Organizations & Multi-Tenancy

Fp Switchboard supports multi-tenant isolation through organizations. Each organization has its own users, encryption keys, service access controls, and audit logs.

How Organizations Work

1. User logs in via Cloudflare Access (SSO/email)
2. Email domain extracted — e.g., user@acme.com maps to acme.com
3. Domain lookup in org_domains table returns the org_id
4. All queries filtered by org_id — users only see their own org’s data

Note

Users whose email domain is not mapped to an organization are placed in a default org context. Platform admins can create organizations and map domains at any time.

Roles

Role	Scope	Capabilities
Platform Admin	All organizations	Create/manage orgs, view all data, manage all users, configure platform settings
Org Admin	Own organization	Manage org users, view org audit logs, configure DLP, manage service access
User	Own data	Connect services, generate tokens, view own usage and activity

Role Flags

Flag	Table	Effect
is_platform_admin = 1	users	Full platform access, bypasses org filtering
is_super_admin = 1	users	Org-level admin for their organization
Neither flag	users	Standard user with own-data access

Service Restrictions

Organizations can restrict which services their users can access:

• Allowed Services — Set via organizations.allowed_services (JSON array)
• Per-User Grants — Admins grant specific services to users via user_service_access table
• Both must align — A user needs both org-level allowance AND a per-user grant to access a service

Tip

If allowed_services is empty or null, all services are available to the organization. Restrictions only apply when explicitly configured.

Data Isolation

Each organization’s data is cryptographically separated:

Encryption Keys

Per-organization encryption keys. One org’s tokens cannot be decrypted with another org’s key.

Database Isolation

All database queries include org_id filter. Cross-organization data access is structurally impossible.

Audit Logs

Audit trails are org-scoped. Org admins see only their organization’s activity.

DLP Configuration

DLP patterns, overrides, and allowlists are configured per-organization.

Managing Organizations

Creating an Organization

Platform admins create organizations through the admin panel:

1. Navigate to Admin > Organizations
2. Set the organization name and allowed services
3. Add email domains that map to this organization

Domain Mapping

Domain	Organization
acme.com	Acme Corp
acme.co.uk	Acme Corp
partner.io	Partner Inc

Multiple domains can map to the same organization. A domain can only belong to one organization.

Managing Users

Org admins can:

• View all users in their organization
• Grant or revoke service access per user
• Promote users to org admin
• View user activity and usage metrics

Organization-Level Features

Feature	Org-Scoped?	Details
Encryption keys	Yes	Separate AES-256-GCM keys per org
DLP patterns	Yes	Custom pattern overrides and allowlists
Service access	Yes	Allowed services list per org
Audit logs	Yes	Org admins see org-only logs
Usage metering	Yes	Per-org usage tracking and analytics
Bundle templates	Yes	Org-scoped templates visible to org members only
Credential storage	Yes	Some services use org-level credentials (shared OAuth apps)

Org-Level vs User-Level Credentials

Some services use org-level credentials (a shared OAuth app configured once by an admin), while others use user-level credentials (each user connects individually):

Credential Type	Services	Who Configures
Org-level	Cloudflare, n8n, ManyChat, Fathom, WordPress, Sage, WhatsApp, Fathom AI, n8n MCP, Fp Design	Org admin or platform admin
User-level	Google, Slack, Notion, HubSpot, GitHub, Jira, Microsoft 365, and others	Each user individually