Platform · Module
Tenants & Workspaces
Partner, tenant and workspace hierarchy with white-label and sub-account snapshots
Tenants & Workspaces creates, routes, brands, suspends and deletes the Partner to Tenant to Workspace hierarchy. The tenant is the isolation, billing and subscription boundary; workspaces scope visibility and roles inside it.
What it does
Every One3 customer is a tenant: the boundary for data isolation, billing and subscriptions. Inside a tenant, workspaces scope visibility and roles. A workspace can be a business unit, a brand, a client account or a region, and workspaces can nest. Above tenants sits the partner, an agency that owns and bills many client tenants under its own brand.
Self-serve sign-up asks for a company name, slug, region and industry. The tenant provisioner then creates the tenant, a default workspace, the owner membership and a Free or trial subscription. The tenant profile holds the legal name, GSTIN, address, default currency, time zone, locale and logo.
Built for agencies
The partner tier, planned for Wave 2, is where One3 is designed to stand out for agencies. Partner admins get delegated memberships in each client tenant. New client sub-accounts are provisioned from a snapshot that carries apps, modules, pipelines, templates, automations, roles and notification defaults. White-label branding covers the logo, colours, email sender name and an app domain such as app.{agency-domain}. Custom domains are verified by DNS TXT records, with automated TLS and daily DNS and TLS checks. An agency console shows every sub-account with usage, connector health, pending approvals and subscription status.
Lifecycle and deletion
Tenants move through provisioning, trial, active, suspended, closing and closed, driven by billing dunning and owner requests. Tenant deletion needs step-up authentication and a cooling-off period, produces a final export, revokes sessions, keys, agents and MCP grants, deletes data across storage, indexes, vectors and caches, and issues a deletion certificate.
Later waves
Planned for Wave 3: a quota advisor, snapshot versioning with "push update to sub-accounts", sandbox tenants, a multi-cell tenant directory and a partner SaaS storefront where an agency can sell its own offers. Silo and sovereign provisioning follow in Waves 4–5.
Features
What Tenants & Workspaces includes
Self-serve tenant sign-up
Company name, slug, region and industry; the provisioner creates the tenant, default workspace, owner membership and a Free or trial subscription. W0.
Row-level security on every table
Tenant isolation enforced in the database and proven by a cross-tenant leak suite in CI. W0.
Nested workspaces
Create, rename, nest and archive workspaces of kind business unit, brand, client account or region. W0.
Tenant profile
Legal name, GSTIN, address, default currency, time zone, locale and logo. W0.
Onboarding checklist and tenant switcher
Pick apps, invite the team and connect channels; switch tenants with a clear breadcrumb and a new tenant-scoped token. W1.
Partner tier
Partner record, partner admins and delegated partner memberships per client tenant. W2.
Sub-account snapshots
Provision a client from a snapshot or edition with apps, pipelines, templates, automations, roles and notification defaults. W2.
White-label branding and domains
Partner logo, colours, sender name, white-label app domain and portal domains, with DNS verification and automated TLS. W2.
Agency console
All sub-accounts with usage, connector health, pending approvals and subscription status in one view. W2.
Tenant lifecycle and deletion
Lifecycle states driven by dunning and owner requests; deletion with step-up, cooling-off, final export, full revocation and a deletion certificate. W2.
Onboarding agent
Proposes apps, workspace structure and roles from a business description for the admin to approve. W2.
Snapshot updates and sandbox tenants
Push snapshot updates to sub-accounts with diff preview and opt-out; sandbox tenants for testing upgrades. W3.
Partner SaaS storefront
An agency publishes offers on its white-label domain; client checkout provisions a sub-account automatically. Gateway terms to verify. W3.
Workflow
Create a client sub-account
- 1
Partner admin picks a snapshot in the agency console.
- 2
Provisioner creates tenant, workspace and owner membership.
- 3
Partner allocates seats and credits from the pool.
- 4
White-label domain and sender name are applied and verified.
- 5
Client receives an invite and completes the onboarding checklist.
Workflow
Delete a tenant
- 1
Owner requests deletion with step-up authentication.
- 2
Cooling-off period starts and a final export is produced.
- 3
Sessions, keys, agents and MCP grants are revoked.
- 4
Data is deleted across storage, indexes, vectors and caches.
- 5
A deletion certificate is issued and the slug is tombstoned.
AI
AI skills and Digital Employees
Onboarding agent
Suggests apps, modules, workspace structure, roles and a snapshot from a short business description. The admin applies each step.
Quota advisor
Flags tenants approaching plan limits and suggests plan fit. Suggestion only. Planned for W3.
Digital Employees that use this module
They act through the same governed Actions as people; risky steps wait for approval.
Frequently asked questions
What is the difference between a tenant and a workspace?
A tenant is your company's isolated account: data, billing and subscriptions live there. Workspaces sit inside a tenant and scope visibility and roles for a brand, business unit, client account or region.
Can an agency white-label One3?
The partner tier planned for Wave 2 includes partner branding, a white-label app domain, portal domains and white-label email sender names.
What happens when a tenant is deleted?
After step-up and a cooling-off period, you get a final export, then all access is revoked and data is deleted across storage, indexes, vectors and caches, with a deletion certificate.
See Tenants & Workspaces in your workflow
Tell us about your team and the outcomes you want. We will walk you through the apps, the Digital Employees and the plan for your industry.