Organization and account system

What is an organization?

Organizations are the top-level containers in Geelab that host team members, product subscriptions, permissions, and business assets.

Organizations typically include:

• organization owner and invited members.
• Activated products and packages.
• Configuration and business data of each product.
• device fingerprint applications, endpoints, events, visitors, risk signals, keys and Webhooks.

When the same account joins multiple organizations, the data, product subscriptions, and permissions of each organization are isolated from each other. After the user switches organizations, the applications, events, and configurations in the console will also switch with the current organization.

Global account and organization membership relationship

The global account is used to log in to Geelab and is usually uniquely identified by an email address. Organization membership indicates whether this account can access an organization and what product permissions it has in the organization.

Global account: [email protected]
│
├── Organization A
│   ├── Member status: Active
│   ├── Device Fingerprint: Read and write
│   └── CAPTCHA: No access
│
└── Organization B
    ├── Member status: Disabled
    ├── Device Fingerprint: Read-only
    └── CAPTCHA: Read-only

This means:

• Deactivating membership in organization B will not log out the global account.
• The user can still log in and access Organization A.
• Deleting a membership relationship in organization A does not automatically delete the relationship in organization B.
• Modifying product permissions in one organization will not affect other organizations.

Account login and business isolation

Geelab and other business systems can share underlying user information, but independent authentication configurations and business permissions should be used. The user's password, login status and organizational context in Geelab should be handled in accordance with Geelab's authentication rules.

Organizational data isolation follows the following principles:

• Users can only see organizations they have joined and have a healthy status.
• After entering an organization, you can only access products that have been subscribed by the organization.
• Even if the organization has activated a certain product, members still need to be assigned corresponding product permissions.
• Only members with read-only permissions can view data, but cannot perform write operations such as adding, modifying, or deleting.
• Member permissions and business data between organizations will not be automatically inherited.

organization owner and members

organization owner

The master account is the owner of the organization and is usually responsible for organization-level management, including:

• View and modify organization profiles.
• Invite and manage members.
• Assign member product permissions.
• Deactivate, reinstate or delete members.
• View organization subscriptions and membership quotas.
• Handle issues where members cannot access the organization or products.

In the current design, each organization has only one master account, and organization ownership transfer is not currently available. The master account cannot exit the organization it created or owns.

members

members are ordinary members who are invited to join the organization. members can view or manage products based on the product permissions they are granted, but generally cannot:

• Invite or remove other members.
• Modify other members' permissions.
• Modify organization owner.
• Delete an organization.
• Perform organization management operations limited to the master account.

members can actively exit the organization. After exiting, all product permissions granted by the organization will expire; if you need to rejoin, you must be re-invited by the organization owner.

Join multiple organizations with one account

The same global account can join multiple organizations. The global upper limit in the current product design is to join a maximum of 10 organizations, including organizational relationships that have been joined normally; whether invitations to be activated are included in the upper limit should be based on the actual server rules.

After joining multiple organizations:

• After logging in, the user enters the organization last used or specified by the system.
• You can enter other organizations through Switch Team or Switch Organization in the account menu.
• Each organization displays membership and product permissions separately.
• Deactivated organizations can be displayed in the toggle list, but cannot be entered.
• Organizations that have left or had their membership removed are no longer displayed.

If a user has joined 10 organizations, new invitations will be blocked. Users need to first exit an organization they no longer use, or contact the relevant organization’s organization owner to delete membership.

Illustration: List of organization members