Principals need key custody and a memory horizon. A practice needs that, plus an admin console, centralized billing, SSO, org-level audit, and a BAA the compliance officer will actually sign. Every organizational tier starts with everything individual, then adds the surfaces a practice can’t operate without.
Every organizational tier is end-to-end encrypted, post-quantum, and TEE-isolated. What changes is the breadth of the admin surface, the dedication of infrastructure, and the contractual envelope around both.
| Capability | Teams Professional | Teams Executive | Enterprise |
|---|---|---|---|
| Seat minimum | 5 | 10 | 25 |
| Memory horizon | 7–90 days | Indefinite | Indefinite |
| Key custody | Platform-managed | User-held + admin policy | Client-controlled |
| Infrastructure | TEE shared pool | TEE shared pool (dedicated opt.) | Dedicated single-tenant |
| Models | 7B / 8B | Up to 70B | Up to 70B + custom |
| Org admin console | ✓ | ✓ | ✓ |
| Centralized billing | ✓ | ✓ | ✓ |
| Org-level signed audit log | ✓ | ✓ | ✓ |
| BAA workflow | ✓ | ✓ | ✓ |
| SSO / SAML | — | ✓ | ✓ |
| Role-based memory policies | — | ✓ | ✓ |
| Dedicated implementation | — | Opt. | ✓ |
| Custom MSA / DPA | — | — | ✓ |
| On-call security (1-hr SLO) | — | — | ✓ |
Every tier inherits Ghost Mode, response-signature verification, and the ML-KEM-768 / ML-DSA-65 post-quantum envelope by default.
Short answers, linked to the artifact that backs them. If something is on the roadmap rather than shipped, it is labelled so — not hidden.
Full tier architecture, seat minimums, and what every tier includes are on the pricing page. The snapshot below is the shape of the thing.
Teams Professional and Teams Executive begin with a short application and a thirty-minute call. Enterprise begins with a conversation about your procurement window.