Launch intelligence is in early access. Become a design partner

Enterprise

Run launches inside your company's controls,with your identity provider and your retention rules.

Enterprise adds SSO, SCIM, audit log export, longer audit retention, legal hold, and the highest limits on every quota. You can also run the whole platform in your own cloud.

Contact salesSecurity overview
Audit log exportEnterprise
Destination
Splunk HEC
Format
CloudEvents JSON
Credential
HEC token · encrypted
Private addresses
Refused
Schedule
Every minute, with retries
delivering

Controls

The controls your IT team will ask about,included on Enterprise.

Your identity provider decides who gets in. Your security log tool (SIEM) receives every audit event. Your retention policy decides how long history stays.

  • SAML and OIDC

    Single sign-on through your identity provider, including Microsoft Entra ID.

  • SCIM

    SCIM user provisioning adds and removes teammates automatically. Tokens are scoped to one workspace and hashed.

  • Fresh two-factor to change it

    Configuring SSO or SCIM requires an owner or admin with a fresh two-factor session.

  • Audit log export

    Signed CloudEvents to any HTTPS endpoint, or presets for Splunk HEC and Datadog.

  • Retention and legal hold

    Set a longer retention period, or hold history indefinitely. The daily retention job honors holds.

  • Self-hosting

    Production Docker images and a portable Helm chart, in the open-source repository.

Identity

New teammates start as viewersuntil someone grants them more.

Identity setup is a privileged action, so it asks for proof. Teammates who arrive through SSO or SCIM start with read-only access.

01

Your directory, your rules

Connect a SAML or OIDC provider, turn on SCIM, and switch off password sign-in. Changes need an owner or admin with a fresh two-factor session.
  • Google, Microsoft, and GitHub sign-in also available
  • SCIM deactivation removes access
  • Six fixed roles, assigned per workspace
Single sign-onowner · fresh 2FA
Protocol
SAML or OIDC
Provisioning
SCIM
Default role
viewer
Password sign-in
Off

02

Every audit event in your SIEM

Every audit event is sent to your security log tool as it happens. Export secrets are encrypted at rest with AES-256-GCM and never shown back. Private addresses and redirects are refused.
Read the security overview
Audit log exportEnterprise
Destination
Splunk HEC
Format
CloudEvents JSON
Credential
HEC token · encrypted
Private addresses
Refused
Schedule
Every minute, with retries
delivering

Room for every product line. Enterprise limits, read from the same code that enforces them.

AI credits a month
54,000
AI credits a month
API writes a minute
10,000
API writes a minute
concurrent jobs
250
concurrent jobs
asset storage
5 TB
asset storage

Deployment

Use our hosted platformor run it in your own cloud.

The code is open source either way.

  • hosted · United States

    Hosted

    We run it on DigitalOcean in New York, with scheduled workflows on Temporal Cloud and private storage on Cloudflare R2.
  • helm install

    Self-hosted

    A portable Helm chart and production Docker images. Bring your own PostgreSQL, Redis, object storage, and Temporal.

Questions

Anything else? Talk to us.

Do you sign a DPA or security questionnaire?
Talk to us. We will share the architecture and control documentation and work through your questionnaire with you.
Do you have SOC 2?
Not today. Every control on our security page is documented and tested in the open-source repository.
Can we keep data outside the United States?
The hosted platform runs in the United States. To keep data elsewhere, self-host it in your own region.
How is Enterprise priced?
From $3,000 a month, billed annually, sized to your launches, seats, and products. Contact sales.

Related

Read the full security overview,compare plan prices, or see how approvals work.

Talk to salesabout SSO, SCIM, and self-hosting.

Get startedRequest a demo