Skip to content
Enterprise

Theo for teams that need self-host, SSO, or audit.

Same TheoKit framework, same TheoCloud runtime, same RAG/Memory/Observability built in — on your infrastructure (commercial license) or on TheoCloud Enterprise tier with SSO/SAML, dedicated support, audit logs, and a 99.9% SLA target. Bring your own LLM keys.

Talk to us Read the security page

Why teams choose Enterprise

Your infrastructure, your control.

Self-host the full platform on your AWS, GCP, Azure, or on-prem Kubernetes. Commercial license; standard containers; rebuild anywhere — nothing in the image is Theo-specific.

Compliance roadmap, today's contracts.

SOC 2, LGPD, GDPR roadmap published on /honesty. Public security disclosure policy at /security. Enterprise tier includes contract terms aligned to your audit calendar.

Dedicated support, dedicated cells.

Named support engineer. Multi-cell isolation per tenant. Dedicated cells available for workload-critical accounts.

SLA target: 99.9%.

Uptime commitments defined in contract — the SLA terms define downtime and credits. Status page, incident communication, post-mortem on every Sev-1.

Total cost vs building the agent layer in-house

Building the agent layer in-house typically ties up 3-5 engineers plus DevOps and compliance time for a year. Theo Enterprise frees that team from building it — month-one delivery, and your platform team keeps running your platform.

  • In-house agent-layer build (year 1, typical industry estimate)$300K – $1.2M+
  • Internal team to ramp6 – 12 months
  • Theo Enterprise (year 1)Custom · talk to sales
  • Time to first production deployDays, not quarters

Security & compliance

  • Signed container images on every build (cosign / Sigstore)
  • CycloneDX SBOM per build — every tier
  • SLSA-style build attestation per release
  • Multi-cell tenant isolation (1 K8s cluster per tenant in Enterprise · gVisor sandboxing per workload Pro+)
  • SSO / SAML 2.0 (Okta · Azure AD · Google Workspace · OneLogin)
  • OIDC + SCIM 2.0 user provisioning (Okta · Azure AD)
  • Envelope encryption secrets (AES-256-GCM · KMS-wrapped) at rest and in transit
  • Filterable audit log · 1-year retention · S3/Splunk/Datadog export
  • Public security disclosure (/security · /.well-known/security.txt · 48h ack)
  • Public sub-processor list (/sub-processors · 30-day advance notice)

Let's talk about your workload

Tell us about your team size, stack, and timeline. We'll schedule a 30-min call.

Email sales@usetheo.dev

Or join the conversation on Discord