOffice and engineering workstations
Standardized computing for administrative and engineering work at the plant.
Engineering application licensing and requirements are qualified.
Floor and line PCs
Supported configurations for the computers that sit on the floor and beside the line.
Enclosures and environmental requirements are confirmed per location.
HMI and PLC support layer
The computing and network layer that supports HMI and PLC systems.
Surya covers the computing that supports production equipment, not the machine.
Label printing
Supported label printers and defined configurations for plant workflows.
Specialty label workflows and application dependencies require qualification.
Plant connectivity
A defined plant network configuration and agreed support scope.
Carriers, network appliances and failover configurations are scoped case by case.
Badge and time clock
Supported badge readers and time clock endpoints on standard configurations.
Access control and payroll applications stay with their owners.
Final module selection, supported integrations and service scope are confirmed before deployment.
/ Surya Critical
Surya Critical.
Surya Critical covers the specialized devices that stop production, revenue or care when they fail. Coverage is quoted separately, by device class, after the critical device audit.
- Firewalls
- Plant networks
- On-prem servers
- PLC and HMI
- Imaging capture workstations
- Label and wristband printers
- Badge readers
- Nurse call gateways
We work up to the port, not past it.
Surya covers the technology that supports the clinical device: the workstation, printer, network connection and supported computing layer. The clinical device itself remains under the authority of the healthcare organization and its medical-equipment vendor unless separately qualified and contracted.
Surya covers the computing that supports production equipment, not the machine. OT security software is on the customer's paper - Nozomi, Claroty or the customer's choosing - and can be deployed and folded into the runbooks.
/ Device flows
Device flows and stocking, included.
/ 01
Preparation and deployment
Standardized setups are prepared at the distribution center and installed at the site.
/ 02
New hire readiness
Equipment for new and moving employees is prepared ahead of the start date.
/ 03
Replacement
A qualified failure follows a controlled replacement process from the locker.
/ 04
Recovery and repair routing
Failed, retired and departed devices come back through a documented path.
/ 05
Retirement
Certified erasure to NIST 800-88 where applicable, then approved disposition, recorded by serial number.
/ Uptime
Reduce the time site technology stays unavailable.
Uptime comes from a known configuration, support a person can reach at any hour, repeatable device flows and a prepared replacement close to the site.
/ 01
A known configuration
Troubleshooting starts from a setup Surya defined and deployed, not from a local improvisation.
/ 02
24/7/365 support
L1 and L2 for end users and the platform, at any hour, every day of the year.
/ 03
Escalation with named owners
Vendor and carrier issues follow an agreed route instead of stalling at the site.
/ 04
Device flows
Preparation, deployment, recovery, repair routing and retirement run as standing workflows.
/ 05
Local replacement
For qualified devices and locations, a prepared replacement sits in the locker with managed replenishment.
/ Security and compliance in operation
Make the supported standard easier to prove and protect.
The standard turns safeguards into operating practice. Because Surya defines the configurations it supports, the same controls, records and handling steps apply at every site in scope.
Configuration baseline
Supported device configurations and the agreed security baseline are applied when a module enters service, not after the fact.
Identity and access
Identity, sign-in and secure access are operated to the standard in the tenant the customer owns. Access to Surya facilities is controlled and logged.
Endpoint protection and updates
Endpoint protection and update handling for supported devices are operated within the standard.
Support records
Requests, troubleshooting and changes inside the supported environment produce an operational record available for review.
Device custody
Devices in Surya's custody are tracked by serial number, and every handoff, return and swap is documented.
Media sanitization
Drives are erased to NIST 800-88 where erasure applies, with a certificate per device, before approved disposition.
Vendor responsibilities
A business associate agreement is available. Clinical application and equipment vendors retain their own responsibilities.
Incident escalation
Issues needing a vendor, a physical action or your approval follow an agreed escalation path with named owners.
HIPAA compliance remains an organizational responsibility. Surya provides scoped technology controls, operational practices and evidence that support your program.
Handling for manufacturing customers is aligned to NIST 800-171. Compliance remains an organizational responsibility.
/ Who owns what
Surya operates the standard. You keep the decisions.
| Layer | Surya operates | Your organization keeps |
|---|---|---|
| Platform | Microsoft 365 and Azure operated to the standard: identity, access, device management, security baseline, updates | Tenant and license ownership, business approvals |
| AI foundation | Identity, data governance, licensing assignment and device compliance prepared for Copilot Suite | Copilot Suite licensing on your Microsoft agreement, adoption decisions |
| Operations | 24/7/365 L1 and L2 for people and the platform, escalation with named owners, change control | Approval for changes touching systems outside the standard |
| Physical | Preparation, deployment, replacement, recovery, repair routing, erasure, retirement and custody | Purchase and ownership of the devices, including the replacements in the locker |
| Outside the standard | Named coordination only | Clinical applications, production systems, and medical and OT equipment |
Every responsibility has a single named owner. Surya does not commit to security or uptime for systems it does not operate.
Systems outside the standard are still possible. Clinical applications, production systems, and medical and OT equipment stay with the team or vendor that owns them today.
Surya defines and operates the supported standard. Clinical and production decisions, business approvals and data authority stay with your organization.
/ Trust and custody
One published price.
$100 per person per month. $5,000 minimum. One locker per site included. Additional lockers and specialized devices quoted separately. One on-site badge-access smart locker per site is included. Additional lockers at a site are quoted, and Surya Critical devices are quoted separately.