Access control, BYOK, self-hosted deployments, on-prem Copilot, SSO & SAML, whitelabeling, Admin API, and flexible data retention—enterprise features for teams with strict security and compliance requirements.
We've been working with security teams at larger organizations to bring Sim into environments with strict compliance and data handling requirements. This post covers the enterprise capabilities we've built: granular access control, bring-your-own-keys, self-hosted deployments, on-prem Copilot, SSO & SAML, whitelabeling, compliance, and programmatic management via the Admin API.
Permission groups let administrators control what features and integrations are available to different teams within an organization. This isn't just UI filtering—restrictions are enforced at the execution layer.
Allowlist specific providers while blocking others. Users in a restricted group see only approved providers in the model selector. A workflow that tries to use an unapproved provider won't execute.
This is useful when you've approved certain providers for production use, negotiated enterprise agreements with specific vendors, or need to comply with data residency requirements that only certain providers meet.
Restrict which workflow blocks appear in the editor. Disable the HTTP block to prevent arbitrary external API calls. Block access to integrations that haven't completed your security review.
Control access to platform capabilities per permission group:
Knowledge Base — Disable document uploads if RAG workflows aren't approved
MCP Tools — Block deployment of workflows as external tool endpoints
Custom Tools — Prevent creation of arbitrary HTTP integrations
Invitations — Disable self-service team invitations to maintain centralized control
Users not assigned to any permission group have full access, so restrictions are opt-in per team rather than requiring you to grant permissions to everyone.
When you configure your own API keys for model providers—OpenAI, Anthropic, Google, Azure OpenAI, AWS Bedrock, or any supported provider—your prompts and completions route directly between Sim and that provider. The traffic doesn't pass through our infrastructure.
This matters because LLM requests contain the context you've assembled: customer data, internal documents, proprietary business logic. With your own keys, you maintain a direct relationship with your model provider. Their data handling policies and compliance certifications apply to your usage without an intermediary.
BYOK is available to everyone, not just enterprise plans. Connect your credentials in workspace settings, and all model calls use your keys. For self-hosted deployments, this is the default—there are no Sim-managed keys involved.
A healthcare organization can use Azure OpenAI with their BAA-covered subscription. A financial services firm can route through their approved API gateway with additional logging controls. The workflow builder stays the same; only the underlying data flow changes.
Run Sim entirely on your infrastructure. Deploy with Docker Compose or Helm charts for Kubernetes—the application, WebSocket server, and PostgreSQL database all stay within your network.
Single-node — Docker Compose setup for smaller teams getting started.
High availability — Multi-replica Kubernetes deployments with horizontal pod autoscaling.
Air-gapped — No external network access required. Pair with Ollama or vLLM for local model inference.
Enterprise features like access control, SSO, and organization management are enabled through environment variables—no connection to our billing infrastructure required.
Copilot—our context-aware AI assistant for building and debugging workflows—can run entirely within your self-hosted deployment using your own LLM keys.
When you configure Copilot with your API credentials, all assistant interactions route directly to your chosen provider. The prompts Copilot generates—which include context from your workflows, execution logs, and workspace configuration—never leave your network. You get the same capabilities as the hosted version: natural language workflow generation, error diagnosis, documentation lookup, and iterative editing through diffs.
This is particularly relevant for organizations where the context Copilot needs to be helpful is also the context that can't leave the building. Your workflow definitions, block configurations, and execution traces stay within your infrastructure even when you're asking Copilot for help debugging a failure or generating a new integration.
Integrate with your existing identity provider through SAML 2.0 or OIDC. We support Okta, Azure AD (Entra ID), Google Workspace, OneLogin, Auth0, JumpCloud, Ping Identity, ADFS, and any compliant identity provider.
Once enabled, users authenticate through your IdP, so its MFA and sign-in policies apply to the authentication event. Sim sessions have their own lifecycle: IdP logout or deprovisioning does not currently revoke an active Sim session or remove organization membership, so those are explicit Sim admin steps during offboarding.
Administrators choose how first-time users enter the organization. For a user without a pending invitation or existing external workspace access, Automatic provisioning adds them through the verified SSO connection as a Member and consumes a billed seat; Team seat counts grow with membership, while fixed-seat plans require available capacity. Invite only authenticates the user but requires access to be granted separately. Existing membership and workspace access remain available. Automatic provisioning never promotes IdP claims into Sim roles and never grants workspace access implicitly.
This centralizes your authentication and audit trail. Your security team's policies apply to Sim access through the same system that tracks everything else.
Customize Sim's appearance to match your brand. For self-hosted deployments, whitelabeling is configured through environment variables—no code changes required.
Brand name & logo — Replace "Sim" with your company name and logo throughout the interface.
Theme colors — Set primary, accent, and background colors to align with your brand palette.
Support & documentation links — Point help links to your internal documentation and support channels instead of ours.
Legal pages — Redirect terms of service and privacy policy links to your own policies.
This is useful for internal platforms, customer-facing deployments, or any scenario where you want Sim to feel like a native part of your product rather than a third-party tool.
Sim maintains SOC 2 Type II certification with annual audits covering security, availability, and confidentiality controls. We share our SOC 2 report directly with prospective customers under NDA.
Data Retention — Configure how long workflow execution traces, inputs, and outputs are stored before automatic deletion. We work with enterprise customers to set retention policies that match their compliance requirements.
We provide penetration test reports, architecture documentation, and completed security questionnaires (SIG, CAIQ, and custom formats) for your vendor review process.
Manage Sim programmatically through the Admin API. Every operation available in the UI has a corresponding API endpoint, enabling infrastructure-as-code workflows and integration with your existing tooling.
User & Organization Management — Provision users, create organizations, assign roles, and manage team membership. Integrate with your HR systems to automatically onboard and offboard employees.
Workspace Administration — Create workspaces, configure settings, and manage access. Useful for setting up isolated environments for different teams or clients.
Workflow Lifecycle — Deploy, undeploy, and manage workflow versions programmatically. Build CI/CD pipelines that promote workflows from development to staging to production.
The API uses standard REST conventions with JSON payloads. Authentication is via API keys scoped to your organization.
Move workflows between environments, create backups, and maintain version control inside or outside of Sim.
Workflow Export — Export individual workflows or entire folders as JSON. The export includes block configurations, connections, environment variable references, and metadata. Use this to back up critical workflows or move them between Sim instances.
Workspace Export — Export an entire workspace as a ZIP archive containing all workflows, folder structure, and configuration. Useful for disaster recovery or migrating to a self-hosted deployment.
Import — Import workflows into any workspace. Sim handles ID remapping and validates the structure before import. This enables workflow templates, sharing between teams, and restoring from backups.
Version History — Each deployment creates a version snapshot. Roll back to previous versions if a deployment causes issues. The Admin API exposes version history for integration with your change management processes.
For teams practicing GitOps, export workflows to your repository and use the Admin API to deploy from CI/CD pipelines.
Is Sim SOC 2 certified, and can we get a copy of the report for vendor review?
Sim maintains SOC 2 Type II certification with annual audits covering security, availability, and confidentiality controls, and shares the report directly with prospective customers under NDA. Sim also provides penetration test reports, architecture documentation, and completed security questionnaires (SIG, CAIQ, and custom formats) for vendor review.
Can we restrict which model providers or integrations are available to certain teams?
Yes, through permission groups that are enforced at the execution layer, not just hidden in the UI. Administrators can allowlist approved model providers so unapproved ones fail to execute, disable specific workflow blocks like HTTP calls, and block integrations that haven't cleared security review — while users outside any permission group keep full access by default.
Does Sim offer SLAs and dedicated support?
SLA terms and dedicated support are established through direct engagement with Sim during the enterprise sales and deployment process rather than through a published self-service SLA. Enterprise customers also work directly with Sim on requirements such as data retention policies, while self-hosted deployments provide full control over the underlying infrastructure.
Does Sim support VPC or on-premises deployment?
Yes, Sim can run entirely within your own network or infrastructure using Docker Compose or Helm charts for Kubernetes. Deployment options include single-node, high-availability, and air-gapped configurations, with the application, WebSocket server, and PostgreSQL database remaining inside your environment.
Does Sim support data residency across regions?
Sim supports regional data handling through self-hosting in your chosen region or BYOK routing to your own model provider, rather than through a built-in multi-region hosting guarantee. Self-hosting keeps the application, WebSocket server, and database within your network, while BYOK can route model traffic directly to providers such as Azure OpenAI or AWS Bedrock.
Can teams roll back a deployed agent to a previous version?
Yes, teams can roll back to a previous version because each workflow deployment creates a version snapshot. The Admin API also exposes version history for integration with change management processes.
Can admins set budget caps or track spend per team?
Sim does not describe numeric per-team budget caps or a per-team spend dashboard; its documented cost-control mechanism is provider and feature allowlisting through permission groups. Admins can restrict model providers, integrations, and platform capabilities by team, while BYOK lets teams use their own provider's billing dashboards and spend controls.
Does using our own LLM API keys (BYOK) keep our data from passing through Sim's servers?
Yes. When you configure your own API keys for providers like OpenAI, Anthropic, Google, Azure OpenAI, or AWS Bedrock, prompts and completions route directly between Sim and that provider without passing through Sim's infrastructure. BYOK is available to everyone, not just enterprise plans, and is the default with no Sim-managed keys involved in self-hosted deployments.
Can Copilot be used without sending workflow data to an external AI service?
Yes. Copilot can run entirely within a self-hosted deployment using your own LLM keys, so prompts containing context from your workflows, execution logs, and workspace configuration route directly to your chosen provider and never leave your network.
What identity providers does Sim support for SSO, and what happens when an employee is deprovisioned?
Sim integrates with Okta, Azure AD (Entra ID), Google Workspace, OneLogin, Auth0, JumpCloud, Ping Identity, ADFS, and any SAML 2.0 or OIDC compliant identity provider. IdP deprovisioning blocks future SSO authentication but does not currently remove Sim membership or revoke active Sim sessions, so offboarding must also remove or suspend access in Sim.
