Enterprise overview

The Enterprise tier of AACsearch is for organizations that need contractual controls (DPA, SLA, security questionnaire) and a few features that the standard plans do not include — SAML/OIDC SSO, SCIM provisioning, and dedicated infrastructure.

This page is honest about what is generally available, what is custom, and what is roadmap. If a control you need is not on this list, please ask before assuming.

What you get on Enterprise

Who Enterprise is for

You probably want Enterprise if any of these apply:

• Your security review process requires a signed DPA, MSA, and SOC 2 report — not a click-through.
• You need SAML or OIDC for sign-in, with provisioning controlled by your IdP.
• A search outage of more than 15 minutes costs you measurable revenue, and you need an SLA with a credit schedule, not best-effort uptime.
• Your compliance team requires a named contact for incident response.
• You need a dedicated cluster (no neighbors), or you are evaluating a private deployment.

You probably don't need Enterprise if you are happy with the standard DPA, 99.9 % shared SLA, and the security controls available to every plan. Most of the security model on the Security overview page is the same regardless of plan.

How to start

1. Read the security and operational docs first. That gives you the technical baseline to compare against.
2. Email sales@aacsearch.com with a short description of your use case, your data residency requirements, and any non-negotiables (SAML, dedicated cluster, custom SLA).
3. We'll schedule a 30-minute scoping call and respond to your security questionnaire within 5 business days.
4. After scoping, we send a draft MSA + DPA. You can hand off to legal in parallel with a technical evaluation.

Typical time from first email to signed contract: 2–6 weeks, depending mostly on your side.

Procurement and compliance documents

The following are available on request, gated by an NDA:

• SOC 2 Type II report — see SOC 2 checklist for the current scope.
• Penetration test summary, latest available.
• Data flow diagram for the region you will deploy into.
• Sub-processor list with locations and purposes.
• Standard DPA (no NDA needed — request from sales@aacsearch.com).
• Standard security questionnaire (CAIQ-style; we can also fill SIG Lite).

See Procurement for the full process and document set.

Things we will not sign

• Liability terms that put us on the hook for indirect damages we cannot meaningfully control.
• "Right to audit" clauses that mean an unannounced on-site visit. We will accept "reasonable notice" right-to-audit clauses against the latest SOC 2 report.
• A custom SLA that we cannot operationally meet. We'd rather say no than promise something we'll miss.

We are happy to discuss alternatives for any of these. The point of being explicit is to save your legal team time on a clause we will eventually push back on anyway.

See also

• Security overview — all the controls available regardless of plan
• Procurement — the document set and the typical timeline
• Dedicated cluster — when you need to be the only neighbor