Each organization runs on its own subdomain. The Infronest marketing site stays on the apex domain, while tenant subdomains go straight to a company-specific login.
02
Let users discover the right portal
Workspace discovery routes users to their correct workspace from their email address before they log in — the same flow on web, the Electron desktop app and the Capacitor mobile apps.
03
Approve who joins
New tenant sign-ups and access requests route through an owner approval workflow, so growth stays controlled rather than open.
04
Set module and role controls per workspace
Enable modules per tenant and assign role-based access, so every organization gets a footprint sized to its plan and its people.
05
Operate with isolation enforced
Per-tenant reports and activity logs run on top of database row-level security and automated isolation tests, so multi-tenancy is enforced server-side, not just in the UI.
Example
A worked example
Take a holding group rolling Infronest out to four subsidiaries totalling 900 users. Each subsidiary gets its own portal on its own subdomain: an employee types their work email on the shared discovery screen and lands on their company’s login, whether they are on the web, the Electron desktop app or the mobile app. New workspace requests wait for owner approval, and each portal’s modules and roles are sized to its plan. Underneath, row-level security keeps the four companies’ records fully separate — enforced in the database, not just hidden by the interface.
FAQ
Frequently asked questions
Can every company in our group get its own login portal?
Yes. Each organization runs on its own subdomain that resolves straight to a company-specific login, while the shared workspace-discovery screen routes each employee to the right portal from their work email address.
How do users find the right workspace to sign in to?
Workspace discovery resolves the correct workspace from a user’s email address before login and sends them to the matching subdomain, and the same discovery step runs in the web, Electron desktop and Capacitor mobile clients.
Does the public marketing site leak into tenant workspaces?
No. The Infronest landing experience lives only on the apex domain. Company subdomains resolve straight to tenant login, so end users of a workspace do not see marketing pages.
How is data isolated between the companies on the platform?
Each organization is a separate tenant on its own subdomain with row-level security in the database, and cross-tenant isolation is checked by automated tests on every release.
Can owners approve who joins a workspace?
Yes. Tenant sign-ups and access requests route through an owner approval workflow, so an administrator decides who is admitted to each workspace.
Do the desktop and mobile apps support the same portal flow?
They do. The Electron desktop build and the Capacitor Android/iOS builds use the same workspace-discovery-before-login flow as the browser, so the experience is consistent across surfaces.
Is the multi-tenancy actually enforced, or only in the interface?
It is enforced server-side: tenant-scoped views, database row-level security and automated isolation tests back it, not just front-end routing. Our stated posture is "ISO 27001 aligned — certification in progress".
Portal-per-company subdomains, email-based workspace discovery and owner-approved joins — with isolation enforced in the database rather than promised by the UI.