Stereologic can be deployed on-premises or within an approved cloud environment, with non-intrusive, no-install desktop-recording software and no Administrator-level endpoint access — giving teams operational visibility while keeping processing within the agreed environment.
Security review tends to stall on the same four questions. These are the answers, before anyone opens a questionnaire.
Recording runs without installation on employee devices.
Deploy on-premises or within the approved hosted or cloud environment.
On-premises data stays on-premises; hosted data stays within that cloud. Processing remains in jurisdiction.
Operational data is not sent to an external AI engine for processing.
Each item below is addressed in the Stereologic Security and Compliance Pack, provided to prospective customers on request.
Stereologic maintains a SOC 2 Type II attestation covering the Security, Availability, Confidentiality and Privacy trust services criteria, issued by SAV Associates Professional Corporation. A further audit period is currently in progress. The full report is available to prospective clients under NDA on request.
Availability commitments are agreed per engagement and set out in the contract, and accommodate a scheduled monthly maintenance window for platform updates. In on-premises and client-cloud deployments, availability is governed by the client’s own infrastructure.
Our HIPAA position and the associated documentation, including how PHI is handled in a deployment, is provided on request for covered entities and their reviewers.
Penetration testing is in place, and the associated documentation is provided on request.
PII masking and sensitive-data handling are in place.
A data processing agreement (DPA) and a business associate agreement (BAA) are in place and available for execution.
Architecture and deployment requirements are documented and provided for technical review. Resource footprint is confirmed per deployment against your environment and observed workload during technical scoping.
Standardized security questionnaires, including SIG and CAIQ, are completed where a review requires them.
This page is the evaluation layer: enough for a reviewer to decide whether Stereologic can be deployed in your environment. The pack is the procurement layer. Tell us which frameworks your review runs against and which teams need to be in the room, and we will make sure the right people are on the call.
Two things define a Stereologic deployment: where the platform runs, and what it is allowed to reach. Both are set before discovery begins.
Illustrative deployment envelope. Final architecture is confirmed per environment.
Reviewers usually want the scope of observation as well as the architecture. The process-level view is described on Process Mining, the task-level view on Deep Task Mining, and how the two fit together on the platform page. How personal data is handled in our own operations is set out in the privacy policy.
Security review is usually where operational discovery stalls. Stereologic is built so the answers are configuration choices you make, not constraints you have to accept. Each is agreed in writing and set out in the contract before any work starts.
Where the platform runs is your decision, not a condition of using it.
Whether the AI recognition layer is used at all is a choice you make per engagement.
Where AI is used, you choose which models are applied.
Options are confirmed per environment and recorded in the contract. Deployment and model choices do not change the method: recognition is reviewed and approved before anything downstream is built on it, and case assembly, end-to-end reconstruction and map generation are deterministic by design.
This page is written for an initial technical read. The Security & Compliance Pack is the source of record: it carries the current certification and attestation position, the deployment architectures, data handling and residency, PII and PHI treatment, the AI-processing boundary, and completed SIG or CAIQ responses where those are required. Where a control is in progress rather than in place, the pack says so, and audit dates are answered there rather than on this page so they stay current.
Send the pack to the people who would otherwise stop the project in month three: security architecture, privacy, and procurement. Or bring them to the same call and let them ask directly.