/ Guide / Questions
Questions buyers ask, answered directly.
These are the questions that come up during qualification, answered the way they are answered on a call. Where a limit exists, it is stated instead of softened.
Does Surya report into Vanta?
Yes. Surya is a Vanta partner, and Standby, Endpoint and Fabric all support automated reporting to the Vanta platform for their agreed scope. The configured reporting scope determines which records are transmitted automatically; additional records are available on request. Vanta licensing and reporting setup are identified in your proposal.
Can Surya arrange an auditor or assessor?
Where your requirements call for an independent audit or assessment, Surya can arrange the appropriate auditor or assessor relationship as part of your product scope; for CMMC assessments that require a C3PAO, that means an authorized C3PAO. The auditor or assessor makes its own findings, and any assessment fees are identified in your proposal. It is never mandatory for a product purchase.
Is support round the clock, and is that incident response?
Three things are different and are kept separate. Round-the-clock product support is the support path for supported users, staffed across three shifts, 365 days a year. Continuous supported-state monitoring is how Surya Control evaluates the Endpoint and Fabric scope. Security incident response is covered only to the extent written into your contract; Surya is not an unlimited SOC or MDR service.
What does Surya actually sell?
Surya builds and operates standardized technology products for mission-critical physical environments: physical recovery, the endpoint environment, the site network and the operating layer that maintains them. Surya Standby is where the relationship starts and is a complete standalone product. Surya Endpoint and Surya Fabric are added on top of Standby, independently, in either order or together, at the outset or later. Standby, Endpoint and Fabric together are Surya Foundation. Product support is included and open-ended consulting is not.
What does it cost?
It is quoted for the covered sites and devices. Scope, prerequisites and commercial terms are confirmed in writing before an order is accepted.
Can I buy Surya Control or Surya Standby on their own?
Surya Standby yes, Surya Control no. Standby is a complete standalone product, not a trial or a pilot: Surya captures your existing configurations per employee persona or equipment class and prepares replacement equipment to them, from workstations and peripherals to qualified switches, firewalls and other agreed critical equipment. Surya Endpoint and Surya Fabric are added on top of Standby when deeper standardization and administration is wanted. Surya Control is the operating layer inside Surya Endpoint and Surya Fabric and is never a separate purchase.
Who actually does the work?
Every Surya product is run by the Surya Agent Network. It takes the first response on a support request, runs the device flows, and hands anything it is not permitted to finish to Surya engineers on shift. 78% of responses are AI-first: the first response to a support request comes from the Surya Agent Network, not a person. Measured across every customer Surya operates, over the 90 days to September 2026. Surya engineers work three shifts, 365 days a year. Under Surya Standby on its own, the Agent Network runs the replacement loop - issuance, returns, replenishment and the custody record. Surya Control is not involved, because there is no tenant scope to govern.
Is someone there at night?
Yes. Surya runs three shifts, 365 days a year. Response commitments for your scope are set in your written proposal.
What happens when a workstation fails at a site?
The person at the site makes the first move, and what follows depends on what you purchased. Under Surya Standby they go to the prepared replacement, which is issued through the authorized workflow and recorded against the serial number. Where Surya Endpoint is purchased, they can instead call support: a 30-minute restoration window opens, the replacement comes out if the device is still not working when the window closes, and protected data is restored from the locations declared in that standard. Standby on its own provides the prepared replacement and its recorded handoff, not managed troubleshooting or a protected-data restore.
Who owns the devices?
You do. The customer purchases and owns the devices, including the replacement devices held at the site. Surya provides, installs, owns and operates the on-site badge-access smart locker where the released arrangement includes one.
Is a replacement device the same as a backup?
No. A replacement device is not a backup. Protected data is restored from the locations declared in the standard, and local-only data outside those locations is not promised to reappear.
Do you guarantee a recovery time?
No. Standardization makes site technology more predictable to operate and to recover, but Surya does not publish a recovery-time guarantee. Local replacement covers device failure, not an application outage, an identity outage, a power loss or every kind of network fault.
Does Surya replace our IT team?
No. Surya operates the supported technology foundation. The business, its applications, its AI workflows, access decisions and data authority stay with your organization, along with the Microsoft tenant and the licenses.
Can we keep our own consultants?
Yes. You can hire your own consultants at any time. Surya does not become their implementation staff, and they cannot create obligations for Surya. If a consultant changes the standard, the affected scope is identified and its status is restored or resolved.
What has to be true for us to qualify?
Fit depends on the product you need: a supported configuration for that product, named business, access and data owners where required, acceptance of the product's operating standard and change process, and confirmation of the prerequisites for the proposed scope. Endpoint requirements do not automatically apply to Surya Fabric.
What is in scope for endpoints?
Supported Windows hardware and currently supported Windows releases named in the release manifest, with approved applications, integrations and peripherals from a versioned catalogue. Other endpoint operating systems are outside the supported standard.
Can we reuse the equipment we already have?
It depends on which product. Under Surya Standby your existing configuration is captured per agreed role or equipment type and qualified replacements are prepared to it, so the equipment your teams run today stays as it is. Where Surya Fabric is purchased, Surya provides the complete network system for the agreed sites: Surya supplies the equipment and its standard configuration, installs and tests it before operation, and maintains it, rather than taking over the equipment installed there today. Where Surya Endpoint is purchased, existing endpoints are reused only to the extent the released profile permits. For Standby and Endpoint, equipment that does not qualify is named during the review rather than carried forward quietly.
Are single-site organizations excluded?
No. Single-site organizations are not excluded. Installation, field response and replenishment coverage are confirmed for the proposed sites during qualification.
What does Surya do about OT and cyber-physical systems?
Where that layer is in scope, Surya Fabric extends across the IT and OT boundary: asset visibility delivered with Claroty, segmentation between the business and operational environments, monitoring of the boundary and the paths permitted across it, a defined recovery procedure for supported network components, and evidence of what is connected, changed and denied. Claroty licensing is a customer requirement where the OT capability is in scope.
Will Surya touch our PLCs or production machinery?
No. Surya does not perform PLC programming, ladder logic, process engineering, controls engineering or machinery optimization, and does not take responsibility for production equipment or its safety systems. Surya covers the computing that supports production equipment, not the machine.
How does this work around medical devices?
We work up to the port, not past it. Surya covers the technology that supports the clinical device: the workstation, printer, network connection and supported computing layer. The clinical device itself remains under the authority of the healthcare organization and its medical-equipment vendor unless separately qualified and contracted.
How is HIPAA handled?
Handling is HIPAA-aligned under a signed business associate agreement, and drives are erased to NIST 800-88 where erasure applies with a certificate filed against the serial number. HIPAA compliance remains an organizational responsibility. Surya provides scoped technology controls, operational practices and evidence that support your program.
What evidence can we see before enrolling anything?
Surya is SOC 2 Type II audited and the report is available on request under NDA; an attestation is not a certification. Your security team can request the full data-flow and access documentation before anything is enrolled.
Which environments does Surya serve?
Three classes of physical environment consume the same product architecture: industrial, commercial and healthcare. The products and the standard do not change per environment; the profiles selected and the devices covered do.
How does Surya decide which specialized devices are covered?
Through device-class qualification during Check Fit and three tests: does its failure stop or materially disrupt production, revenue, care or site operations, can the supported setup be defined and reproduced reliably, and can trained site staff replace it through a controlled runbook without a specialist physically present. Coverage for those device classes is quoted separately, by device class.
What happens if we leave?
Because the assets and licensing are yours, leaving is a transition rather than a rebuild. Exit treatment comes from the approved agreement.
Check Fit.
If your question is not here, ask it on the fit form and it will be answered directly.
Check Fit