Organizations & Tenants

The Telisky MDM platform supports multiple organizations (tenants) with strict data isolation between them.

Multi-Tenant Architecture

Each organization operates in complete isolation:

• Devices are visible only to their owning organization
• Telemetry data is never shared across tenants
• Users belong to exactly one organization
• Configuration profiles are organization-scoped
• Alert rules are organization-scoped

Organization Hierarchy

Platform (Telisky)
├── Organization A (Customer)
│   ├── Users (owner, admin, user, viewer)
│   ├── Devices (RC500s, GPS trackers)
│   ├── Configuration Profiles
│   ├── Firmware Policies
│   ├── Geofences
│   └── Alert Rules
│
├── Organization B (Customer)
│   ├── Users
│   ├── Devices
│   └── ...
│
└── System Tenant (Platform Ops)
    ├── Super Admins
    └── Unclaimed Devices

Organization Settings

Each organization has configurable settings:

Setting	Description
Name	Organization display name
Plan	Subscription tier (Starter/Pro/Enterprise)
Max Devices	Maximum allowed devices
Max Users	Maximum allowed user accounts
Data Retention	Telemetry retention period
Timezone	Default timezone for displays

Plans & Limits

Feature	Starter	Pro	Enterprise
Devices	10	100	Unlimited
Users	5	50	Unlimited
Data Retention	30 days	90 days	365 days
Alert Rules	100	1,000	Unlimited
API Rate Limit	100/min	1,000/min	Custom
Support	Email	Priority	Dedicated

Creating an Organization

Super admins can create new organizations:

1. Navigate to Ops → Organizations
2. Click Create Organization
3. Fill in:
   • Organization name
   • Plan selection
   • Initial owner email
4. Click Create
5. An invitation email is sent to the owner

Device Assignment

Devices can be moved between the system tenant and organizations:

Claiming (Customer Self-Service)

1. Admin generates a claim code for the device
2. Customer enters the code in their portal
3. Device moves to the customer’s organization

Direct Assignment (Ops)

1. Ops admin selects an unclaimed device
2. Chooses target organization
3. Device is assigned immediately
4. Organization admin is notified

Transfer Between Organizations

Transfers require super admin action:

1. Remove device from source organization
2. Re-assign to target organization
3. Device configuration and telemetry history transfer with it

Data Isolation Guarantees

Database Level

Every table includes a tenant_id column:

-- All queries are automatically filtered
SELECT * FROM devices WHERE tenant_id = $1;

API Level

JWT tokens contain the user’s tenantId. Middleware automatically scopes all queries:

• Non-super-admin users can only see their organization’s data
• Cross-tenant requests return 403 Forbidden
• Even direct ID access is tenant-checked

Audit

All cross-organization actions are logged:

• Device transfers
• User invitation
• Plan changes
• Data exports

Organization Dashboard (Ops)

Super admins have access to a platform-wide operations view:

View	Content
All Organizations	List of tenants with device counts
All Devices	Cross-tenant device view
System Health	Platform-wide metrics
Unclaimed	Devices awaiting assignment
Audit Log	Cross-tenant operations