Identity
Your login, everywhere
Internal apps sign people in through your identity provider. Owners, admins and members control the rest.
Company SSOConnected
- Provider
- Okta
- Protocol
- OpenID Connect
- Apps protected
- 23
- Last change
- Priya K. · 3 days ago
SmallForce Enterprise
AI employees for every department, an internal app platform that hosts a million apps on one server, and search across everything your company knows. Deployed in your account, signed in with your identity provider.
Services
Live activity
Needs approval · Daniel
Pay 14 supplier invoices, $182,400
Northwind Group is a sample company. Search figure from our benchmark on one index. Model calls go to the AI providers you choose.
App platform
Anyone describes the tool they need. An AI employee builds it, ships it behind your company login and keeps it running.
1M+ apps deployed on a single server.
Apps load the moment someone opens them and leave memory when they go quiet. You pay for the apps in use, not every app that exists.
Running nowDeployed, idleEach square is 1,000 apps. Illustrative.
Internal apps1,284 apps · 37 running
| App | Team | Access | Traffic | State |
|---|---|---|---|---|
| vendor-onboarding | Procurement | Okta SSO | 1.2k/min | Running |
| field-quotes | Sales | Okta SSO | 310/min | Running |
| stock-check | Operations | Team only | — | Idle |
| holiday-rota | People | Google list | — | Idle |
| warranty-claims | Support | Okta SSO | 88/min | Running |
Theo · Web developer“Vendor onboarding” is on Preview with Okta sign-in, a database for submissions and storage for tax forms. Promote to Production?
Release log · vendor-onboarding
Full-stack apps
Every app your team asks for ships with its own database, file storage, background jobs and access to your company's tools. Built by an AI employee, owned by you.
export default { async fetch(request, env, ctx) { // Signed in with your identity provider if (!ctx.user) return new Response("Sign in", { status: 401 }); const form = await request.formData(); // Your own SQL database, one per environment const { rows: [vendor] } = await env.DB.query( "INSERT INTO vendors (name, owner) VALUES (?, ?) RETURNING id", [form.get("name"), ctx.user.email], ); // File storage with signed uploads const { upload } = await env.STORAGE.createUpload({ path: `vendors/tax-forms/${vendor.id}.pdf`, contentType: "application/pdf", sizeBytes: Number(form.get("size")), }); // Any connected app, without ever seeing its credentials await env.INTEGRATIONS.execute({ connectionId: env.GMAIL_CONNECTION, toolKey: "GMAIL_SEND_EMAIL", arguments: { to: "ap@northwind.com", subject: "New vendor" }, }); // Background work: a queue and a durable workflow await env.VENDOR_CHECKS.send({ vendorId: vendor.id }); await env.ONBOARDING.create({ params: { vendorId: vendor.id } }); return Response.json({ upload }); }, // Runs every night at 2am async scheduled(controller, env) { const { defaultModelId } = await env.AI.listModels(); await env.AI.createResponse({ model: defaultModelId, input: "Summarize today's vendor sign-ups for procurement.", }); },}; What Theo shipped
A signed-in vendor form with its own database, file storage, a background check queue, an onboarding workflow, a nightly AI summary and a Gmail connection.
Sample usage. Standard Worker APIs your team can read, change or take with them.
Built in
The same backend primitives your engineers reach for, available to every app from its first release. No database to set up, no queue to run, no keys to paste.
env.DB.query(sql, params) A SQLite database for every environment. Preview data never touches Production.
100 MiB default · 10k rows per result
env.STORAGE.createUpload(file) Signed uploads and downloads that go straight from the browser to storage.
500 MiB · 10k objects · 25 MiB a file
env.ASSETS Pages, scripts and images served from the immutable release.
Versioned with every release
env.VENDOR_CHECKS.send(msg) Batch consumers with retries for slow or bursty work.
Per app and environment
env.ONBOARDING.create(run) Multi-step processes that survive restarts and resume where they stopped.
Per app and environment
scheduled(controller, env) Cron triggers for nightly reports, syncs and clean-ups.
triggers.crons
env.AI.createResponse(req) 70+ curated models called server-side, with no API key in your code.
Or your private models
env.INTEGRATIONS.execute(call) Gmail, Salesforce, Stripe and 200+ more, plus your OpenAPI specs and MCP servers.
Credentials never reach app code
fetch(url) Call internal or external services, limited to the destinations you allow.
Outbound allowlist per app
ctx.user The verified person from your identity provider, on every request.
id · email · name · method
env.SALESFORCE_TOKEN Write-only secrets per environment, injected at runtime and never bundled.
AES-256-GCM
env.TELEMETRY Structured events and request logs, searchable from the dashboard.
Kept 365 days
Run them properly
Every app comes with the dashboards and controls your platform team would otherwise build: releases, logs, traffic, and security settings per app.
EditAnalyticsObservabilityReleasesSecurity
Requests per hour · errors in red
Recent requests
14:02:11200POST /api/vendors41 ms
14:02:09200GET /vendors/new12 ms
14:01:58429POST /api/vendors2 ms
14:01:40500POST /api/tax-forms210 ms
14:01:33200GET /9 ms
Security settings
Who can open it
AnyonePasswordGoogle listSSO
Network access
AnyoneIP allowlistBlock all
Outbound connections
AnyOnly listedNone
Browser content policy
Test firstEnforce
Sample app and figures. The tabs and settings are the product's own.
Every change lands on Preview. Promote the exact release you checked, with no rebuild.
Every release is immutable. The previous one is always a click away.
Protect internal systems from a runaway script or a noisy team.
Add Test or Staging next to Preview and Production, each with its own data.
Private AI models
Use the 70+ models we host, or deploy open-weight models privately and fine-tune small ones on your own work.
Modelsnorthwind-prod
| Model | Base | Runs on | State | Used by |
|---|---|---|---|---|
| northwind-support-8b | Fine-tuned · Llama 3.1 8B | Your cloud · Baseten | Serving | |
| northwind-contracts-32b | Fine-tuned · Qwen3 32B | Dedicated · Fireworks | Serving | |
| gpt-oss-120b | Open weights | Your cloud · Baseten | Serving | |
| deepseek-v3.1 | Open weights | Dedicated · Fireworks | Standby | — |
Fine-tuning northwind-support-8b · v4step 2,400 / 3,600
Sample deployment. Northwind models and figures are illustrative.
Open models run inside your own cloud, so prompts, documents and answers never leave it.
Fine-tune on your tickets, contracts and calls. The model learns your products, policies and tone.
A tuned small model handles the routine work. Frontier models step in only when a task needs them.
Where your models run
Private models are hosted and fine-tuned on Fireworks AI and Baseten.
Knowledge search
Contracts, reports, spreadsheets and scanned paperwork, indexed inside your cloud. People and AI employees search it the same way.
What did we agree with Contoso on renewal pricing?
Answer
A 6% annual uplift [1], capped at 8% if Contoso goes past 500 seats [1][3]. Contoso asked to lock it before their Q3 expansion [2].
Benchmark on one index; yours depends on your data and hardware. Source counts are sample data.
AI employees
Hundreds of AI employees across your teams, each with its own role, model and permissions, and one place to see what all of them are doing.
Workforcethis week
| Department | Employees | Tasks done | Waiting | Default model |
|---|---|---|---|---|
| 41 | 3,912 | 2 | Claude Sonnet 5 | |
| 28 | 1,204 | 1 | GPT-5.5 | |
| 17 | 846 | 3 | Claude Opus 5 | |
| 22 | 1,530 | 0 | Gemini 3.8 Flash | |
| 19 | 702 | 0 | GPT-5.5 | |
| 15 | 388 | 0 | northwind-support-8b |
Policy
Set in the dashboard. Enforced by the OS.
Folder, network and command rules are enforced below the model, so a clever prompt can't talk its way past them.
Anything over the threshold you set waits for a person. Everything else gets done.
70+ models from 24 labs, chosen per employee, or your team's own ChatGPT and Grok plans.
Sample company. Departments and figures are illustrative.
Security
Controls live in the product, where your team can see and test them. The questionnaire, architecture notes and DPA are ready when you are.
Identity
Internal apps sign people in through your identity provider. Owners, admins and members control the rest.
Company SSOConnected
Isolation
Every app and every AI employee runs in its own sandbox, with its own data and only the access you grant.
vendor-onboarding
Secrets
Secrets are encrypted with AES-256-GCM, injected at runtime and never shown again, not even to admins.
Secretskeyring v2
Deployment
Every component ships as containers you can run in your own account. Or we run a dedicated deployment for you.
What runs in your account
| SmallForce Cloud | Your cloud | |
|---|---|---|
| Where it runs | A dedicated machine we operate | Your AWS, GCP or Azure account |
| Your data | Isolated to your company | Stored only in your account |
| Upgrades | Automatic | Scheduled with your team |
| Network | Our managed network | Your VPC and firewall rules |
Model calls go to the AI providers you choose.
Pilot
Real work on a real team, with success agreed up front.
Roll out
SSO, permissions and data sources, team by team.
Operate
A shared channel and regular reviews of what the team is doing.
Talk to sales
Tell us what you want to run. We'll come back with a pilot plan, an architecture review and pricing for your deployment.
Request received
Thanks. A solutions engineer will be in touch soon.
In the meantime, you can book a call directly.