FAI Orchard — Enterprise Edition

What you get on Team/Business/Enterprise tiers that you don't get on Free/Pro. Multi-region tenancy, SAML + OIDC SSO, audit-log export to your own bucket, custom rate limits, self-host Docker, MSA/DPA.

ℹ️ For pricing detail see /docs/enterprise/pricing. For self-hosting setup see /docs/enterprise/self-host.

§1 — Multi-region tenancy

Cross-region READ requires the `cross-region:read` entitlement, auto-granted at Enterprise tier.

Cross-region WRITE is always denied. Locked as a test invariant across every tier × every entitlement combination — data-residency by construction. Tested.

§2 — Single Sign-On (SAML + OIDC)

SSO providers tested: Okta, Auth0, Microsoft Entra ID (formerly Azure AD), Google Workspace, Ping Identity, OneLogin, JumpCloud.

For step-up MFA, the MCP server returns `insufficient_user_authentication` with `acr_values` when a higher-assurance authentication is needed (e.g., for high-privilege `orchard.admin.*` tools that Enterprise tier can use).

§3 — Audit-log export to your bucket

Available on Business + Enterprise tiers.

Export shape:

``` <bucket>/region=<R>/tenant=<T>/dt=<YYYY-MM-DD>/segment-<NNN>.jsonl ```

• Hive-partitioned for parquet conversion in YOUR warehouse
• SHA-256 manifest per segment verifies against actual file bytes
• Manifest spoofing is detectable
• Retention: 30 days (Business default) → 7 years (Enterprise default)

§4 — Custom rate limits

Default budgets per tier are documented in /docs/enterprise/pricing.

Business + Enterprise can override per-bucket budgets via the operator CLI:

```bash frootai orchard ratelimit override \ --tenant my-org \ --tool orchard.search \ --budget 100k/hour ```

Overrides ship to the Redis-backed rate-limiter and propagate to all self-host instances in your fleet within ~5 seconds.

§5 — Self-host Docker (Business + Enterprise)

```bash docker pull ghcr.io/frootai/mcp-orchard:1.0.0 ```

See Self-host guide for the full deploy playbook (cosign verify + multi-instance fleet + Redis backend + graceful shutdown + audit-export).

§6 — MSA + DPA (Enterprise)

Master Service Agreement + Data Processing Agreement templates are available as part of the Enterprise tier — signed before the first production audit-export goes live. The MSA enumerates SLA credits (99.95% uptime → service credits up to 25% of monthly fee on breach).

Contact [email protected] for the templates.

§7 — Support tiers

§8 — Procurement-pack contents

For Business + Enterprise security reviews, the pre-built procurement pack includes:

1. STABILITY.md (semver promise + LTS window + CVSS-tiered patch timeline): https://github.com/frootai/frootai/blob/main/STABILITY.md
2. SECURITY.md (90-day coordinated disclosure policy): https://github.com/frootai/frootai/blob/main/SECURITY.md
3. Supply-chain attestation tracker: https://github.com/frootai/frootai/blob/main/planning/listings/supply-chain-attestations.md
4. End-to-end verifier: `node frootai-core/scripts/orchard/verify-supply-chain.js --tag orchard-v1.0.0-mcp --json`
5. SBOM (CycloneDX 1.5) attached via `cosign attest --type cyclonedx`
6. SLSA v1.0 Build L3 provenance for every release artifact

This pack collapses typical 2-week vendor-questionnaire cycles to ~1 hour of CISO review.

§9 — Related docs

• Pricing
• Self-host guide
• v1 changelog
• MCP server reference