NoemaAI for organizations
Enroll employees, set role policy and manage approved devices from one console. Employees use the Noema app with company knowledge that stays in your environment and on approved devices.
What Teams includes
The production console manages workspace accounts and encrypted delivery. Your customer connector remains the authority for protected device access, sources and inference policy.
With Noema 4.2 or later, employees import a device profile approved by your company authority. The app verifies its customer signature and enforces the approved datasets, tools, models, endpoints and offline lease.
Encrypt documents with the customer publisher before uploading an artifact to Noema. Only approved recipient devices can decrypt it. Direct retrieval keeps source files and indexes on your company server.
Console roles govern administration and encrypted delivery. Customer-signed policies separately govern source access, models, tools, approved inference endpoints and off-grid operation.
The app checks company policy where tools and inference run. An expired lease or device reboot locks protected access until a fresh policy is obtained, while retaining encrypted content for renewal.
Use verified email and DNS domain ownership for workspace enrollment. Customer connectors can integrate configured OIDC and SCIM, while customer administrators separately approve and revoke content-access devices.
The console records administrative actions such as invites, role changes, and device registrations. Employees’ local prompts and answers are not sent to the console.
Architecture
Approved devices decrypt and run models locally. Your company connector holds sources, keys and policy signing. The Noema service handles accounts, audit records and encrypted delivery, and holds no keys.
Plaintext content and keys stay on this side
Zone 1
Employee iPhone, iPad or Mac running Noema 4.2 or later
Uses independently approved device keys
Zone 2
Runs in your environment, under your control
Holds your signing and decryption keys
Ciphertext only
Zone 3
Operated by NoemaAI
Holds no customer signing or decryption keys
Company knowledge
Answer from approved internal documents. Original documents, private indexes and decryption keys stay in your environment and on approved devices.
Use encrypted offline datasets, or retrieve authorized passages directly from your company connector.
Connecting documents is retrieval. It does not train the model.
Technical details
| Platforms | Protected employee workflows require Noema 4.2 or later on iPhone, iPad or Mac. |
|---|---|
| Policy | Customer-signed, bound to the approved employee and device, with a bounded offline lease. |
| Datasets | Customer-encrypted bundles and direct company retrieval; Noema stores ciphertext without decryption keys. |
| Models | Governance by format and by specific model ID. |
| Backends | Customer-approved inference origins, paths and models, checked at request time. |
| Identity | Configured OIDC JWT exchange and SCIM provisioning in the customer connector; deployment validation is required. |
| Further integrations | Provider-specific document adapters, SAML and MDM are not included in this release. |
Questions
Offline datasets are decrypted on approved devices. Direct retrieval sends a query to your company connector, and optional remote inference sends context only to an endpoint your company approves. The protected path keeps plaintext content and decryption keys outside Noema infrastructure.
Yes, within the customer-signed offline lease and with the required data already installed. Off-grid policy blocks online retrieval and remote inference. Lease expiry or reboot requires policy renewal before protected work can continue.
Revoke customer content access in your company connector. Online requests then fail and a device erases governed data when it receives revocation; an offline device remains bounded by its signed lease. Revoking a Noema delivery credential separately stops ciphertext downloads.
The customer connector includes configured OIDC JWT exchange and SCIM users, groups and deactivation. It requires your identity-provider setup and validation, plus independently approved device keys. SAML is not included. Protected access in the app requires Noema 4.2 or later on iPhone, iPad or Mac.
Noema Teams is a paid service offered by arrangement, covering deployment, administration and support where your organization needs it. Pricing, scope, support and billing are agreed with each organization before service begins.
Start a conversation
Email us a short description and we’ll follow up with a practical next step. Please do not send confidential datasets; data transfer follows an agreed scope and handling process.
Helpful to include
