30-day pilot
A regulated support-to-engineering pilot, with the boundary in the code
In 30 days, turn user-reported bugs from a regulated app into privacy-safe, reproducible engineering evidence: a scrubbed trace, a replayability score, sanitized diagnostics, a Playwright repro, and ticket/PR drafts. StepStitch does this without capturing screens, input values, or page text. Self-hosted and open source, so your reviewers can verify every line.
Who it is for
- Regulated financial-services teams where support escalations to engineering must carry no customer data the team cannot account for.
- Microsoft tenants standardizing on Copilot Studio / Power Platform for agent workflows.
- Risk, compliance, and model-risk reviewers who need evidence they can read, not certificates to trust.
What gets installed
Ingest API
Self-hosted on Railway (or any OCI host) with the financial-services-enterprise scrub profile. You hold the keys; StepStitch holds no system-of-record credentials.
Tracker SDK
@stepstitch/tracker mounted behind a consent gate in the app the support team supports.
MCP connector
Read-only / draft-only tools for Copilot Studio, Claude, or any agent network.
Compliance packet
COMPLIANCE-EVIDENCE.md generated from the live scrub policy, plus the named tests that back each control.
What you get by day 30
- A working report → scrub → score → repro → draft → verified-fix loop on a real support flow.
- A folder of scrubbed traces, each with the server's own report of exactly what it stripped at ingestion.
- Deterministic Playwright reproductions your engineers can run in CI as regression tests.
- ServiceNow incident + Salesforce case + GitHub issue drafts, created but never auto-sent.
- A confirmed-fixed regression corpus: bugs that went red in CI before the fix and green after.
Mode A: Power Platform native connectors
Copilot Studio calls the read-only export-preview endpoint, gets a flat draft, and maps it onto Microsoft's native ServiceNow/Salesforce connectors as a human-approved step. StepStitch never holds system-of-record credentials.
Mode B: governed direct-write
StepStitch can post the sanitized draft itself. This mode is off by default, admin-only, dry-run by default, requires a named human approver and idempotency key, is fully audited, and is never exposed on the agent surface.
The compliance evidence packet
Hand your reviewer the packet generated from the live scrub policy: it cannot drift from what the server actually enforces. It crosswalks the controls to SEC Reg S-P (2024) and NIST AI RMF, and names the test that backs each one.
Success criteria
- Under the financial-services-strict profile the server refuses free text, unapproved selectors and undeclared routes with HTTP 422, and stamps what survived strict_schema_passed.
- Evidence from a local reproduction is scrubbed and never comes from the reported session, but the application under test is yours. StepStitch therefore marks that data customer_data_status: not_verified rather than certifying it.
- Median time from support ticket to a runnable engineering repro measurably reduced.
- Every escalation carries a replayability grade so engineering knows what is reproducible.
- At least one bug taken from report to confirmed_fixed regression evidence.