# Enterprise headshots your procurement team can approve Everything the team plan does, plus the parts procurement asks about: enforced SSO, SCIM provisioning, invoicing on your terms, and a contract your legal team can sign. > Canonical: https://aiheadshot.me/enterprise Everything the team plan does, plus procurement's checklist: enterprise headshots with enforced SSO, SCIM, and invoicing on your terms. ## What Enterprise Headshots Add The product is the same. What changes is how it is bought, governed, and connected to the systems you already run. ### SAML SSO with enforced domains Verify your domain and every employee on it must authenticate through your identity provider. Verification is required first - without it, claiming a domain would be an account-takeover primitive rather than a control. ### SCIM 2.0 provisioning Okta, Entra ID, and Google Workspace push directory changes directly. A leaver is deprovisioned by HR, not by someone remembering to click something here. ### Net-30 invoicing Agreed payment terms drive the invoice due date programmatically, alongside a contracted seat commitment and your negotiated per-seat rate. ### Signed MSA and DPA A master services agreement and data processing agreement your legal team reviews once, with the signature date recorded against your organization. ## Where enterprise headshots require procurement review If a purchase needs security review, a contract, and a PO number, this is the path. ### Regulated industries Finance, healthcare, and legal, where a vendor questionnaire arrives before any pilot does. ### Large distributed workforces Thousands of employees across regions, where a studio day was never a realistic plan. ### Companies with an IdP mandate Where every SaaS tool must sit behind SSO and be provisioned from the directory. ### High-turnover organisations Where automatic deprovisioning matters more than any feature on the product page. ## How Enterprise Controls Actually Work Each of these is enforced state read by the code path it governs, not a note in a sales spreadsheet. ### Domain verification gates SSO enforcement You claim a domain, prove control of it with a DNS record, and only then can SSO be required for its users. The unverified state deliberately does nothing. ### SCIM tokens are stored hashed A provisioning token is a standing key to your directory, so only its SHA-256 hash is stored and the value is shown exactly once. A database read never yields a usable credential. ### Seat commitment drives billing Invoices bill the greater of your active seats and your contracted floor - the trade for a negotiated rate, applied automatically rather than reconciled by hand. ### Retention policy is organisation-wide Set 7 or 30 days once and it applies to every member, including photos already uploaded. Shortening takes effect immediately; nothing can silently extend it. ## How a Rollout Runs Typically two calls and a week, not a quarter. ### Security review and contract We send the security overview, subprocessor list, and DPA up front. Your questionnaire gets answered against documented controls rather than aspirations. ### Connect your identity provider Verify your domain, enable SSO enforcement, and issue a SCIM token so your directory becomes the source of truth for seats. ### Lock the brand look Choose the backdrop and outfit pool, upload custom branded backdrops, and set per-department overrides where teams differ. ### Roll out in waves Provisioned employees are reminded on a bounded cadence that stops once their headshots exist. New hires match from their first day. ## One Capture Standard Every Employee Can Follow At four figures of headcount, output quality is mostly a function of what you wrote in the intranet article. These are the four lines worth writing. ### Publish one sentence about light Across a large population, variance in results is very largely variance in lighting. "Stand facing a window" is the single instruction worth putting in the announcement - it shifts more of the distribution than any guidance about phones or megapixels. ### Specify a floor, not a spec Do not mandate camera models or resolutions; people read that as a reason to defer. Ask for head and shoulders at arm’s length, which anyone can follow on any handset, and let the pre-flight check reject the few that still fall short before credits are spent. ### State that wardrobe is irrelevant Without this line a meaningful share of employees postpone indefinitely, waiting for a day they are dressed for it. The team wardrobe you locked replaces whatever is in the upload - saying so explicitly is what unblocks them. ### Decide the opt-out before you launch Some employees will decline to upload a photograph of their face, and under most biometric privacy regimes that is a legitimate position rather than an obstruction. Agree in advance what the directory shows for them, so the rollout does not stall on the first refusal. ## Enterprise headshots capabilities What is included beyond the team plan. ### SAML 2.0 SSO Enforced per verified domain, with just-in-time account creation on first sign-in. ### SCIM 2.0 endpoints Standards-compliant Users provisioning with filtering, pagination, PATCH deactivation, and a service provider config document. ### Net-30 invoicing Agreed terms drive due dates; pay by invoice or bank transfer rather than card. ### Custom rate and seat commitment A negotiated per-seat price with a contracted floor, applied automatically at billing time. ### Contracted data residency Your processing region is recorded on the agreement and surfaced on the trust page. ### Audit trail Sensitive administrative actions are recorded in an append-only audit log. ## Biometric Handling Your Legal Team Can Review Face photos are biometric data under BIPA, GDPR and CCPA. These are the controls your DPA references, implemented in the product and auditable. ### Your photos never train any AI model Uploads are used once to generate your headshots and are never used to train, fine-tune, or improve a model. No exceptions, and every provider we route to is contractually bound to the same rule. ### Automatic deletion after 30 days Uploaded selfies are permanently deleted 30 days after your headshots are generated. A scheduled sweep enforces it, and we alert ourselves if a single photo is ever overdue. ### Delete everything right now, in one click You do not have to wait for the retention window. A single button on your shoot page erases every selfie you uploaded, immediately and permanently. ### Explicit consent, recorded properly Before anything is processed we show exactly what is collected, why, and for how long, and record your consent against that precise wording - the standard biometric privacy laws expect. ### Every image is labelled as AI-generated Delivered headshots carry embedded content credentials marking them as AI-generated, so the images stay honest wherever they travel. ## Procurement Questions Security, legal and procurement ### What does an enterprise headshot rollout actually involve? Four stages, and only one of them is technical. Contracting - MSA, DPA, subprocessor list, and any residency commitments - usually sets the timeline. Then SSO and SCIM are connected so the employee list stays current without anyone maintaining a spreadsheet. An administrator locks the backdrop and wardrobe that defines the house style. Finally the invitation goes out, completion is tracked centrally, and finished enterprise headshots are pulled as a ZIP or synced into the directory. ### Do you support SAML single sign-on? Yes. You claim your domain, verify control of it with a DNS record, and can then require every user on that domain to authenticate through your identity provider. Verification is mandatory first - enforcing SSO on an unverified domain would let one organisation capture every user with that email suffix. ### Do you support SCIM provisioning? Yes, SCIM 2.0 (RFC 7644). Your IdP can list, create, read, deactivate, and delete users against organisation-scoped endpoints using a bearer token. Deactivation removes the seat; the person’s account and its data lifecycle stay governed by account deletion. ### How are SCIM tokens secured? Only a SHA-256 hash is stored, the token value is displayed exactly once at creation, and tokens are scoped to a single organisation. Revocation is immediate, and an unknown, revoked, or unentitled token all return the same response so probing reveals nothing. ### Can we pay by invoice on Net-30? Yes. Agreed payment terms are recorded on your agreement and drive the invoice due date programmatically, so the terms your contract states are the terms the system applies. ### Will you sign a DPA? Yes. We act as processor and your organisation remains controller. The signature date is recorded against your organisation, and our subprocessor list is published so you always know which vendors process employee photos. ### Are employee photos used to train AI? Never. Every provider in our routing must carry a reviewed training-exclusion position before it can receive an image; an unattested provider is unroutable by construction, not by policy. ### How long are employee photos kept? Your organisation chooses 7 or 30 days, applied to every member including photos already uploaded. A scheduled sweep enforces it and any overdue photo is treated as an incident rather than a backlog item. ### Where is our data processed? Your contracted processing region is recorded on the agreement. We state our actual region plainly on the security page rather than claiming coverage we cannot back. ### Do you have SOC 2? Our security controls, subprocessors, retention behaviour, and breach-notification commitments are documented on the security page and in the DPA. Where a report reference exists for your agreement it is recorded against your organisation and shared under NDA. ### Can I use what Headshots for Enterprise makes commercially? Every paid plan includes a commercial licence for what Headshots for Enterprise makes; the free tier is for personal use. ## Talk to Us About a Rollout Send the security questionnaire. We will come back with the DPA, the subprocessor list, and an enterprise headshot rollout plan sized to your headcount. _Last updated July 28, 2026_