Multi-Tenancy & Data Isolation
Company-Based IsolationEvery record in the system — orders, customers, assets, pieces — belongs exclusively to your company. It is structurally impossible for any other company's users to access or even see your data, regardless of how they are logged in.
Authentication GuardEvery request to the system requires a valid login session. The system verifies who you are, looks up your account, and confirms which company you belong to before allowing any action. Your company identity is always determined by your verified session — nothing you supply in the request can override it.
Row-Level SecurityData isolation is enforced at two independent levels simultaneously — in the database itself and in the application layer. Even if application logic were somehow bypassed, the database would still refuse to return any record that does not belong to your company.
Membership TableThe system maintains an explicit record of every person who belongs to your company, including their role, their permissions, when they joined, and who invited them. The same account can never be added to your company twice, and your company can never have more than one owner at any given time.
Permissions Source of TruthWhen the system checks what a user is allowed to do, it always reads from the live user record — not a cached copy. This means any change to a user's permissions takes effect immediately on their next action.
Public Auth EndpointsA profile endpoint returns the combined account and company information for the logged-in user. A setup endpoint handles first-time account creation automatically — returning the existing profile if it already exists, or creating one on the spot if this is the user's first contact with the system.
Owner OnboardingWhen an owner sets up their account, the system creates the company, the user profile, and the membership record all at once in a single operation — so your workspace is fully ready the moment setup completes, with no partial states or follow-up steps required.
Staff OnboardingWhen a staff member accepts an invite, the system validates the invite token, creates their profile, adds them to the company, and marks the invite as consumed — all in one step. Each invite can only be used once and expires after 48 hours.
Global CatalogFilament and printer specifications are stored in a shared reference catalog available to all companies on the platform. If your company creates a custom specification not already in the catalog, it is added to the global catalog and attributed to your company for others to benefit from as well.
Company Roles & Employee Management
Role ModelThe system supports two roles: owner and staff. Owners have unrestricted access to all areas of the platform. Staff members can only access the specific areas their owner has enabled for them through individual permission flags on their account.
Permission FlagsStaff access is controlled through eight individual on/off flags: viewing orders, acting on orders, viewing customers, acting on customers, viewing assets, acting on assets, sending invites, and managing permissions. Owners are granted all eight flags by default. New staff members start with no permissions until the owner grants them explicitly.
Staff Management RulesWhen managing a staff member, only their permissions can be updated — their role cannot be changed through this action. The system prevents owners from being modified or removed, prevents staff from granting themselves the ability to manage permissions, and prevents any user from removing themselves from the company.
Invite TokensInvites are generated as short, readable codes designed to be easy to share without ambiguity. Each invite expires after 48 hours and can only be used once. The system records exactly when each invite was used and by which account. The active invite list shows only unused, unexpired invites; revoking an invite removes it immediately.
Owner Setup ValidationOwner account setup requires a display name of at least two characters, plus a company name, industry, company size, city, and default currency in the three-letter ISO format. Timezone can optionally be provided. Duplicate email addresses and duplicate company names for the same owner are rejected at the point of creation.