feat(blog): enterprise post

Author: icecrasher321

apps/sim/content/blog/enterprise/index.mdx

@@ -0,0 +1,143 @@
+---
+slug: enterprise
+title: 'Build with Sim for Enterprise'
+description: 'Access control, BYOK, self-hosted deployments, on-prem Copilot, SSO & SAML, whitelabeling, and flexible data retention—enterprise features for teams with strict security and compliance requirements.'
+date: 2026-01-23
+updated: 2026-01-23
+authors:
+  - vik
+readingTime: 7
+tags: [Enterprise, Security, Self-Hosted, SSO, SAML, Compliance, BYOK, Access Control, Copilot, Whitelabel]
+ogImage: /studio/enterprise/cover.png
+ogAlt: 'Sim Enterprise features overview'
+about: ['Enterprise Software', 'Security', 'Compliance', 'Self-Hosting']
+timeRequired: PT7M
+canonical: https://sim.ai/studio/enterprise
+featured: false
+draft: false
+---
+
+We've been working with security teams at larger organizations to bring Sim into environments with strict compliance and data handling requirements. This post covers the enterprise capabilities we've built: granular access control, bring-your-own-keys, self-hosted deployments, on-prem Copilot, SSO & SAML, whitelabeling, and compliance.
+
+## Access Control
+
+![Access Control Settings](/studio/enterprise/access-control.png)
+
+Permission groups let administrators control what features and integrations are available to different teams within an organization. This isn't just UI filtering—restrictions are enforced at the execution layer.
+
+### Model Provider Restrictions
+
+Allowlist specific providers while blocking others. Users in a restricted group see only approved providers in the model selector. A workflow that tries to use an unapproved provider won't execute.
+
+This is useful when you've approved certain providers for production use, negotiated enterprise agreements with specific vendors, or need to comply with data residency requirements that only certain providers meet.
+
+### Integration Controls
+
+Restrict which workflow blocks appear in the editor. Disable the HTTP block to prevent arbitrary external API calls. Block access to integrations that haven't completed your security review.
+
+### Platform Feature Toggles
+
+Control access to platform capabilities per permission group:
+
+- **Knowledge Base** — Disable document uploads if RAG workflows aren't approved
+- **MCP Tools** — Block deployment of workflows as external tool endpoints
+- **Custom Tools** — Prevent creation of arbitrary HTTP integrations
+- **Invitations** — Disable self-service team invitations to maintain centralized control
+
+Users not assigned to any permission group have full access, so restrictions are opt-in per team rather than requiring you to grant permissions to everyone.
+
+---
+
+## Bring Your Own Keys
+
+![BYOK Configuration](/studio/enterprise/byok.png)
+
+When you configure your own API keys for model providers—OpenAI, Anthropic, Google, Azure OpenAI, AWS Bedrock, or any supported provider—your prompts and completions route directly between Sim and that provider. The traffic doesn't pass through our infrastructure.
+
+This matters because LLM requests contain the context you've assembled: customer data, internal documents, proprietary business logic. With your own keys, you maintain a direct relationship with your model provider. Their data handling policies and compliance certifications apply to your usage without an intermediary.
+
+BYOK is available to everyone, not just enterprise plans. Connect your credentials in workspace settings, and all model calls use your keys. For self-hosted deployments, this is the default—there are no Sim-managed keys involved.
+
+A healthcare organization can use Azure OpenAI with their BAA-covered subscription. A financial services firm can route through their approved API gateway with additional logging controls. The workflow builder stays the same; only the underlying data flow changes.
+
+---
+
+## Self-Hosted Deployments
+
+![Self-Hosted Architecture](/studio/enterprise/self-hosted.png)
+
+Run Sim entirely on your infrastructure. Deploy with Docker Compose or Helm charts for Kubernetes—the application, WebSocket server, and PostgreSQL database all stay within your network.
+
+**Single-node** — Docker Compose setup for smaller teams getting started.
+
+**High availability** — Multi-replica Kubernetes deployments with horizontal pod autoscaling.
+
+**Air-gapped** — No external network access required. Pair with Ollama or vLLM for local model inference.
+
+Enterprise features like access control, SSO, and organization management are enabled through environment variables—no connection to our billing infrastructure required.
+
+---
+
+## On-Prem Copilot
+
+![On-Prem Copilot](/studio/enterprise/copilot.png)
+
+Copilot—our context-aware AI assistant for building and debugging workflows—can run entirely within your self-hosted deployment using your own LLM keys.
+
+When you configure Copilot with your API credentials, all assistant interactions route directly to your chosen provider. The prompts Copilot generates—which include context from your workflows, execution logs, and workspace configuration—never leave your network. You get the same capabilities as the hosted version: natural language workflow generation, error diagnosis, documentation lookup, and iterative editing through diffs.
+
+This is particularly relevant for organizations where the context Copilot needs to be helpful is also the context that can't leave the building. Your workflow definitions, block configurations, and execution traces stay within your infrastructure even when you're asking Copilot for help debugging a failure or generating a new integration.
+
+---
+
+## SSO & SAML
+
+![SSO Configuration](/studio/enterprise/sso.png)
+
+Integrate with your existing identity provider through SAML 2.0 or OIDC. We support Okta, Azure AD (Entra ID), Google Workspace, OneLogin, and any compliant identity provider.
+
+Once enabled, users authenticate through your IdP instead of Sim credentials. Your MFA policies apply automatically. Session management ties to your IdP—logout there terminates Sim sessions. Account deprovisioning immediately revokes access.
+
+New users are provisioned on first SSO login based on IdP attributes. No invitation emails, no password setup, no manual account creation required.
+
+This centralizes your authentication and audit trail. Your security team's policies apply to Sim access through the same system that tracks everything else.
+
+---
+
+## Whitelabeling
+
+Customize Sim's appearance to match your brand. For self-hosted deployments, whitelabeling is configured through environment variables—no code changes required.
+
+**Brand name & logo** — Replace "Sim" with your company name and logo throughout the interface.
+
+**Theme colors** — Set primary, accent, and background colors to align with your brand palette.
+
+**Support & documentation links** — Point help links to your internal documentation and support channels instead of ours.
+
+**Legal pages** — Redirect terms of service and privacy policy links to your own policies.
+
+This is useful for internal platforms, customer-facing deployments, or any scenario where you want Sim to feel like a native part of your product rather than a third-party tool.
+
+---
+
+## Compliance & Data Retention
+
+![Compliance Certifications](/studio/enterprise/compliance.png)
+
+Sim maintains **SOC 2 Type II** certification with annual audits covering security, availability, and confidentiality controls. We share our SOC 2 report directly with prospective customers under NDA.
+
+**GDPR** — Data Processing Agreements available for organizations handling EU personal data.
+
+**HIPAA** — Business Associate Agreements available for healthcare organizations. Requires self-hosted deployment or dedicated infrastructure.
+
+**Data Retention** — Configure how long workflow execution traces, inputs, and outputs are stored before automatic deletion. We work with enterprise customers to set retention policies that match their compliance requirements.
+
+We provide penetration test reports, architecture documentation, and completed security questionnaires (SIG, CAIQ, and custom formats) for your vendor review process.
+
+---
+
+## Get Started
+
+Enterprise features are available now. Check out our [self-hosting](https://docs.sim.ai/self-hosting) and [enterprise](https://docs.sim.ai/enterprise) docs to get started.
+
+*Questions about enterprise deployments? [help@sim.ai](mailto:help@sim.ai)*