AACFlow supports enterprise deployments with access controls, customer-managed model credentials, SSO, compliance documentation, and programmatic administration. These capabilities help larger organizations deploy AACFlow under strict security, compliance, and data-handling requirements. This guide explains how each control works and which deployment requirements it addresses.
Access Control
Permission groups let administrators control what features and integrations are available to different teams within an organization. This isn't just UI filtering—restrictions are enforced at the execution layer.
Model Provider Restrictions
Allowlist specific providers while blocking others. Users in a restricted group see only approved providers in the model selector. A workflow that tries to use an unapproved provider won't execute.
This is useful when you've approved certain providers for production use, negotiated enterprise agreements with specific vendors, or need to comply with data residency requirements that only certain providers meet.
Integration Controls
Restrict which workflow blocks appear in the editor. Disable the HTTP block to prevent arbitrary external API calls. Block access to integrations that haven't completed your security review.
Platform Feature Toggles
Control access to platform capabilities per permission group:
- Knowledge Base — Disable document uploads if RAG workflows aren't approved
- MCP Tools — Block deployment of workflows as external tool endpoints
- Custom Tools — Prevent creation of arbitrary HTTP integrations
- Invitations — Disable self-service team invitations to maintain centralized control
Users not assigned to any permission group have full access, so restrictions are opt-in per team rather than requiring you to grant permissions to everyone.
Bring Your Own Keys
When you configure your own API keys for model providers—OpenAI, Anthropic, Google, Azure OpenAI, AWS Bedrock, or any supported provider—your prompts and completions route directly between AACFlow and that provider. The traffic doesn't pass through our infrastructure.
This matters because LLM requests contain the context you've assembled: customer data, internal documents, proprietary business logic. With your own keys, you maintain a direct relationship with your model provider. Their data handling policies and compliance certifications apply to your usage without an intermediary.
BYOK is available to everyone, not just enterprise plans. Connect your credentials in workspace settings, and all model calls use your keys.
A healthcare organization can use Azure OpenAI with their BAA-covered subscription. A financial services firm can route through their approved API gateway with additional logging controls. The workflow builder stays the same; only the underlying data flow changes.
SSO & SAML
Integrate with your existing identity provider through SAML 2.0 or OIDC. We support Okta, Azure AD (Entra ID), Google Workspace, OneLogin, Auth0, JumpCloud, Ping Identity, ADFS, and any compliant identity provider.
Once enabled, users authenticate through your IdP, so its MFA and sign-in policies apply to the authentication event. AACFlow sessions have their own lifecycle: IdP logout or deprovisioning does not currently revoke an active AACFlow session or remove organization membership, so those are explicit AACFlow admin steps during offboarding.
Administrators choose how first-time users enter the organization. For a user without a pending invitation or existing external workspace access, Automatic provisioning adds them through the verified SSO connection as a Member and consumes a billed seat; Team seat counts grow with membership, while fixed-seat plans require available capacity. Invite only authenticates the user but requires access to be granted separately. Existing membership and workspace access remain available. Automatic provisioning never promotes IdP claims into AACFlow roles and never grants workspace access implicitly.
This centralizes your authentication and audit trail. Your security team's policies apply to AACFlow access through the same system that tracks everything else.
Compliance & Data Retention
AACFlow does not currently claim a third-party certification. Contact support@aacflow.io for the security documentation that is available.
Data Retention — Configure how long workflow execution traces, inputs, and outputs are stored before automatic deletion. We work with enterprise customers to set retention policies that match their compliance requirements.
We provide penetration test reports, architecture documentation, and completed security questionnaires (SIG, CAIQ, and custom formats) for your vendor review process.
Admin API
Manage AACFlow programmatically through the Admin API. Every operation available in the UI has a corresponding API endpoint, enabling infrastructure-as-code workflows and integration with your existing tooling.
User & Organization Management — Provision users, create organizations, assign roles, and manage team membership. Integrate with your HR systems to automatically onboard and offboard employees.
Workspace Administration — Create workspaces, configure settings, and manage access. Useful for setting up isolated environments for different teams or clients.
Workflow Lifecycle — Deploy, undeploy, and manage workflow versions programmatically. Build CI/CD pipelines that promote workflows from development to staging to production.
The API uses standard REST conventions with JSON payloads. Authentication is via API keys scoped to your organization.
Import & Export
Move workflows between environments, create backups, and maintain version control inside or outside of AACFlow.
Workflow Export — Export individual workflows or entire folders as JSON. The export includes block configurations, connections, environment variable references, and metadata. Use this to back up critical workflows or move them between workspaces.
Workspace Export — Export an entire workspace as a ZIP archive containing all workflows, folder structure, and configuration. Useful for disaster recovery or for moving a workspace between environments.
Import — Import workflows into any workspace. AACFlow handles ID remapping and validates the structure before import. This enables workflow templates, sharing between teams, and restoring from backups.
Version History — Each deployment creates a version snapshot. Roll back to previous versions if a deployment causes issues. The Admin API exposes version history for integration with your change management processes.
For teams practicing GitOps, export workflows to your repository and use the Admin API to deploy from CI/CD pipelines.
Get Started
Enterprise features are available now. Check out our enterprise docs to get started. Teams comparing options can also use our guides to enterprise AI agent platforms, the AI workflow automation buyer's checklist, and AI agents in procurement.
Questions about enterprise deployments?
Contact UsFAQ
Does AACFlow have a SOC 2 Type II report?
AACFlow does not currently claim a third-party SOC 2 Type II report. Contact support@aacflow.io for the security documentation that is available for vendor review.
What does AACFlow provide for an enterprise security review?
Contact support@aacflow.io for the security documentation that is available for enterprise security reviews. Reviewers can also evaluate SSO through SAML 2.0 or OIDC, permission groups enforced at the execution layer, configurable data-retention policies for execution traces, and BYOK with customer-managed model credentials.
How are SLAs and dedicated support handled?
AACFlow sets SLA terms and dedicated support arrangements during the enterprise evaluation. Contact AACFlow to confirm response times, availability commitments, escalation paths, and support coverage for your deployment.
Does AACFlow support data residency across regions?
BYOK lets you select a model provider and account configuration that meet your residency requirements, and can route model traffic directly to providers such as Azure OpenAI or AWS Bedrock. Confirm AACFlow region availability for the application itself directly with AACFlow.
Can teams roll back a deployed agent to a previous version?
Yes. Each workflow deployment creates a version snapshot that administrators can use to restore an earlier version. The Admin API also exposes version history for integration with change management processes.
Can admins set budget caps or track spend per team?
The capabilities described here do not include numeric per-team budget caps or a per-team spending dashboard. Administrators can restrict model providers, integrations, and platform features by permission group. With BYOK, spending controls and usage reporting depend on the configured model provider.
Does using our own LLM API keys (BYOK) keep our data from passing through AACFlow's servers?
BYOK makes AACFlow use your credentials for providers such as OpenAI, Anthropic, Google, Azure OpenAI, or AWS Bedrock. Confirm the request path and processing boundaries during your security review. BYOK is available to everyone, not just enterprise plans.
What identity providers does AACFlow support for SSO, and what happens when an employee is deprovisioned?
AACFlow integrates with Okta, Microsoft Entra ID (formerly Azure AD), Google Workspace, OneLogin, Auth0, JumpCloud, Ping Identity, ADFS, and other identity providers that support SAML 2.0 or OIDC. With SSO alone, IdP deprovisioning blocks future SSO authentication but does not remove AACFlow membership or revoke active AACFlow sessions, so offboarding must also remove or suspend access in AACFlow.