Enterprise on-premise edition

Enterprise on-premise is the full product on your infrastructure: your machines or your cloud, independent of buff.systems. It is installed by the installation wizard, which distributes the roles across machines, and the same wizard updates it from the release artifacts.

What is included

• Several organisations, member roles and permissions, the audit log.
• User single sign-on through your IdP (Active Directory, Keycloak, SAML, OIDC) — with Authentik as the broker and screens in our design system; password sign-in remains as a fallback.
• A fleet of workers on several machines; usage accounting by organisation and by person — without wallets or payments.
• Models — through the installation’s LiteLLM gateway with your provider: the wizard takes an OpenAI-compatible address (your LiteLLM, vLLM, Ollama) and a key, and the house model is openai/<model name at the provider>; OpenRouter is then not needed. The “work class → model” logic is the same as in SaaS.
• An air-gapped environment without internet: the release package is carried over on media, the licence as a file.
• Access for our operator for support (VPN + operator single sign-on) — under contract, optional; without it, support works from a diagnostic archive taken in the admin panel.

The full comparison with SaaS and Community is on the Editions page.

User single sign-on

The installation sets up its own sign-in broker (Authentik) and registers the “Cabinet” application in it. The broker connects to your provider — Active Directory/LDAP, Keycloak, any SAML or OIDC — through Authentik’s standard sources; the cabinet knows nothing about it: the sign-in screen has a “Sign in with single sign-on” button, and your provider confirms the sign-in.

Who belongs to which organisation and with which role is determined by the broker’s groups — they are mapped to your directory’s groups in Authentik itself:

The organisation is its short name in the cabinet. Groups are read at every sign-in: add a person to a group and they are in the organisation; change the group and the role changes. The organisation appoints its owner itself; a person without any such group is not let in. There is one account per person: an email matching an existing account means the same account, without password confirmation, since the broker is yours. Password sign-in remains as a fallback, including for the administrator.

The broker’s screens — sign-in, application choice, second factor, errors — are styled in the colours of the Buff design system through Authentik’s standard branding mechanism, without a fork: updating the broker does not break them. Support operators (if you have them) sign in through separate groups and applications — users and operators are not mixed.

Mobile app

Employees connect the Buff app for iPhone and Android to the installation: tasks, review, “Ask”, research, the knowledge base and audits — from the phone, with notifications. The phone and the installation meet at the buff.systems gateway and talk with end-to-end encryption: the gateway does not see the content, the installation does not need to open any ports to the outside, it only needs outbound access to buff.systems. An air-gapped installation without such access cannot connect to the app — the cabinet in a browser inside the network works as usual.

The administrator manages access in the admin panel, in the “Mobile app” section: the main switch, who may connect phones (“All employees”, “Roles only”, “Not allowed for employees”), push notifications (“Through buff.systems” or “Off”), the list of employees’ phones with the option to disconnect them, the Buff Code instances signed in to the installation, and the log — in detail in Access policy.

Licence

The licence is issued as a certificate with a limited term — monthly, and you can take several months at once. Installations with a connection renew it automatically after it is renewed in our admin panel; into an air-gapped environment the certificate is carried over as a file. An expired or revoked certificate stops new tasks, runs, research and questions; sign-in and reading remain.

Enterprise is not published in any form: the images, the wizard distribution, updates and the air-gapped package are available only with a valid certificate.

Air-gapped environment

An installation without internet access receives the release on media. On a machine with access, the script buff-enterprise-kit.sh fetch <version> <installation id> <certificate file> uses the certificate to download the role images, the release trees and the stock images (PostgreSQL, Gitea, Windmill, Authentik, the model gateway and the rest) into one directory. Inside the environment the same script’s load distributes the stock images to the installation’s machines over ssh, and serve starts a local registry with the release artifacts — the wizard is given its address. Inside the environment the certificate is entered as a file in the admin panel.

How to get it

Write to us through the form on the site or to the email in the “Contacts” section. After the contract you receive a certificate, access to the artifacts and instructions for installing with the wizard. Machine requirements and the role layout depend on the load — we agree on them before installation.