Enterprise

Confluye includes enterprise controls for authentication, provisioning, environment governance, and audit. These features are always present in the product and are gated by role (Admin/Owner and organization owner/admin) rather than a master feature flag.

Enterprise subscription and onboarding

Enterprise is quoted to fit your organization. The subscription proposal defines included compute credits, initial onboarding, recurring expert hours, and advanced support coverage. Onboarding can cover a first use case, existing connections, and team training; recurring hours can cover workflow reviews, training, and scoped improvements. Initial onboarding and recurring hours are defined separately. Platform support and implementation work have distinct scopes, with support channels and response targets agreed in the proposal.

There is no published fixed Enterprise price or self-service Enterprise checkout. To discuss a proposal, complete the form in the public homepage's Enterprise section. Provide your name, email, company, and a short description of your use case; team size is optional. No account is required. Request an Enterprise proposal sends the details to our team and shows a confirmation when the email provider accepts the request. If sending fails, your entries stay in the form so you can retry. You can also email support@confluye.run. Submitting the form does not start a subscription or charge you. Our team follows up by email.

AI provider subscriptions and BYOK usage remain separate from Confluye compute credits. Enterprise does not imply unlimited implementation work or a guaranteed resolution time. The controls below describe product capabilities; access remains subject to roles and configuration.

Single sign-on

Confluye supports SAML and OIDC SSO at the organization level. Configure a connection from Settings → Authentication (requires Admin/Owner and an organization owner/admin). Key behaviors:

• Domain verification before a connection can be trusted, and per-login user provisioning.
• OIDC uses PKCE with configurable claim mapping (sub, email, email_verified, name).
• SAML enforces strict security: signed assertions, InResponseTo validation, IdP-initiated flows disabled, short request TTL and clock skew, SHA-256+ signatures/digests, and AES-GCM encryption.
• Provider secrets (OIDC/SAML config) are stored encrypted using APP_ENCRYPTION_KEY (required in production).

Disabling a connection is a soft-disable, preserving history.

SCIM provisioning

User provisioning uses SCIM. Generate a SCIM token (stored hashed) for the organization; provisioning requires an owner or admin role. Provisioned members are synced into the organization, and banning a user revokes their access across workspaces. Tokens can be rotated.

Workflow previews and previous environments

Create and manage test deployments from Versions & previews in each workflow. A workflow has one production destination and can have several named previews. Each destination selects an immutable workflow version and explicit connections. Publishing enables its triggers after the destination's AIMS and repository checks pass. Running & Debugging explains the controls, promotion and recovery.

Settings → Environments is a read-only view of previous environment records, secret references and historical releases. A release recorded there is not evidence that a workflow is running. Existing external secret provider records are retained; creating a preview does not copy their secret values or provider subscriptions. Choose the preview's runtime connections in its workflow.

GET /api/enterprise/promotions?workspaceId=… returns the latest 100 historical releases in the authorized workspace. The old POST /api/enterprise/promotions returns 409 with code: "workflow_target_required": an environment ID does not identify an approved target activation. Open the workflow and prepare a promotion from its deployed preview instead.

Governance and audit

Every significant action is recorded in the audit log with an actor, resource, action, severity, and message — including preview publication, promotion, stopping and rollback. Audit and run-detail retention are configurable with FLUXUS_AUDIT_RETENTION_DAYS (default 365) and FLUXUS_RUN_DETAIL_RETENTION_DAYS (default 30).

Next steps