Standby at the site
$2,000
per site per month, any site type
The locker operated, spares built to your image at Research Triangle Park and kept patched, swap, custody record, RMA and the remote restore line. You supply the devices.
/ Start here · Standby with JML
Start with Standby and JML
A smart locker at each site with a configured replacement always in it, and every joiner, mover and leaver handled from a request, with a record of who asked, who approved and when it ran. Month to month. Everything above it on the ladder, Surya Endpoint first, is bought later without paying twice.
Three prices.
JML operated
$25
per person per month, $500 minimum per tenant
Account, role-based licenses and groups, multifactor, device bound to the person on arrival, access removed on the date you set, and the record for every event, exportable as an access review.
JML implementation
$4,000
one-time per tenant
Your HR system connected as the source of truth, the role model, joiner, mover and leaver flows in Entra and Intune, the service desk handoff, the evidence export and an acceptance test.
The locker and the moves
The locker is yours: passed through at cost as a one-time setup fee, on your paper, operated by Surya. LocknCharge F5 $2,990 or LocknCharge F15 $5,990 today; mixed-bay options quoted.
Five-bay or fifteen-bay, standard or mixed-bay for edge devices, chosen for the site. Devices that leave or return to Research Triangle Park are on the move meter.
Device moves are on the move meter: a new hire shipped with a dock $160; a leaver retrieved, wiped with a certificate and restocked $235.
Moving up
Surya Endpoint, $100 per person per month, includes Standby at every site with 15 or more people, JML, the support desk and the compliance platform. On moving up the deployment fee is waived, the JML implementation is credited, and the site fee folds into the seat price.
Surya EndpointInside your compliance boundary
This rung gives you a record an auditor can read: who asked, who approved and when it ran for every joiner, mover and leaver, and who opened each bay and what went in and came out. It is a record, not a certification. There is no compliance platform at this rung; the JML record is exported to you.
The controls behind every joiner, mover and leaver
Access is granted from a request, changed from a request and removed from a request. Each one leaves a record of who asked, who approved and when it ran.
Joiner
| Control | What is set | Where it is recorded |
|---|---|---|
| Account creation | The account is created from an approved request (your HR system or a named approver), never from a help-desk message. | |
| Licenses and groups | Assigned by role, not by person. | |
| Multifactor | Registered before first sign-in. | |
| Device | The device shipped from the Surya RTP Distribution Center is enrolled in your device management and bound to the person on arrival. | |
| Conditional access | Applies from day one. |
Where it is recorded: The request, the tenant's audit log and the configuration record.
Mover
| Control | What is set | Where it is recorded |
|---|---|---|
| New role | Access re-evaluated against the new role on the effective date. | |
| Previous role | Access from the previous role removed on that date, not left to accumulate. | |
| Data access | Changes approved by the data owner. | |
| Device | Re-profiled or swapped where the role requires it. |
Where it is recorded: The request, the tenant's audit log and the device record.
Leaver
| Control | What is set | Where it is recorded |
|---|---|---|
| Account and sessions | Account disabled and sessions revoked at the time you set, on the day you set. | |
| Authentication methods | Multifactor methods and app passwords cleared. | |
| Mailbox and files | Retained under your retention policy and delegated to the person you name. | |
| Access removal | Shared-mailbox, group and application access removed. | |
| Device recovery | The device recovered through the Surya supply chain, wiped with a certificate of erasure, and the record closed. |
Where it is recorded: The request, the tenant's audit log, the custody record and the certificate of erasure.
Evidence
| Control | What is set | Where it is recorded |
|---|---|---|
| Access review | A record for every joiner, mover and leaver, exportable as an access review for the period you choose; where Surya Endpoint is in place, into your compliance platform. |
Where it is recorded: Your compliance platform, where Surya Endpoint is in place.
It is a record your auditor can read. It is not a certification.
The controls behind every locker swap
A locker is a bay with a lock. A Surya locker is a bay whose every opening is attributed to a named person, with a record of what went in and what came out.
Access
| Control | What is set | Where it is recorded |
|---|---|---|
| Named access | Each bay opened by a named person through a PIN or badge issued to them; no shared codes. | |
| Opening rights | Granted and removed with the person's account. | |
| Administration | Administrative access to the locker platform held by you, Surya delegated. |
Where it is recorded: The locker platform's event log.
Contents
| Control | What is set | Where it is recorded |
|---|---|---|
| Staged device | What is staged in each bay recorded by serial number and image version. | |
| Bay purpose | A bay holds one device for one purpose. | |
| Returned device | Locked in its bay until retrieved by Surya. |
Where it is recorded: The custody record.
Device and network
| Control | What is set | Where it is recorded |
|---|---|---|
| Network segment | The locker on its own network segment. | |
| Outbound traffic | To the locker platform's published endpoints only. | |
| Firmware | On the managed update channel with the version recorded at handover and at each change. |
Where it is recorded: The network configuration and the locker platform's device record.
Custody and evidence
| Control | What is set | Where it is recorded |
|---|---|---|
| Swap record | A custody record for every swap (who opened, which bay, which serial out, which serial in, when). | |
| Erasure | A certificate of erasure for every returned device. | |
| Evidence | Where Surya Endpoint is in place, both into your compliance platform. |
Where it is recorded: The custody record and the certificate of erasure; where Surya Endpoint is in place, both into your compliance platform.
It is a record your auditor can read. It is not a certification.
Two sites, worked
One clinic, 20 people, five-bay locker
- On signingJML implementation $4,000, locker passed through at cost
- $4,000 + locker
- MonthlyStandby at the site: 1 x $2,000; any site type; JML operated: 20 people at the $500 minimum per tenant
- $2,500
- Each new hire shipped, each leaver retrievedOn the move meter
- $160 / $235
Three clinics, 45 people, five-bay lockers
- On signingJML implementation $4,000, 3 lockers passed through at cost
- $4,000 + lockers
- MonthlyStandby at the site: 3 x $2,000; any site type; JML operated: 45 people x $25
- $7,125
- Same group on Surya Endpoint, all in$5,000 Endpoint plus the $12,400 compliance platform a year, spread monthly
- $6,033 a month
Price your first rung
Enter your sites, your people and the locker for each site. The figures below come from the price book; Surya confirms them in a written quote.
Licensed users in your Microsoft tenant. $25 per person a month, $500 minimum per tenant.
Terms
Month to month, 30-day out, no pilot, no free month. The site fee starts the day the bays are stocked; the JML fee starts the day the first flow runs. No compliance platform at this rung; the JML record is exported to you.
Figures in USD. Confirmed in a written quote against a declared scope. Download the price book (PDF)