They most likely are. Third party techs then access them over Citrix or VPN/RDP. There could be some cloud portion that aggregates data or pushes policies and schedules as well.