Surya Agent Platform →
The Microsoft agent environment in your tenant: identity, approved data, build and live environments, release and cost controls. Your team builds the agents.
/ The Surya product family
One stack. One operating standard.
Surya builds and operates the supported foundation that people and AI agents work on at physical sites: devices and access, site networks and workloads, and prepared recovery. Each product is a complete capability with its own included behaviour, dependencies and acceptance tests. Your team owns its business applications, workflows and decisions.
/ The stack
One stack.
Your agentsBuilt and owned by your team.
Buy any layer on its own. Each one works with what you already run.
Standby, Endpoint and Fabric together are Surya Foundation →/ The Surya product family
Products and components.
01
Surya Standby →
Prepared equipment and physical recovery.
Equipment and recovery readiness keep physical work moving through failures.
Replacements prepared to your agreed configuration and held at the site, with authorized issuance, returns and replenishment recorded against the serial number.
Microsolutions - bought on their own
Smart lockerswith LocknCharge - Locker hardware, software and setup, run by your team.Standby can also use an existing secure room or cage. A smart locker is not required.
02
Surya Endpoint →
Productive people, ready devices and controlled access.
People use the right devices, accounts and access as they work with AI.
The supported workstation environment: identity, provisioning, protection, protected-data recovery, and access through every hire, role change and departure.
03
Surya Fabric →
Connected, protected and recoverable sites.
The supported networks and workloads your operations depend on stay connected and protected.
The Surya-supplied site-network system for the agreed sites, installed and tested before the site runs on it, then operated with a tested recovery procedure.
Microsolutions - bought on their own
OT and CPS securitywith Claroty - Scoped licensing, deployment and handover.Surya Control operates the Endpoint workstation service and Fabric. Standby provides prepared recovery inside both.
Surya FoundationThe shared operating foundation: Standby, Endpoint and Fabric together, under one agreement.An optional combined purchase for organizations ready for all three, so more people and sites can run on one standard. Not required to start, or to use AI.See Foundation →Across the family: evidence and complianceAutomated Vanta reporting for the products you purchase. Vanta licensing and setup can also be bought on its own.
Vanta reportingVanta licensing and setup →/ The combined purchase
Surya Foundation is Standby, Endpoint and Fabric together.
Surya Foundation operates Standby, Endpoint and Fabric together under one operating standard, with Surya Control operating the supported state and the security capabilities included in the purchased scope. It is the shared operating foundation beneath your people and agents, run by AI agents, people on shift 24/7 and site supply chains from RTP, so additional teams and sites can join on the same standard. It is optional: each product can be bought on its own, and none is required to use AI.
Surya Control is not sold separately. It is the operating layer included with the Endpoint workstation service and with Fabric, and it is what makes the standard hold. Standby on its own does not include it. Room deployment and management have their own scope; workstation and site-network services are purchased separately. Surya Agent Platform, the Microsoft foundation for customer-built agents, is the top layer of the stack and is not part of Foundation.
- Resilience
- Keep equipment, people and site networks recoverable under one operating standard.
- Security
- Protect equipment custody, company access and site connections together.
Standby, Endpoint and Fabric each support automated reporting to Vanta, so Foundation reports across all three products for the agreed scope. Surya Foundation →
/ Inside each product
Included behaviour, dependencies and acceptance.
/ Purchasable product - Surya Standby
Protect revenue and customer commitments by keeping your sites working when critical equipment fails.
Prepared replacement coverage for the equipment written into your scope, whatever class it is. Surya captures your existing configuration for each agreed role or equipment type and prepares replacements to that agreed configuration through its supply chain. Where workstations are in scope they are held in a branded Surya Smart Locker at the site; qualified network and site equipment such as switches, firewalls, access points and edge appliances is held in an existing secure onsite room or cage with the custody tracking specified for the agreed configuration, including RFID where confirmed, staged on site or shipped from the Surya RTP Distribution Center, with authorized issuance, returns, readiness checks and replenishment, so a working replacement is ready before it is needed.
Included behaviour
- Your existing laptop image and configuration captured per employee persona or role, and replacements prepared to that agreed configuration
- The same principle for qualified switches, firewalls and other agreed critical equipment: existing configuration captured, ready replacements prepared
- Workstations and peripherals held in a branded Surya Smart Locker at the site, accessed with your existing corporate identity
- Qualified network and site equipment held in an existing secure onsite room or cage with the custody tracking specified for the agreed configuration, including RFID where confirmed, retrieved by designated staff
- Equipment outside the locker recorded at serial level, with RFID and labelling where specified in the qualified, agreed configuration
- Authorized issuance recorded against the serial number
- Returns, repair routing, certified erasure to NIST 800-88 and retirement
- Readiness checks and replenishment
- A swap runbook the person at the site follows
- Resilience
- Keep equipment failures from becoming prolonged business interruptions.
- Security
- Keep covered equipment in authorized hands, with custody documented through issue, return, and disposition.
Standby supports automated reporting to Vanta for its agreed equipment and handling scope.
The evidence listed illustrates the product's contribution; the configured reporting scope determines which records are transmitted automatically. Vanta licensing, connection scope, reporting details and any third-party assessment fees are confirmed in the commercial scope.
- Required dependencies
- The customer purchases and owns the devices, including the prepared replacements. Where workstations are in scope, Surya provides, installs, owns and operates the locker; where the scope is network equipment, Surya uses an existing secure onsite room or cage with the custody tracking specified for the agreed configuration, including RFID where confirmed. The agreed configurations to reproduce, the identity integration, access permissions and approvals the replacement workflow needs, and installation, field response and replenishment coverage are confirmed for the proposed sites during qualification.
- Explicit exclusions
- Supported equipment and published logistics terms, not unlimited procurement. A prepared replacement covers device failure, not an application outage, an identity outage, a power loss or every network fault. Standby prepares, stocks, swaps and tracks the replacement equipment. Ongoing standardization and administration of your production endpoint and network estate is Surya Endpoint and Surya Fabric, and Surya Control is not included with Standby on its own.
- Acceptance test
- A person at the site obtains a working replacement, prepared to the agreed configuration, through the runbook and returns to the defined working state, with the swap recorded.
/ Purchasable product - Surya Endpoint
Keep your people productive with ready devices, secure access and meeting rooms that work, and keep control of company access and data through every hire, role change, and departure.
Supported identity, endpoint provisioning, Intune configuration, controls, approved applications and protected-data recovery. Autopilot, Intune and Graph are Microsoft functionality; the product is the engineered combination and its verified operation.
Included behaviour
- Identity controls, authentication enrollment and a documented recovery path
- Endpoint provisioning and Intune configuration on the released baseline
- Endpoint protection, encryption key custody and supported updates
- Approved application deployment and supported peripherals
- Defined protected data sets, backup operation and tested restore
- Joiner, mover and leaver handling from the standard input and role catalogue
- Resilience
- Keep people productive through hiring, device failure, and recovery.
- Security
- Protect company access and data as people join, change roles, and leave.
Endpoint supports automated reporting to Vanta for its agreed endpoint and identity scope.
The evidence listed illustrates the product's contribution; the configured reporting scope determines which records are transmitted automatically. Vanta licensing, connection scope, reporting details and any third-party assessment fees are confirmed in the commercial scope.
- Required dependencies
- Supported licenses for each released profile, a supported tenant and identity model, and named access and data owners.
- Explicit exclusions
- For workstations, a defined Microsoft foundation, not every application or every Microsoft feature; conference rooms follow their own Neat room standard. No line-of-business software engineering, business-process redesign or unlimited training. A replacement device is not a backup, and local-only data outside the protected locations is not promised to reappear.
- Acceptance test
- Provision a new supported device; restore an authorized user to the defined working state on a replacement; test account recovery and the denial of an unauthorized recovery attempt; verify approved controls; execute a safe data restore; validate joiner and leaver handling; run a controlled containment exercise.
/ Purchasable product - Surya Fabric
Keep every location operating securely and at full speed, with network capacity and resilience that support your growth.
One defined system for the agreed sites, from equipment through ongoing operation: Surya-supplied edge, switching, Wi-Fi, segmentation and connectivity on one released profile, installed and tested before the site runs on it, then maintained with a tested recovery procedure.
Included behaviour
- Surya-supplied edge, switching and wireless equipment on the standard configuration
- Installation and pre-operation testing of the supplied system
- Segmentation and allowed paths from the shared specification
- Connectivity, with a tested alternate path where the selected profile includes one
- Network inventory, firmware lifecycle and configuration protection
- Replacement of a supported component without the original designer
- Resilience
- Keep locations connected and make network recovery predictable.
- Security
- Control which systems can connect and limit the spread of threats across the site.
Fabric supports automated reporting to Vanta for its agreed site-network scope.
The evidence listed illustrates the product's contribution; the configured reporting scope determines which records are transmitted automatically. Vanta licensing, connection scope, reporting details and any third-party assessment fees are confirmed in the commercial scope.
- Required dependencies
- Site readiness, structured cabling, declared power dependencies, and the customer's carrier accounts.
- Explicit exclusions
- The supported site-network scope written into your agreement, not every system that connects to it. A single connection is not sold as redundant. Site readiness, structured cabling, building power, carrier accounts and carrier repair, and production machinery stay outside Surya's control. Equipment ownership and commercial terms are set out in the written proposal and agreement.
- Acceptance test
- Inventory matches the installation; required business paths succeed; prohibited cross-segment access is denied; the approved configuration can be restored; losing each included path produces the declared result.
/ Operates Endpoint and Fabric - Surya Control
The system that maintains the system.
Customer-dedicated operations compute in the Surya RTP Distribution Center, with tested automated actions, continuous configuration verification and an explicit exception path.
Included behaviour
- Continuous evaluation of the supported operating state
- Allowlisted, tested routine operations under a standing policy
- Explicit authorization for privilege grants and other high-impact changes
- An exception path when a condition is unknown or unsafe
- Protected evidence for every action and access
Routine operations run from an allowlisted, tested catalogue under a standing policy, so an engineer does not approve every ordinary execution. Privilege grants, destructive changes and broad policy changes require explicit authorization. An unknown or unsafe condition stops the action, preserves the evidence and raises the product exception path. The identities Surya uses live in your own Microsoft 365 tenant, where your administrator can see, audit and revoke them.
Dedicated to you.
Your operations run on hardware assigned to your organization alone, in the Surya RTP Distribution Center. It is not shared with any other customer. If it fails, your tenant keeps running exactly as before; nothing in your environment depends on it.
Routine analysis of your configuration runs on that dedicated hardware. Where a correction needs to be worked out, the configuration difference and its rationale are processed under terms that prohibit training on or retaining your data. Mailbox content, file content and business-document content are not part of routine infrastructure operation.
Access is through two identities that live in your own Microsoft 365 tenant. Your administrator can see every sign-in, audit every action, and revoke either identity at any time. Surya holds no global administrator role and no delegated partner access to your tenant.
Routine operations run from an allowlisted, tested catalogue under a standing policy, so an engineer does not approve every ordinary execution. Consequential changes require explicit authorization, and an unknown or unsafe condition stops the action, preserves the evidence and raises the exception path.
How it works, in the detail your security team will ask for.
- Required dependencies
- Application identities your administrator consents to and can revoke, and Microsoft Graph permissions tied to the operations actually used.
- Explicit exclusions
- Surya Control operates Surya Endpoint, Surya Fabric and Surya Foundation. It is not used by Surya Standby on its own, and it is never a separate purchase. No arbitrary privileged AI agent and no custom automation built per customer. Dedicated compute does not mean a dedicated facility, power, staff, logging infrastructure or downstream cloud service.
- Acceptance test
- A permitted automated correction is applied and verified; a prohibited action is stopped and raised; the operations appliance is replaced and its working state rebuilt from your tenant.
/ Product support
What product support covers.
Around-the-clock operation, automation and response commitments apply to the purchased operated products - Standby, Endpoint, Fabric and Foundation - within the written scope. Room operation follows its own written support scope. For component purchases, the quote names the manufacturer and subscription support responsibilities, including subscription support for licensing bought through Surya, and the setup and handover support Surya provides.
For operated products, support is included: a defined support path for supported users, plus supported vendor escalation with named owners. Surya engineers work three shifts, 365 days a year, and the Surya Agent Network takes the first response on 78% of support requests (90 days to September 2026). Response commitments for your scope are set in your written proposal.
Product support covers faults within the scope you purchase. Your written proposal identifies incident priorities, escalation and any field-response coverage for the products you select. Operated products are covered three shifts, 365 days a year; response commitments are set per scope.
- Backup operation and supported restore execution
- Authentication and account recovery under the documented path
- Supported Microsoft administration inside the released baseline
- Product-security exceptions, containment and restoration of covered components
- Escalation to supported vendors with a named owner
- Faults in the accepted scope, at no consulting fee
Autopilot, Intune and Microsoft Graph are Microsoft functionality. What Surya supplies is the engineered combination, the shared release, the verified operation and the physical recovery around them. Regulatory determinations, legal notification and investigation beyond the product boundary stay with your own authorities or their chosen specialists.
/ Who does what
Surya operates what you purchased. Your team keeps the rest.
Surya
- Product operation across every element the purchased product requires, and nothing outside it
- Prepared replacement equipment, authorized issuance and custody, returns and replenishment under Standby
- Device lifecycle and configuration management where Endpoint or Fabric is purchased
- The defined security and recovery behaviour
- Product faults inside the accepted scope
- Product support and supported vendor escalation
- Release improvements for every customer at once
Your internal IT
- Business applications and their vendors
- AI workflows and process design
- Access and business decisions
- Ongoing production administration wherever Endpoint or Fabric has not been purchased
- Integration with business systems
- Adoption and the results the business wants
Consultants you choose
- Advice or projects you independently decide to buy
- Not required to keep the Surya product running
- Cannot create obligations for Surya
Your IT team and current providers can remain in place. Surya operates and restores the purchased product within its agreed scope.
Your organization and its other providers retain responsibility for business applications, workflows and systems outside that scope.
Surya operates the supported technology foundation. The business, its applications, its AI workflows, access decisions and data authority stay with your organization.
/ How to start
Start with what your site needs. Build from there.
Step 1
Choose a starting point
Step 2
Agree the first scope
Step 3
Get it working
Step 4
Run and expand
Component purchases can work alongside your existing platforms, providers and contracts. Compatibility and any transition work are confirmed before expanded scope is accepted. Expansion is optional.