Multi-tenancy and white label
One platform, many organisations
Every customer, plant or department can have its own organisation, with its own devices, members, dashboards, plan and branding. The database itself keeps organisations apart, and one account can work in several of them.
Separation
Kept apart in the database, not only in the app
An organisation is called a tenant in the API. Everything created in it belongs to it.
Row-level security
Every table that holds organisation data is protected by row-level security in the database, so one organisation can never read another's rows.
Devices stay inside
A device never receives another device's messages, nor another organisation's. Devices behind a gateway belong to the gateway's organisation.
Members per organisation
One account can belong to several organisations, with its own role in each. After sign-in, people pick the organisation they work in.
Its own sign-in rules
Each organisation sets its sign-in policies and can connect its own identity provider over SAML.
Its own audit log
Sensitive actions go to the organisation's audit log, linked as a hash chain you can verify and exportable as CSV or NDJSON.
Its own plan and limits
Devices, monthly messages, telemetry retention, flows, rules and members are limited per organisation by its plan.
White label
What each organisation can make its own
Set under Branding and Domains in the organisation's settings.
| Item | What you set |
|---|---|
| Web address | A free <slug> subdomain for every organisation, plus custom domains where the plan includes them. A custom domain serves only after its DNS is verified and its certificate works; the free subdomain keeps working whatever happens to it. |
| Logos and icons | Separate logos and icons for light and dark themes, and the favicon. |
| Name and colours | The brand name, a tagline, and primary and secondary colours. |
| Sign-in pages | The organisation's logo, name, colours and a background image. |
| Messages the platform sends carry the organisation's brand. | |
| Legal links | Links to your own privacy policy and terms of service. |
Serving your customers
How service providers set it up
Give each customer its own organisation. Their devices, readings, dashboards, rules and members stay in it, and their people see only it. Your team joins each customer organisation as members, with the role you agree with the customer.
Inside one organisation, roles and groups decide who does what. Owner, Admin and User are built in; groups add permissions on top, for example the ready-made IoT operator and IoT viewer groups. Attribute-based policies can narrow access down to a single device; check such a policy with the policy simulator before you rely on it. See users and roles.
Good to know
- By default, one account creates one organisation through onboarding. Ask us to set up more for your customers
- Each organisation has one home region, chosen when it is created. See deployment and regions
- There is no parent organisation that sees into its customers' data. Boards and flows move between organisations as export files
- An organisation's data can be exported. Device secrets, credentials and device addresses are never part of an export
- Suspending an organisation disconnects its devices at once and refuses them at login
Onboarding a customer
From a new customer to the first board
1
Create the organisation
Choose its region and its slug. It gets its free subdomain at once.
2
Brand it
Set the logo, colours and sign-in page, and add a custom domain if the plan includes one.
3
Invite people
Invite the customer's people by e-mail with the User or Admin role, and add groups for operators and viewers.
4
Bring in the setup
Connect the devices, then import boards and flows from files made in another organisation, and share the boards.
FAQ
Questions about multi-tenancy
Can one person manage many customer organisations?
Yes. One account can be a member of several organisations, with a role in each, and picks the organisation to work in after sign-in.
Can customers see each other's devices or data?
No. Each organisation's rows are separated by row-level security in the database, and devices never receive another organisation's messages.
Can a customer use its own domain?
Yes, where its plan includes custom domains. The domain serves after its DNS is verified and its certificate works, and the free subdomain keeps working. See pricing.
Can we copy a setup from one customer to another?
Boards and flows export to files and import into another organisation. The board import runs a dry run first and lists what it must repair or skip.
How are several customer organisations billed?
Each organisation has its own plan and limits. Talk to sales about how you want to run and bill several organisations.
Running Hermetry for your customers?
Tell us how many customers and sites you serve. We help you set up the first customer organisations with you.