Account model
Organizations, legal entities and brands, how people get access through memberships, and how data stays isolated.
Ownrecord organizes everything in three levels: an organization has one or more legal entities, and each legal entity has one or more brands.
Organization (your account; the isolation boundary for all data)
├─ Members (people with a role, scoped to the organization, an entity or a brand)
└─ Legal entity (the seller: registrations, thresholds, ledger, filings, processor connections)
└─ Brand (catalog, customers, checkout, subscriptions, wallets, API keys, webhooks, invoice series)
Organization
An organization (org_…) is your account: the company or group that signs up for Ownrecord. It holds your Ownrecord subscription, your members, and your entities and brands. It's the isolation boundary for all data: nothing in one organization is visible to another.
Legal entity
A legal entity (ent_…) is a company that sells: the seller of record on every sale. Each entity has its own:
- establishment country and tax IDs;
- tax registrations and threshold counters;
- payment processor connections;
- ledger and invoice numbering;
- tax filings.
An organization can have several entities, for example a group with companies in different countries.
Brand
A brand (brd_…) is a storefront or product line of an entity. Each brand has its own name and branding, checkout domain, catalog, customers, subscriptions, wallets, API keys, webhooks, portal settings and invoice series.
One entity can sell under several brands. Ownrecord itself works this way: the Ownrecord plans are one brand of a legal entity that also sells another product under a different brand.
Tax is shared at the entity level. Registrations, thresholds, filings and the ledger belong to the entity, so every sale of every brand counts toward the same thresholds and lands in the same tax returns.
Members and roles
People get access through memberships. A person can belong to several organizations. Each membership has a role and a scope: the whole organization, one entity (with its brands), or one brand. A role granted at a scope applies to everything below it.
| Role | Scopes | Can |
|---|---|---|
org_owner | organization | Everything, including deleting the organization and transferring ownership. Every organization has at least one. |
org_admin | organization | Everything except transferring ownership and deleting the organization. |
billing_admin | organization | The organization's Ownrecord subscription only: plan, payment method, invoices from Ownrecord. |
finance | organization, entity | Ledger, invoices, credit notes, refunds, filings, reconciliation, exports, invoice settings. |
tax_manager | organization, entity | Registrations, prerequisites, filing periods, evidence reviews, the entity's tax IDs. |
support | any | Customers, subscriptions, wallets, refunds up to a limit, disputes. |
developer | any | Test-mode API keys (live keys only if an owner or admin allows it), webhooks, request logs, test-mode products and prices. |
viewer | any | Read only. |
Sensitive actions, such as creating live API keys or marking a registration as registered, need a sign-in within the last 15 minutes. If yours is older, Sign in again next to the action opens the sign-in page with your email filled in; you stay signed in meanwhile, and you come back to the action afterwards.
What your plan allows is checked separately from what your role allows. An action can be allowed by your role and still be blocked by a plan limit, for example adding a brand beyond the number your plan includes.
Isolation
Every piece of data belongs to exactly one organization, and most of it also to one entity or brand and to one mode (see Test and live mode). Ownrecord checks that scope on every read and write, whether the call comes from the console, an API key, an agent or the hosted checkout. A member scoped to one brand never sees another brand's data.
Tax knowledge (rates, thresholds, registration rules) is the exception: Ownrecord maintains it once and every organization reads it. Your own data is never shared.
Names in URLs
- An organization slug is unique across Ownrecord.
- An entity slug is unique within its organization.
- A brand slug is unique across Ownrecord, because it appears in public checkout URLs and in API keys.