Platform / Multi-tenant and partners
One platform, many organizations, and room for partners.
Host identity for many customers with a real database boundary between them, and give outside companies a portal of their own.
acme.idra.teamOwn signing keys, policies and System Logglobex.idra.teamOwn signing keys, policies and System Loglogin.example.comOwn signing keys, policies and System Log
Example addresses. A query for one can’t reach another: Postgres keeps them apart.
A database for each organization
Isolation comes from Postgres itself: a tenant’s queries can only reach its own database. Each one gets its own address, OIDC issuer, keys, policies, jobs and System Log.
- Addresses like acme.idra.team, or a verified custom domain
- Self-serve signup with email confirmation and a setup wizard
- A platform console to create, suspend, resume and limit tenants
Each organization looks like its own
Set the logo, favicon and primary color on the sign-in page and dashboard, and edit the wording of the emails people receive.
- Per-tenant brand and email templates
- Domain ownership checked with a DNS TXT record
- Tenant admins manage their own domains
A portal for people outside your company
Add partner organizations, let their admins invite their own people, and let them bring their own identity provider. Access is scoped through a linked group and can expire.
- Partner portal at /partner
- Bring-your-own identity provider per partner
- Invitations, expiry and System Log events
Standards it speaks
- Postgres database per tenant
- DNS TXT domain verification
Not here yet
- Running more than one replica: schedulers and rate counters are per process today
- Org-to-org hub administration, sandboxes and tenant copies
- Per-tenant encryption keys and sending domains: one key and one sender cover the deployment
- Partner people still belong to the Everyone group, so assign workforce apps to a workforce group
We’d rather you read this now than find it in a pilot. See the full comparison.
Create your organization.
Pick an address and confirm your email, then sign in as its first admin. A setup wizard takes you through the rest.