How Workspaces Are Kept Separate

The idea

Oris Work is shared software, but every firm gets its own workspace. Everything you create — clients, invoices, documents, messages — belongs to your workspace only, and other firms cannot see it.

How it is enforced

• When you sign in you receive a pass that names your workspace. The server reads the workspace from that pass on every request, never from something you type.
• Every data query is limited to that workspace.
• Permissions (your role, and any custom role) are checked on the server for every action, not just in the screen.
• If you belong to several workspaces, switching issues a new pass for the new workspace. The server first checks you have an active membership there.

Links shared outside the firm

Client portal links, signing links, payment links and review links each point to one specific record. Opening one does not give access to anything else in your workspace.

What you control

• Who is in your workspace and what role they hold (Settings → Team).
• Custom roles and per-module access (Settings → Roles).
• Whether two-factor authentication is required for all members.
• Removing people: deactivating a member stops their access.
• The Audit Log (admins only) shows key account and role changes.
• Your workspace’s data residency is shown under Settings → Profile.

What you should do

• Do not share your login. Invite colleagues so each person has their own account and a role that fits.
• Remove people promptly when they leave.
• Check the workspace name in the top bar if you belong to several (see Switching Between Organisations).