Skip to content
Cirvix.
Start

Enterprise

Deploy Cirvix on your terms.

Cirvix is the enterprise control plane for AI agents, providing runtime governance, policy enforcement, identity, observability, security, and compliance across every model, framework, protocol, and cloud.

Enterprise is not Pro with bigger limits — it is a different shape of engagement: where the control plane runs, whose identity provider it trusts, what the contract guarantees, and who answers when something breaks.

Cirvix is in private beta. Enterprise engagements are scoped individually while the platform ships its governance surface — which is exactly why deployment model, procurement, and support are settled up front in the MSA, not assumed.

Deployment

Four ways to run the control plane

The same enforcement, policy, and audit model — deployed to match how much of your infrastructure you're willing to let Cirvix touch.

Multi-tenant SaaS

The default. Cirvix operates the control plane; your workspace is logically isolated with no infrastructure for your team to run.

Single-tenant VPC

A dedicated instance of the control plane, deployed into a VPC you own or peer with. Nothing shares compute, storage, or a database with another customer.

On-premise

Policy evaluation, the decision log, and the dashboard run inside your data center and never leave your network boundary.

Air-gapped

For networks with no outbound connectivity. Policy bundles and software updates move by controlled transfer, not by the control plane phoning out.

Identity

SSO — OIDC

Human approvers, groups, and roles federate from the identity provider you already run — Okta, Entra ID, and Google Workspace all speak OIDC natively. Cirvix does not become a second source of truth for who works here; it reads one. SAML is not implemented, and a SAML connection is refused with that reason rather than silently ignored.

Provisioning

SCIM

Access follows your directory. Offboard someone at the IdP and their dashboard access and approval authority are revoked with it, not discovered days later in an access review.

Deployment boundary

Pinned to your infrastructure

Single-tenant VPC and on-premise run the control plane — and everything it evaluates — on infrastructure you choose and operate. Cirvix does not currently offer multi-region replication or per-region data isolation as a product feature; where data lives is wherever you run it. What Cirvix stores at all, regardless of deployment, is covered in full on the Security page.

SLA

99.99%, with credits

Enterprise contracts carry a 99.99% uptime SLA with service credits for shortfalls, defined precisely in the MSA. That is a contractual commitment, not a historical average — Cirvix is in private beta and has not yet accumulated the track record to publish one, and we are not going to imply otherwise.

Procurement

What your security review needs

A Master Services Agreement, a Data Processing Agreement, and a security questionnaire — the same three documents any vendor review asks for.

MSA

Commercial terms, the SLA, and liability — reviewed and negotiated per engagement.

Read the terms →

DPA

Data processing terms for any personal data that passes through Cirvix, including sub-processor terms.

Read the DPA →

Security questionnaire

CAIQ-style or custom — most answers are already public, unscored, on the Security page.

Read the security page →

Rollout

Migration is a sequence, not a switch

Every enterprise rollout follows the same three phases. Nothing enforces on day one.
  1. Phase 1

    Observe

    Deployed in observe-only mode. Nothing is blocked — you get the agent inventory, the execution graph, and a real refusal-rate baseline before a single policy goes live.

  2. Phase 2

    Shadow policy

    Candidate policies run against real traffic in simulation, so you see exactly which calls would flip before anything is enforced. This is the same replay capability described on the Policy Engine module page.

  3. Phase 3

    Enforce

    Policies go live, starting with the highest-confidence rules — egress allowlists, secret access — before graduating to approval-gated writes. Each phase is reversible.

Support

A named contact, not a ticket queue

Enterprise plans include a dedicated, named support contact and an onboarding engineer for rollout. Response commitments are written into the MSA rather than promised in marketing copy — ask for the specifics when you talk to us.

Talk to us

Scope your deployment

Tell us your deployment model, team size, and timeline. Cirvix is founder-led and in private beta, so an Enterprise engagement starts as a conversation, not a form submission into a queue — this goes straight to the Cirvix intake, and the reply comes from the person who builds it.

Prefer to write directly? umang@cirvix.com