# Deployment overview

> What deploying Cephable across an organization involves, in the order you will need to do it.

Source: https://help.cephable.com/docs/it-admins/overview

---

This section is written for whoever is responsible for putting Cephable on other people's
machines and keeping it working. It assumes you administer devices and identity, not that
you use Cephable yourself.

## What you are deploying

The Cephable desktop app is a signed application that runs in the user's session. It
requires no server component of your own, and no inbound network access.

Two properties usually decide whether a security review goes smoothly:

- **Processing is local.** Voice recognition, face detection, and the AI assistant run on
  the device. Microphone audio and camera video are never transmitted.
- **Outbound only, over HTTPS.** The app talks to Cephable services for sign-in, licensing,
  and syncing. Nothing listens for inbound connections.

[Privacy and security](/docs/get-started/privacy-and-security) has the detail your security
team will ask for, and [Security review and controls](/docs/it-admins/privacy-and-security)
covers the network requirements, the Trust Center, and the controls your organization has
over the assistant.

## The order to do things in

:::steps
:::step title="Create the organization and verify your domain"
Domain verification is what routes your users' sign-ins to your identity provider instead
of a Cephable password. Do it first — retrofitting it after people have created personal
accounts means account merges.
:::

:::step title="Start single sign-on"
SAML, before the pilot. Cephable configures it with your IT team — email
[support@cephable.com](mailto:support@cephable.com) to begin.
[Single sign-on](/docs/it-admins/identity/single-sign-on).
:::

:::step title="Check device policy"
Camera and microphone policy, and on macOS the Device Control and Data Access permission,
named Accessibility on macOS 26 and earlier. This is the single most common cause of a
stalled pilot.
:::

:::step title="Set governance before the assistant is in use"
Decide your skill and connector policy up front — retrofitting it after members have added
their own is harder. [Governance](/docs/it-admins/governance/automation-rules).
:::

:::step title="Pilot"
A small group across at least two device models, including someone from the helpdesk.
The [rollout planner](/docs/it-admins/rollout-planner) will size this for you.
:::

:::step title="Roll out in waves, then automate"
Once the pattern is stable, ask Cephable to enable SCIM so joiners and leavers are handled
without you. [SCIM provisioning](/docs/it-admins/identity/scim-provisioning).
:::
:::

:::callout type="warning" title="Do not license everyone on day one"
Assigning every seat before the pilot confirms your camera and microphone policy actually
allows the app to run is how rollouts generate large helpdesk queues. Assign per wave.
:::

## What needs a Pro license

Everything in this section describes Cephable Pro or Education capabilities. The pages
themselves are readable by anyone — the configuration detail unlocks when you sign in with
an account that carries an organization license.

:::cards columns="2"
:::card title="Deploying at scale" href="/docs/it-admins/deploying-at-scale" icon="building" license="pro"
The order of operations, the device policy to verify first, and how members join.
:::

:::card title="Managing licenses" href="/docs/it-admins/managing-licenses" icon="clipboard" license="pro"
Members, roles and permissions, seats, and license keys.
:::

:::card title="Single sign-on" href="/docs/it-admins/identity/single-sign-on" icon="lock" license="pro"
SAML sign-in and domain verification across every Cephable client. Set up with Cephable.
:::

:::card title="SCIM provisioning" href="/docs/it-admins/identity/scim-provisioning" icon="code" license="pro"
Automatic joiner, mover, and leaver handling. Enabled by Cephable for your organization.
:::

:::card title="Governance" href="/docs/it-admins/governance/automation-rules" icon="sparkle" license="pro"
Where the assistant may automate, and which skills and connectors members can enable.
:::

:::card title="Security review and controls" href="/docs/it-admins/privacy-and-security" icon="lock"
Network requirements, the Trust Center, and the Cephable Portal controls you have over the assistant.
:::
:::

## Getting help

Organizations with a Pro or Education agreement have a named support contact. If you do
not know who yours is, the [Cephable Portal](https://portal.cephable.com) lists it under
**Organization → Support**.