Launch intelligence is in early access. Become a design partner

Enterprise

Launch at scale,inside your controls.

Enterprise adds SSO, SCIM, audit drains, longer audit retention, legal hold, and the highest limits on every quota. Or run the whole platform in your own cloud.

Contact salesSecurity overview
Audit drainEnterprise
Destination
Splunk HEC
Format
CloudEvents JSON
Credential
HEC token · encrypted
Private addresses
Refused
Schedule
Every minute, with retries
delivering

Controls

The answers a security reviewasks for.

Your identity provider decides who gets in. Your SIEM sees everything that happens. Your retention policy decides how long it stays.

  • SAML and OIDC

    Single sign-on through your identity provider, including Microsoft Entra ID.

  • SCIM

    Provision and deprovision members automatically. Tokens are scoped to one organization and hashed.

  • Fresh two-factor to change it

    Configuring SSO or SCIM requires an owner or admin with a fresh two-factor session.

  • Audit drains

    Signed CloudEvents to any HTTPS endpoint, or presets for Splunk HEC and Datadog.

  • Retention and legal hold

    Set a longer retention period, or hold history indefinitely. The daily retention job honors holds.

  • Self-hosting

    Production Docker images and a portable Helm chart, in the open-source repository.

Identity

Least privilegefrom the first login.

Identity setup is a privileged action, so it asks for proof. Members who arrive through SSO or SCIM start as viewers until someone grants more.

01

Your directory, your rules

Connect a SAML or OIDC provider, turn on SCIM, and switch off password sign-in. Changes need an owner or admin with a fresh two-factor session.
  • Google, Microsoft, and GitHub sign-in also available
  • SCIM deactivation removes access
  • Six fixed roles, assigned per organization
Single sign-onowner · fresh 2FA
Protocol
SAML or OIDC
Provisioning
SCIM
Default role
viewer
Password sign-in
Off

02

Everything in your SIEM

Every audit event is delivered to your SIEM as it happens. Drain secrets are encrypted at rest with AES-256-GCM and never shown back. Private addresses and redirects are refused.
Read the security overview
Audit drainEnterprise
Destination
Splunk HEC
Format
CloudEvents JSON
Credential
HEC token · encrypted
Private addresses
Refused
Schedule
Every minute, with retries
delivering

Room for every product line. Enterprise limits, read from the same code that enforces them.

AI credits a month
54,000
AI credits a month
API writes a minute
10,000
API writes a minute
concurrent jobs
250
concurrent jobs
asset storage
5 TB
asset storage

Deployment

Hosted,or in your cloud.

Use the hosted platform, or run it yourself. The code is open source either way.

  • hosted · United States

    Hosted

    We run it on DigitalOcean in New York, with durable workflows on Temporal Cloud and private storage on Cloudflare R2.
  • helm install

    Self-hosted

    A portable Helm chart and production Docker images. Bring your own PostgreSQL, Redis, object storage, and Temporal.

Questions

Anything else? Talk to us.

Do you sign a DPA or security questionnaire?
Talk to us. We will share the architecture and control documentation and work through your questionnaire with you.
Do you have SOC 2?
Not today. Every control on our security page is documented and tested in the open-source repository.
Can we keep data outside the United States?
The hosted platform runs in the United States. To keep data elsewhere, self-host it in your own region.
How is Enterprise priced?
From $3,000 a month, billed annually, sized to your launches, seats, and products. Contact sales.

Related

Keep reading.Every part connects.

Bring your identity provider.Keep your audit trail.

Get startedRequest a demo