Enterprise

Sim Enterprise adds fine-grained access control, SSO, audit logging, compliance features, and workspace forking on top of Team plans.

Access Control

Define permission groups on a workspace to control what features and integrations its members can use. Permission groups are scoped to a single workspace — a user can belong to different groups (or no group) in different workspaces.

External workspace members can be assigned to permission groups just like internal organization members, but they remain outside the organization roster and do not consume seats.

Features

• Allowed Model Providers - Restrict which AI providers users can access (OpenAI, Anthropic, Google, etc.)
• Allowed Blocks - Control which workflow blocks are available
• Platform Settings - Hide Knowledge Base, disable MCP tools, disable custom tools, or disable invitations

Setup

1. Navigate to Settings → Access Control in the workspace you want to manage
2. Create a permission group with your desired restrictions
3. Add workspace members to the permission group

Any workspace admin on an Enterprise-entitled workspace can manage permission groups. Users not assigned to any group have full access. Restrictions are enforced at both UI and execution time, based on the workflow's workspace.

See the Access Control guide for full details.

Single Sign-On (SSO)

Enterprise authentication with SAML 2.0 and OIDC support. Works with Okta, Azure AD (Entra ID), Google Workspace, ADFS, and any standard OIDC or SAML 2.0 provider.

See the SSO setup guide for step-by-step instructions and provider-specific configuration.

Whitelabeling

Replace Sim's default branding — logos, product name, and favicons — with your own. See the whitelabeling guide.

Audit Logs

Track configuration and security-relevant actions across your organization for compliance and monitoring. See the audit logs guide.

Data Retention

Configure how long execution logs, soft-deleted resources, and Chat data are kept before permanent deletion. See the data retention guide.

Data Drains

Continuously export workflow logs, audit logs, and Chat data to a customer-owned S3 bucket or HTTPS webhook on a schedule. See the data drains guide.

Workspace Forks

Clone a workspace into a linked child, then push or pull deployed workflow changes between them. Deploy is like a commit; sync is a force push or force pull. See the workspace forks guide.

Self-hosted setup

Self-hosted deployments unlock enterprise features through environment configuration instead of billing. One switch turns on the whole set:

ENTERPRISE_ENABLED=true
NEXT_PUBLIC_ENTERPRISE_ENABLED=true

Each feature also keeps its own flag, so you can enable them one at a time or switch a single feature back off.

Most of these features read their settings from the organization that owns a workspace, so a deployment also needs an organization model — either one instance-wide organization that every user joins automatically, or organizations you provision yourself through the Admin API.

See the self-hosted enterprise guide for the full variable list, both organization patterns, the Admin API reference, and troubleshooting.

Once enabled, each feature is configured through the same Settings UI as Sim Cloud. When invitations are disabled (DISABLE_INVITATIONS, NEXT_PUBLIC_DISABLE_INVITATIONS), use the Admin API (x-admin-key header) to manage organization membership and workspace access. Internal members join the organization; external workspace members only receive access to a specific workspace.