Deployment overview
What deploying Cephable across an organization involves, in the order you will need to do it.
This section is written for whoever is responsible for putting Cephable on other people's machines and keeping it working. It assumes you administer devices and identity, not that you use Cephable yourself.
What you are deploying
The Cephable desktop app is a signed application that runs in the user's session. It requires no server component of your own, and no inbound network access.
Two properties usually decide whether a security review goes smoothly:
- Processing is local. Voice recognition, face detection, and the AI assistant run on the device. Microphone audio and camera video are never transmitted.
- Outbound only, over HTTPS. The app talks to Cephable services for sign-in, licensing, and syncing. Nothing listens for inbound connections.
Privacy and security has the detail your security team will ask for, and Security review and controls covers the network requirements, the Trust Center, and the controls your organization has over the assistant.
The order to do things in
- 1
Create the organization and verify your domain
Domain verification is what routes your users' sign-ins to your identity provider instead of a Cephable password. Do it first — retrofitting it after people have created personal accounts means account merges.
- 2
Start single sign-on
SAML, before the pilot. Cephable configures it with your IT team — email support@cephable.com to begin. Single sign-on.
- 3
Check device policy
Camera and microphone policy, and on macOS the Device Control and Data Access permission, named Accessibility on macOS 26 and earlier. This is the single most common cause of a stalled pilot.
- 4
Set governance before the assistant is in use
Decide your skill and connector policy up front — retrofitting it after members have added their own is harder. Governance.
- 5
Pilot
A small group across at least two device models, including someone from the helpdesk. The rollout planner will size this for you.
- 6
Roll out in waves, then automate
Once the pattern is stable, ask Cephable to enable SCIM so joiners and leavers are handled without you. SCIM provisioning.
Assigning every seat before the pilot confirms your camera and microphone policy actually allows the app to run is how rollouts generate large helpdesk queues. Assign per wave.
What needs a Pro license
Everything in this section describes Cephable Pro or Education capabilities. The pages themselves are readable by anyone — the configuration detail unlocks when you sign in with an account that carries an organization license.
The order of operations, the device policy to verify first, and how members join.
Members, roles and permissions, seats, and license keys.
SAML sign-in and domain verification across every Cephable client. Set up with Cephable.
Automatic joiner, mover, and leaver handling. Enabled by Cephable for your organization.
Where the assistant may automate, and which skills and connectors members can enable.
Network requirements, the Trust Center, and the Cephable Portal controls you have over the assistant.
Getting help
Organizations with a Pro or Education agreement have a named support contact. If you do not know who yours is, the Cephable Portal lists it under Organization → Support.
Related
Rollout planner
Work out a phased Cephable rollout for your organization — pilot size, early adopters, timing, and the license and identity work each phase depends on.
Deploying at scale
What a Cephable rollout involves — getting the app onto devices, getting people into your organization, and the device policy to check first.
Managing licenses and members
Add members, assign seats, set what each role can do, and activate license keys.