# Chainsaw for Enterprise IT > For Enterprise IT and shared-services teams: roll out dependency policy centrally, pick cloud or on-prem, keep governance light. Source: https://chain305.com/solutions/enterprise-it/ --- For Enterprise IT # One org-wide policy for every team Deploy once on managed SaaS, in your VPC or air-gapped. Rules are scoped by repository; for several business units, we scope the rollout with you. Rollout for shared services ## Org-wide governance in three steps 1. 01 Stand up one instance Managed SaaS, your cloud or air-gapped. Same binary, same API. 2. 02 Publish the policy centrally One org-wide policy for vulnerabilities, licenses, provenance and supply-chain signals. 3. 03 Scope rules by repository Target a rule at specific repositories. Exceptions carry an expiry and optional two-person approval. Availability ## HA without a platform team Two replicas behind a health check, and fail-over is automatic. Part Behaviour Proxy Stateless. Any Kubernetes, ECS or Nomad scheduler; no sticky sessions. Control plane Your managed database: RDS, Cloud SQL or self-managed. Cache Local disk for dev, S3-compatible blob store for prod. Degraded data Fails open with an audit row by default. CHAINSAW\_COVERAGE\_MODE=closed refuses anything not fully checked against your mandatory sources. Upstream outage Served from cache. Metrics 50+ Prometheus counters. OpenTelemetry tracing is opt-in. Identity SAML 2.0, OIDC and SCIM 2.0 on Team and Enterprise. Admin, manager and viewer roles with fine-grained API scopes. [Supported IdPs](https://chain305.com/integrations/) Hardening levels ## Four levels, one rollout path Each level is additive: same proxy, same policy, more tooling around it. [Each level in detail →](https://chain305.com/product/enterprise-rollout/) Level Adds Effect L1 Monitor only Audit every install. Block nothing. L2 Admission webhook Cluster-side enforcement on Kubernetes. L3 Egress allowlist Block direct registry access at the network edge. L4 MDM payloads Lock the registry config on managed laptops. Air-gapped ## Disconnected from the public internet Runs fully air-gapped [on Enterprise](https://chain305.com/pricing/). 1. 01 · Signed intel bundle `chainsaw-intel-bundle-YYYY-MM-DD.tar.gz` - Trivy DB - KEV - OSV malware - GHSA 2. 02 · Verify `chainsaw bundle verify` on your transfer schedule 3. 03 · Apply `chainsaw bundle apply` loaded from CHAINSAW\_INTEL\_BUNDLE\_PATH instead of phoning home Migration ## Front your existing registry Chainsaw [slots in front](https://chain305.com/product/how-it-works/) of what you run today. You run How Chainsaw fits Artifactory / Nexus Keep them. Chainsaw fronts the public registries they proxy. Zero dual-publish. Cloudsmith / JFrog SaaS Point Chainsaw's upstream at it; your URLs stay. Verdaccio / npm mirror The mirror stays; Chainsaw replaces the public hop. No .npmrc change. Snyk / SCA scanners Run both. Chainsaw decides what enters; SCA reports what is there. Need on-prem or air-gapped? ## Let's scope the deployment together On-prem comes with the Enterprise plan. Book a 30-minute call to scope yours. [Scope an on-prem rollout](https://cal.com/chain305/30min) [Talk to platform](https://cal.com/chain305/30min) --- ## Long form The full text behind this page, including detail the page itself leaves out. For Enterprise IT ### One org-wide policy for every team Deploy once — managed SaaS, your own VPC, or fully air-gapped. One org-wide policy set, with rules scoped by repository and exceptions that carry an expiry and optional two-person approval. For estates with several business units, we scope the rollout with you. The pain - Dependency policy lives with individual teams — no central rollout path. - Tooling requires either a cloud footprint or a heavy on-prem install with no path between them. - Every new control adds latency to developer workflows. - Air-gapped networks need a story that isn't "rebuild from scratch every release". - A public attack like Shai-Hulud lands — or a security questionnaire does — and there's no install-time control to point to. What changes ##### Central rollout, local enforcement Deploy once; teams inherit the baseline with room for local additions. Governance without flattening. ##### Managed, cloud, or air-gapped Managed SaaS, your own Kubernetes or Docker, or fully air-gapped. Same binary, same API, same policy format. ##### Cache-backed performance Repeat installs answer from cache. Rollout doesn't become a new helpdesk ticket queue. Availability #### HA topology that doesn't need a platform team Chainsaw's proxy tier is stateless. Scale it horizontally behind any load balancer. The management plane runs on a managed relational database with an optional Redis or NATS queue for webhook delivery at scale. Stand up two replicas, put a health check in front, and fail-over is automatic. - **Stateless proxy:** any Kubernetes, ECS, or Nomad scheduler works. No sticky sessions. - **Managed-database control plane:** bring your own RDS, Cloud SQL, or self-managed instance. - **Blob-store cache:** local disk for dev, S3-compatible for prod. Purge and re-populate without downtime. - **Fail-open or fail-closed:** a deployment-level setting, fail-open by default. CHAINSAW\_COVERAGE\_MODE=closed makes Chainsaw refuse any package it could not fully evaluate against the data sources you declare mandatory; left unset, a degraded source fails open with an audit row. Upstream-registry outages are served from cache. - **Prometheus metrics:** 50+ counters out of the box. OpenTelemetry tracing is opt-in. Identity #### SSO, SCIM, and RBAC without custom code SAML 2.0, OIDC, and SCIM 2.0 ship on Team and Enterprise. Any compliant IdP works; these are the ones we see most often. RBAC has admin, manager, and viewer roles with fine-grained API scopes, and SCIM drives provisioning and deprovisioning automatically. **Okta** SAML 2.0 · OIDC · SCIM 2.0 **Microsoft Entra (Azure AD)** SAML 2.0 · OIDC · SCIM 2.0 **Google Workspace** OIDC · SCIM 2.0 **Auth0** OIDC **Keycloak** OIDC **Generic SAML 2.0 / OIDC** Any compliant IdP Air-gapped #### Disconnected from the public internet, end to end Chainsaw runs fully air-gapped [on Enterprise](https://chain305.com/pricing/). The server URL can be baked into the CLI at build time, so your engineers never see a public origin. Sync the malware index, the typosquat seed lists, and the CVE database into your environment on whatever cadence you want; Chainsaw reads them from the local filesystem. `CHAINSAW_WEB_UI_URL`, `FORCE_HTTPS`, and `NEXT_APP_BASEPATH` let the dashboard live on a subpath of your internal domain. Cross-platform binaries ship for macOS, Linux, and Windows, each with a published SHA-256 checksum for download verification. Migration #### Front your existing registry — don't rip it out Most teams already run something: Artifactory for internal artifacts, Cloudsmith for a subset of public packages, a Verdaccio mirror, or an SCA tool doing post-install reporting. Chainsaw [slots in front](https://chain305.com/product/how-it-works/) of whichever you have. - **Artifactory / Nexus** Keep them. Chainsaw sits in front of the public registries they proxy. Internal artifacts keep resolving out of Artifactory; public installs route through Chainsaw's policy. Zero dual-publish. - **Cloudsmith / JFrog SaaS** Point Chainsaw's upstream at the Cloudsmith registry. Your team keeps using Cloudsmith URLs; Chainsaw enforces policy on every fetch. - **Verdaccio / internal npm mirror** Chainsaw replaces the public-upstream hop and keeps the mirror in place. No change to the developer's .npmrc. - **Snyk / SCA scanners** Run both. Chainsaw decides what can enter; your SCA tool reports on what's already there. They target different stages. Hardening levels #### Four levels of enforcement, one rollout path Most teams start at Level 1 (monitor) and stop at Level 2. Regulated environments push to Level 3 or 4. Each level is additive — same proxy, same policy, more tooling around it. On Team and Enterprise, the /onboarding/hardening wizard generates the manifests, firewall snippets, and MDM payloads ready to apply. 1. L1 ### Monitor only Audit every install. Block nothing. The proxy logs every package decision with a structured row. Rules ship in monitor mode by default; the daily report tells you which installs would have failed. Zero developer disruption — every CI job, every laptop install passes through the audit log. Tooling: proxy + dashboard. 2. L2 ### \+ Admission webhook Cluster-side enforcement on Kubernetes. Add a Kubernetes ValidatingAdmissionWebhook so workloads pulling images outside policy are rejected at apply-time. Closes the 'CI sneak-around via direct kubectl apply' gap that monitor mode can't see. Helm chart and Kustomize overlay shipped with the runbook. Tooling: + K8s admission controller. 3. L3 ### \+ Network egress allowlist Block direct registry access at the network edge. Push a firewall / egress-policy snippet that allowlists Chainsaw's proxy and denies direct egress to npmjs.org, pypi.org, registry-1.docker.io, etc. Now the proxy is the only path — no developer can fall back to the public registry by editing one line of .npmrc. Tooling: + network egress policy. 4. L4 ### \+ MDM payloads on managed laptops Lock the developer machine. Distribute MDM (Jamf, Intune, Workspace ONE) payloads that pin the package-manager registry config, prevent override, and bake the proxy URL into the laptop image. Air-gapped variant available for regulated environments. The CLI ships with a baked server URL so engineers never see a public origin. Tooling: + MDM profile + checksum-verified CLI build (SHA-256). Rollout for shared services #### Org-wide governance in three steps 1. ### Stand up one Chainsaw instance Managed SaaS, self-hosted on your cloud (Docker or Kubernetes), or fully air-gapped. Same binary, same config surface, same API. 2. ### Publish the policy centrally Define one org-wide policy for vulnerabilities, licenses, provenance, and supply-chain signals. 3. ### Scope rules by repository Target a rule at specific repositories. Exceptions carry an expiry and optional two-person approval. Need on-prem or air-gapped? #### Let's scope the deployment together On-prem comes with the Enterprise plan. For bespoke deployments, network constraints, or negotiated contracts, book a 30-minute call. [Scope an on-prem rollout](https://cal.com/chain305/30min) [Talk to platform](https://cal.com/chain305/30min)