Enterprise

Thousands of services, one system of record

Run Elva across every team, in your own cloud, with SSO, approval workflows, and an audit trail your auditors will actually accept. The same platform Ticketmaster, FIS and Fortune 500 teams already run on Theneo.

Talk to sales Read the security page

20,000COMPANIES ON THENEO

99.9%UPTIME SLA

UnlimitedWORKSPACES AND MEMBERS

On-premOR YOUR PRIVATE CLOUD

01Rollout

Every team, without a migration project

Connect repos service by service. Each team keeps its own workspace, contracts, and policies, while platform gets one view across all of them and a single place to set the rules.

Unlimited workspacesOne per business unit or product line, with inherited defaults so nobody re-invents your governance rules.

Central policy, local autonomyPlatform sets what must be true. Teams pick how strict to be above that floor, and see the diff.

Fleet view across servicesOne catalog spanning hundreds of repos, deduplicated, with an owner attached to every endpoint.

02Control

Approvals, roles, and an audit trail

Breaking changes route to the people who own the consequence. Every proposal, approval, and publish is recorded with who, what, when, and which policy applied, exportable to your systems.

Audit trailexportable · custom retention

TIMEACTORACTIONPOLICYRESULT

14:22:08n.k@acme.comProposed removing "buildLog" from DELETE /builds/{id}payouts-partner · blockpending

14:31:44platform-lead@acme.comApproved breaking change, bumped contract to v1.5partner · approval requiredapproved

14:31:49elva-systemRegenerated spec, docs, SDKs, Postman collection, MCP servercontract deploypublished

14:31:52elva-systemNotified 4 stakeholders and 1 partner integrationnotify on publishsent

15:04:11j.doe@acme.comAttempted publish of orders-public with 2 failing contract testspublic · block-publishblocked

15:19:02security@acme.comRevoked key elva_test_...44b0 after scope escalation attemptkey lifecyclerevoked

Exportable audit trailFilter by actor, contract, or policy, then export to your SIEM as JSON, CSV, or a webhook. You set the retention.

Role-based permissionsSeparate who can read the catalog, edit a contract, approve a breaking change, and revoke a key.

Approval workflowsRoute by audience: partner and agent contracts need a named approver, internal ones do not.

03Identity

Works with every identity provider

Identity providers were built for people signing in to apps. Elva extends the one you already run to AI agents, so every agent gets its own identity and access follows your existing teams and roles.

OktaMicrosoft Entra IDAuth0WorkOSGoogle WorkspacePing IdentityAny SAML / OIDC

SAML 2.0 and OIDCSingle sign-on against the directory you already run, enforced across every workspace. No second password to rotate.

SCIM provisioningGroups arrive as roles and stay in sync. Deprovisioning someone in your IdP removes their access here, immediately.

Every agent gets its own identityAgents and keys resolve to a named service identity that inherits a team, not a shared account nobody can revoke alone.

04Compliance

SOC 2 Type II, ISO 27001, GDPR

The certifications are held by Theneo, Elva’s parent, and cover the infrastructure Elva runs on. Ask for the pack and the report, the certificates, and the pen test summary arrive with dates attached. The full posture table lists every control behind them.

certified

SOC 2 Type II

Audited controls over security, availability, and confidentiality. The report goes to your team under NDA.

certified

ISO 27001 / 27701

A certified information security management system, extended by 27701 to cover privacy. Certificates on request.

compliant

GDPR

A DPA with a current subprocessor list, EU data residency on request, and deletion that reaches the logs too.

In the security pack

sent under NDA

SOC 2 Type II report, under NDA
ISO 27001 and ISO 27701 certificates
Latest third-party penetration test summary
DPA with the current subprocessor list
Completed security questionnaire
Architecture and data-flow diagram

Request the security pack →

05Deployment

Your cloud, your perimeter, your residency

Run Elva as hosted SaaS, in a private cloud in your account, or fully on-prem. MCP servers can run inside your VPC on a custom domain, with logs staying in your own storage.

Hosted SaaSFastest path. Managed upgrades, 99.9% SLA, regional data residency options.

Private cloudDeployed into your account. Your VPC, your KMS keys, your network policy, our upgrades.

On-premAir-gapped installs for regulated environments. Same contracts, same gateway, no egress.

06Support

A named engineer, not a ticket queue

Enterprise plans include a dedicated engineer who knows your architecture, a security review with your team, a signed DPA, and a migration plan for the repos that matter first.

Dedicated engineerOne person who knows your services, your policies, and your rollout order.

99.9% SLAWritten uptime commitment on the gateway, with status transparency and incident review.

Security review and DPAWe come to your review, answer the questionnaire, and sign the paperwork.

Guided rolloutWe map your first ten services with you, then hand the pattern to your teams.

FAQ

Can Elva run in our own environment?

Yes. Enterprise runs in a private cloud or on-prem, including self-hosted MCP servers and a custom domain such as mcp.yourcompany.com.

Does Elva support SSO and SCIM?

Enterprise includes SSO/SAML and SCIM provisioning, along with audit logs and an exportable contract audit trail.

Which identity providers does Elva work with?

Any SAML 2.0 or OIDC provider, including Okta, Microsoft Entra ID, Auth0, WorkOS, Google Workspace, and Ping Identity. SCIM keeps groups, roles, and deprovisioning in sync, and every agent gets its own identity in the audit trail.

Is Elva SOC 2 and ISO 27001 certified?

SOC 2 Type II and ISO 27001/27701 are held by Theneo and cover the infrastructure Elva runs on. GDPR is covered by a DPA with EU data residency on request. The report, certificates, and latest penetration test summary are sent under NDA.