Skip to main content
nao Enterprise is the licensed tier of nao. It unlocks capabilities such as SSO, unlimited User Groups, nao-managed row-level security, Microsoft Entra ID identity passthrough, and white-label branding. On self-hosted nao, it runs on the same deployment you already use for OSS nao. On nao Cloud, an organization can hold its own Enterprise license (see nao Enterprise on nao Cloud).

​
What’s included

The capabilities available on a given license are encoded in the signed license payload. User Group SSO mapping requires the sso entitlement, unlimited custom groups require user-groups, member and group budgets require user-budget, and nao-managed row-level security and per-group MCP and skill restrictions require row-level-security.

​
Getting a license

nao Enterprise licenses are issued per company on a yearly subscription. To request a quote and a license key:
  1. Email claire@getnao.io with your company name, expected user count, and the features you need.
  2. We send back a quote and, once signed, a license key tied to your subscriptionId.
  3. On self-hosted nao, you install the key as the NAO_LICENSE environment variable on your deployment (see below). On nao Cloud, nao installs it on your organization.
Trial licenses are available on request.

​
Installing the license

The license is a signed token. Verification happens offline at server startup against the public key bundled in the build, so your nao deployment never has to phone home to validate the license.
  1. In your deployment environment (e.g. Cloud Run, ECS, Kubernetes), set:
  2. Restart the nao backend. On startup, the server logs the license verification result.
  3. Sign in as an admin and open Settings -> Enterprise. The page shows the license status, expiry date, company name, and the list of activated features.

​
License statuses

The Enterprise settings page reports one of four statuses:
  • Active - signature valid and within expiry. Enterprise features are enabled.
  • Expired - signature valid but the expiry date has passed. Renew the license to re-enable Enterprise features.
  • Invalid - NAO_LICENSE is set but verification failed (bad signature, malformed token, key mismatch). Check that you copied the full key and that you’re on a recent nao build.
  • Unlicensed - NAO_LICENSE is not configured. The deployment runs in OSS mode.
When a license expires or becomes invalid, the gated Enterprise features are disabled cleanly - the rest of nao keeps running as the OSS build.

​
nao Enterprise on nao Cloud

A nao Cloud organization can hold its own signed Enterprise license, bound to that organization. nao installs it for you once the license is signed: there is no environment variable to set on Cloud. The organization license unlocks the features configured per project or organization: SSO and white-label branding are configured for the whole instance, so an organization license does not unlock them on nao Cloud.
Organization licenses have no grace period: when the expiry date passes, the gated features turn off immediately. An organization license cannot be used as NAO_LICENSE on a self-hosted deployment, and a self-hosted license cannot be installed on a Cloud organization.

​
Next steps

User Groups

Configure project features, context, SSO membership, and row access

Authentication

Configure Microsoft Entra or generic OIDC SSO

Permissions

Configure per-user identity passthrough and native Redshift RLS

White-Label Branding

Replace nao branding with your own logos, favicon, and app name