Enterprise

Use this guide when rolling out Para across your organization. Coordinate with your Para organization owner and IT administrator to set up company sign-in, decide who can access shared projects, and confirm your billing and agreement requirements.

Decide what your organization needs

Plan your rollout

1. 1

   Choose your administrators

   Identify the people responsible for membership, billing, and company sign-in. Owners and administrators need passkeys. Review the roles on Team.

2. 2

   Organize shared projects

   Create access groups for the people who should work together. Every member of a group can use its current and future projects. Owners and administrators can access all shared team projects; personal private projects remain private. See Team and access.

3. 3

   Start with a small group

   Invite a few colleagues, connect the channels they will use, and try an assignment with an appropriate source document. Confirm that each person can access the intended project and receive the result before inviting the wider organization.

Set up company single sign-on

Company single sign-on (SSO) is available on Enterprise. It lets members sign in through your organization’s identity provider. Para supports Microsoft Entra ID, Okta, and other supported OpenID Connect (OIDC) providers. Each Para organization supports one SSO connection and one company email domain. SAML and automatic directory provisioning through SCIM are not supported.

1. 1

   Open company sign-in settings

   An owner or administrator opens Settings. Have your IT administrator follow the provider-specific instructions shown there. For Okta or another OIDC provider, contact Para support to confirm your provider is enabled before setup.

2. 2

   Connect your identity provider

   Create the application in your identity provider using the redirect address shown in Para. Enter the requested connection details in Settings, then assign the intended users in your identity provider.

3. 3

   Verify your company domain

   Select Get DNS verification record. Ask whoever manages your domain to add the displayed TXT record, then select Verify DNS record in Para.

4. 4

   Invite members and test sign-in

   Assigning someone in your identity provider does not add them to Para. Invite their company email address from Team, then test Continue with SSO in a separate browser session. Existing organization members do not need another invitation.

5. 5

   Require company sign-in when ready

   An organization owner who has successfully signed in through the connection and enrolled a recovery passkey can select Require company SSO. Test sign-in before enabling this requirement. Keep owner recovery passkeys available in case your identity provider is unavailable.

Use your organization’s AI provider (BYOK)

Enterprise organizations can bring their own AI provider credentials. Para supports Anthropic, OpenAI, Google Gemini, xAI, OpenRouter, Baseten, Nebius, Fireworks AI, Azure OpenAI, Amazon Bedrock, and compatible custom endpoints. An owner or administrator saves the credentials and model on Models, then explicitly selects that provider for new requests across the organization. Without BYOK, an administrator on a Pro seat can still set the organization’s default model on Models. Members on Standard seats always run Core Lightning, so the default applies to Pro seats only; it replaces members’ own choices only when Override personal model selections is checked.

Your provider bills for model usage; Para seats and services such as document processing and search remain subject to your Para agreement. Your projects and existing conversations stay in Para. If the selected provider fails, Para stops the request rather than switching providers. Follow the BYOK setup guide for connection details, billing, key changes, and troubleshooting.

Check the experience before inviting everyone

• Have a regular member sign in, open an intended shared project, and confirm that unrelated private projects are not available.
• Try an assignment in each channel your organization will use. For email, Slack, or Teams, test both sending a source document and receiving a finished file. Copilot is currently text-only.
• If you choose BYOK, verify a real assignment and its provider usage before making it the organization’s default workflow.
• Agree on who manages membership, provider credentials, and billing, and who colleagues should contact when something needs attention.

Enterprise agreements and billing

Enterprise seats and usage are governed by your organization’s agreement. Contact sales@casemark.com to discuss your rollout, commercial terms, or agreement requirements. Administrators can review the current plan and agreement information on Plan. For self-service subscriptions and prepaid usage, see Plan and billing.

Business Associate Agreements

Para requires an accepted Business Associate Agreement (BAA) before you use it for protected health information. BAAs are available with annual Pro or an Enterprise agreement. Self-service acceptance requires an active paid subscription, every seat on Pro, and an annual commitment. Organizations without a subscription and organizations with Standard seats are not eligible.

Where self-service BAAs are offered, the organization owner reviews and accepts the standard BAA on Plan, with passkey confirmation. Otherwise, email sales@casemark.com. If you currently pay monthly, accepting the BAA schedules annual Pro billing starting at your next renewal; if you are already on annual Pro, your billing does not change. Review the agreement and billing terms before accepting; the Plan page shows the recorded commitment and lets you download the executed BAA. Enterprise BAAs are handled through your enterprise agreement; contact sales@casemark.com.

• Team and accessInvite colleagues and decide who can use shared projects.
• Settings and securityManage organization settings and personal sign-in methods.
• Choose an integrationConnect the email and chat tools your organization uses.
• Plan and billingReview subscriptions, usage balances, and invoices.