Enterprise

Enterprise-ready without the enterprise theatre

The version of CommsOperator your procurement team can sign: a dedicated instance in the EU or the US, a DPA and service level framework written into the contract, a pre-answered security questionnaire, custom roles with audit logs, and a migration we do with you. No SSO and no SOC 2 today. We say so here, before procurement finds out.

CommsOperator's enterprise offering includes a dedicated instance in the EU or the US operated by CommsOperator, a GDPR data processing addendum with Standard Contractual Clauses, a published subprocessor list with change notices, pre-answered security questionnaires, role-based access with audit logs, migration assistance from HubSpot, Brevo, and spreadsheets, annual invoicing, and a service level agreement defined in the order form. SOC 2 is planned, not claimed; so are single sign-on and multi-factor authentication.

Request access Read the trust center

Private beta. A person reads every request.

Deployment

Shared, or your own instance

A dedicated instance is a private copy of CommsOperator run for your organization in the region you choose. It is operated by us; nothing is installed on your servers.

Option	Region	For	What it means
Shared instance, EU	Germany (EU)	Default for new workspaces	Multi-tenant instance with workspace isolation. Application servers in Falkenstein, database in Frankfurt, files on the application server.
Dedicated instance, EU	EU region of your choice, Germany by default	Enterprise	A private copy of CommsOperator run for your organization only: your own database, storage, mailbox connectors, and release cadence, hosted in the EU.
Dedicated instance, US	United States	Enterprise	The same private copy hosted in the United States for organizations whose data must stay in the US.

	Shared instance	Dedicated instance
Region	Germany (Falkenstein application, Frankfurt database)	EU region of your choice, Germany by default, or the United States
Isolation	Workspace isolation on a multi-tenant instance	A private copy: your own database, file storage, and mailbox connectors
Encryption key	Shared deployment key	A key of your own
Release cadence	Ours, with a notice to signed-in users before each restart	Agreed with you
Local AI inference	Not offered	On request (Ollama), so AI drafting never leaves your instance
Incident notices	Not yet; no public status page	By email under the service level framework
Uptime commitment	Not published	Stated in your order form, with service credits
Price	On request; private beta	On request

What you get

Six things a procurement team asks about, with the proof and the gaps

Each card leads with the outcome, lists the proof, and names what is not there yet.

Deployment you choose

Run on our shared instance in Germany, or on a private copy of CommsOperator that exists only for your organization.

Shared instance: multi-tenant with workspace isolation, hosted in Germany, the default for new workspaces
Dedicated instance: your own database, file storage, encryption key, mailbox connectors, and release cadence, in the EU or the US
Local model inference (Ollama) on a dedicated instance on request, so AI drafting never leaves your instance
Not offered: self-hosted, on-premises, or air-gapped installs. A dedicated instance is operated by us

Contracts and compliance

Everything your legal team needs to sign is already written, and the numbers that matter live in your order form, not on a marketing page.

Terms of service, acceptable use policy, and AI transparency statement, all public
Data processing addendum with EU SCCs and the UK Addendum, signed on request
Subprocessor list with change notifications and a right to object
Service level framework: uptime commitment, support targets, and credits stated in the order form
Not yet: SOC 2 or ISO 27001 certification

Security review support

Your reviewer gets answers from the people who run the system, including the rows that are partial or planned.

Pre-answered security questionnaire covering architecture, data flows, retention, AI oversight, and tenant isolation
Trust center with a verified status on every control, including what is partial or planned
Responsible disclosure policy and security.txt
Named technical contact during the review
Not yet: an independent penetration test report

Administration and control

Decide who may see, draft, approve, send, export, and delete, per brand and per module, and prove it afterwards.

Owner, admin, editor, and member roles, plus custom roles with five permission levels across 15 modules
Mailbox-level owner, delegate, and read-only access; single conversations can be delegated
Audit log of administrative actions and a full agent activity log with export
Per-workspace AI kill switch, policy packs with dual approval, per-mailbox send caps
Scoped API tokens, signed webhooks, and an MCP server for authorized agents
Not yet: SSO, MFA, or SCIM. Sign-in is by password or emailed one-time code

Onboarding and migration

Go live without migrating a single email: mail stays in your Microsoft 365 tenant and connects with one approval from IT.

Organization-wide Microsoft 365 connector set up with your tenant admin in one session
Contacts, deals, and opt-outs migrated from HubSpot, Brevo, Mailchimp-style exports, and website forms, matched on email so nobody lands twice and no suppression is lost
List validation before the first campaign, so you know which addresses are live before the first send
A named onboarding owner through go-live
Not yet: Google Workspace mailboxes. Microsoft 365 only today

Commercials

One invoice for every brand, an AI bill you can predict, and no lock-in: the mailboxes stay yours in Microsoft 365, and the synced copies are exported or deleted on request.

Annual invoicing, purchase orders, and vendor forms
Per-workspace pricing for multi-brand portfolios, quoted on request; there is no public price list
AI usage as a plan allowance, not a per-resolution meter
No lock-in: mail stays in your Microsoft 365 tenant; data export on request during the term and at termination
Not yet: self-serve bulk export

Procurement pack

Everything your reviewers will ask for, already written

Public documents, no gate, no sales call required to read them.

Security and trust center Data processing addendum Subprocessor list AI transparency statement Service level framework Terms of service Privacy policy Acceptable use policy Enterprise security review pack (pre-answered questionnaire)

Security review

What a security review with us looks like

Four steps, most of them already done before you ask.

Step 1
Read the trust center
Every control has a status verified against the code: shipped, partial, planned, or not offered. Your reviewer sees the gaps before the first call.
Step 2
Take the pre-answered questionnaire
Architecture, data flows, retention, AI oversight, and tenant isolation are already written up. Send back only the rows your template adds.
Step 3
Redline the DPA
We start from our DPA because it describes how the product actually processes data. Reasonable edits are negotiated in the order form.
Step 4
Talk to the operator
A named technical contact who runs the system answers the remaining questions directly, for the whole review.

Honest roadmap

What is not there yet

These appear on nobody's feature list on this site until they ship.

Item	Status
SOC 2 Type I engagement	Planned
SAML or OIDC single sign-on	Planned
Multi-factor authentication	Planned
Independent penetration test	Planned
Public status page	Planned
Self-serve bulk export	Planned

If one of these is a hard requirement for your organization, say so in the access request. You get a straight answer about timing rather than a roadmap slide, and if it does not work for you, we say that too.

Procurement questions

What does a dedicated instance mean exactly?

Your own private copy of CommsOperator, run by us for your organization only: a separate database, file storage, encryption key, mailbox connectors, and release schedule, in the EU or the US. It is operated by us, not installed on your servers.

Can you sign our DPA instead of yours?

We start from our DPA because it describes how the product actually processes data. Reasonable edits are negotiated in the order form.

What uptime do you commit to?

The commitment and the service credits are stated in your order form under the service level framework. We do not publish a marketing uptime figure because we do not yet run a public status page to back it.

Do you support SSO?

Not today. Sign-in is by password or emailed one-time code. SSO is on the enterprise roadmap, and its timing is agreed in writing, never assumed.

How long does onboarding take?

The Microsoft 365 organization connector is set up in one session with your tenant admin, so mail is live on day one. Migrations depend on your sources: WomenTech Network's consolidation covered a CRM, an email tool, and 97 web forms, with a validation pass between each import.

Does the AI send anything without a person?

Not unless an admin turns that on for a workspace. The default is draft-for-review. Auto-send is behind a feature flag, honours the pipeline's policy pack, passes the same daily caps and opt-out checks as a human send, and is downgraded to human approval for likely EU recipients.

Tell us what you run. We will tell you if it fits.

Enterprise conversations start with a real request, not a form-fill and a sequence. Tell us your size, region, and the requirements that are non-negotiable.

Request access Talk to us