Skip to main content
On Enterprise plans, organizations are the unit of multi-tenancy. An organization owns one or more workspaces, has its own SSO and Directory Sync configuration, and bills as a single account. Members are managed in WorkOS and surfaced in Summand.

​
Provisioning

Enterprise organizations are provisioned through sales — once the contract is signed and a designated admin is named, we set up the organization in WorkOS and invite the admin by email. This is deliberate:
  • No domain squatting. A random user signing up with a @yourcompany.com email can’t claim an organization.
  • Verified admins. The first admin is the person named in the contract.
  • Clean audit trail. Provisioning events come from a sales actor, not anonymous signup.
To get an organization, contact our sales team.

​
Roles

No organization role gives read access to every dataset in the organization. Each person sees the datasets shared with them or filed in a workspace they belong to. Admins invite members, change roles and remove members in Settings → Organization → Members. Ownership changes go through WorkOS. Per-resource access (Owner / Admin / Editor / Viewer on a specific dataset or connector) is separate. See Sharing.

​
Domains

An organization can own multiple verified domains — useful for companies with subsidiary brands (acme.com + acme-labs.com). Each domain is verified independently via DNS TXT record. Once verified, sign-ins from that domain are routed to your SSO connection automatically. To add a domain after the org is provisioned: Settings → Organization → Domain Verification → Configure in the WorkOS Admin Portal.

​
Seat management

Each organization has a seat count tied to your contract. Seats are consumed when a user is added — either by manual invitation, JIT provisioning at first SSO sign-in, or SCIM provisioning from your IdP. The current seat count vs. your limit is shown in Settings → Organization at the top of the page. If you’re approaching the limit, contact your account manager — or remove inactive members first.

​
Member lifecycle

For automatic deprovisioning, run SSO and Directory Sync together. Without SCIM, remove members by hand when they leave.

​
Workspaces

Within an organization, workspaces are an optional grouping for separating datasets across teams (e.g. marketing-analytics and risk). All workspaces share the org’s billing, SSO, and member pool — workspaces are about organization, not isolation. For hard isolation between business units, use separate organizations.