Run the agent inside your own network. Let your team — and your clients — prompt it with roles. Keep every action on record.
The agent works on your servers, against your repos, behind your firewall. Orquesta coordinates; your machines do the work.
Developers, PMs and your clients prompt the same agent. Roles decide what each can see, ask and deploy — per project and environment.
Every session streams live. When something looks wrong, a person takes control of the same terminal, on the same machine — then hands it back.
Who asked, what ran, on which machine, and who approved it — in an append-only, cryptographically chained log you can stream to your SIEM.
SAML 2.0 and OIDC with Okta, Entra ID, Google Workspace. SCIM provisioning, IdP group-to-role mapping, enforced MFA.
Eight built-in roles from Org Owner to Viewer, custom roles, environment-scoped access and command allow/blocklists.
Managed cloud, your VPC on AWS, GCP or Azure, on-prem via Helm or Docker Compose, or air-gapped.
Append-only, cryptographically chained log. Stream to Splunk, Datadog, ELK or CloudWatch. Retention up to 7 years.
Multi-approver chains per environment, mandatory diff review, AI simulation before execution, auto-reject timers.
Monthly caps, per-user and per-project quotas, alerts at 50/75/90/100%, cost tags for chargeback.
Slack & Teams, Jira & Linear, GitHub Enterprise & GitLab, PagerDuty & ServiceNow, signed webhooks.
99.9% uptime, 1h response on critical issues, a named CSM and a shared Slack channel with engineering.
| Framework | Status | Details |
|---|---|---|
| SOC 2 Type II | Certified | Annual third-party audit. Report under NDA. |
| GDPR | Compliant | DPA available, EU data residency, erasure and portability. |
| CCPA / CPRA | Compliant | Deletion and opt-out mechanisms in place. |
| HIPAA | Ready | BAA available. PHI encryption and access controls. |
| OWASP Top 10 | Compliant | Tested against the Top 10, with regular third-party pentests. |
SSO, security review and DPA, first projects and teams.
Roles, integrations, coding standards, approval gates.
5–10 developers on real work, with live training.
The whole team, budgets set, first business review booked.
Yes. Dedicated VPC on AWS, GCP and Azure, plus fully on-prem and air-gapped installs. Your data never leaves your cloud account.
Yes. On-prem and air-gapped deployments can point at your own endpoints — Ollama, vLLM or any OpenAI-compatible API — so nothing leaves your network.
Yes, with a role. Scope what they can see and ask per project and environment, and require approval before anything they request reaches production.
Enterprise is built for 10+ developers, but we work with smaller teams that have specific compliance or deployment needs.
Usually 1–2 hours for Okta or Entra ID, handled by our team during onboarding. SCIM adds another 1–2 hours.
Yes to both. The SOC 2 Type II report is shared under NDA, and we sign BAAs for healthcare customers.
Continue on your enterprise plan with no migration, or we delete your data within 30 days. No lock-in.
30 days with a dedicated engineer. If it doesn't ship real PRs by week two, we refund the call.