Organization, Workspace, Team — the 3-tier hierarchy

Last updated: May 19, 2026

Organization, Workspace, Team — the 3-tier hierarchy

Wevion has a 3-tier model: Organization (billing + SSO + super admins) > Workspace (data isolation per project/brand) > Team (people grouping inside a workspace for ad-account permission bundling). Your Personal Account is your user identity that can belong to many workspaces. Data is fully isolated between workspaces.

Who is this for

Owners and admins designing the right structure for their setup, especially first-time setup for agencies, holdings, or multi-brand teams.

The 3 tiers explained

Tier 1: Organization

The top-level container. One Organization owns:

  • The Stripe subscription (and all billing artifacts: payment methods, invoices, tax ID)

  • Seat pool shared across all workspaces inside the org

  • SSO configuration (SAML / OIDC for Enterprise)

  • Super admins — users with cross-workspace power

Typical: one Org = one legal entity. An agency creating Wevion accounts for itself = 1 Org. A holding company billing centrally for 5 subsidiaries = 1 Org with 5 Workspaces (one per subsidiary). A holding with separate legal entities billing separately = 5 Orgs.

Tier 2: Workspace

The project / brand / client boundary. One Workspace owns its own:

  • Connected ad accounts (Meta, Google, TikTok, Taboola, Snapchat)

  • Campaigns, ad sets, ads, creatives, audiences

  • Rules and automation

  • Reports and dashboards

  • Team members and role assignments (per-workspace roles)

  • Workspace defaults (timezone, currency, language)

  • Audit log

Data isolation is enforced at the backend via session_id patterns and getAccessibleTeamIds in apps/backend/src/lib/team-auth.ts. A user with access to Workspace A cannot see Workspace B's data unless explicitly added there. Switching between workspaces happens via the workspace switcher in the header (see navigation overview).

Tier 3: Team

A grouping of users inside a Workspace, used for per-ad-account permission bundling — not for billing or data boundary.

Use case: agency with 10 clients managed in one workspace, but each mediabuyer only sees their assigned 1-2 ad accounts. Solution:

  • Create one Team per client inside the workspace

  • Assign the client's ad accounts to that Team

  • Assign each mediabuyer to the right Team(s)

The mediabuyer sees only the ad accounts of the Teams they belong to. Owners and admins always see all ad accounts regardless of Team membership.

If you don't need this granularity, don't create Teams. Assign roles directly to users at the workspace level (everyone sees all ad accounts of the workspace).

Personal Account

Your personal account is your user identity: email, password, 2FA, profile, preferred language. It lives at /settings/personal/*.

A personal account can be a member of many workspaces simultaneously. The workspace switcher shows the workspaces you have access to with your role in each.

Each user counts as 1 seat per Organization, regardless of how many workspaces in that Org they belong to.

How invitations move users across tiers

When you invite someone:

  1. Email is checked: if the email already has a personal account, they're added to your workspace; if not, they're guided through account creation first

  2. Role is set at invite time (workspace-specific)

  3. Workspace assignment can be multi-select if you have multiple workspaces in your org

So one invite can add an existing user to multiple workspaces with the same role. See invite and manage team members.

Common patterns

Pattern A: Solo media buyer / consultant

  • 1 Org + 1 Workspace

  • You as owner

  • 0-2 additional contractors as mediabuyer

Pattern B: In-house team, single brand

  • 1 Org + 1 Workspace

  • Owner: head of marketing

  • Admin: 1-2 leads

  • Mediabuyer: rest of perf team

  • Finance: 1 from finance dept

  • Viewer: stakeholders (sales, exec, ...)

Pattern C: Agency

  • 1 Org + 1 Workspace per client

  • Super admin or owner: agency founder + ops lead (visible across all client workspaces)

  • Admin: client account manager (in their client's workspace only)

  • Mediabuyer: junior buyers (Team-scoped within client workspace)

  • The client may or may not be invited to their own workspace as viewer

Pattern D: Holding with subsidiaries

Choice:

  • Centralized billing: 1 Org + 1 Workspace per subsidiary. Subscription managed at HQ.

  • Decentralized billing: 1 Org per subsidiary. Each has its own subscription. Multiple super admins per subsidiary if needed.

Pattern E: Big advertiser with internal teams + agency partners

  • 1 Org + multiple Workspaces (one per region or product line)

  • Internal owner/admin per workspace

  • Agency partners invited as Mediabuyer with Team-scoped access to specific brand or region

Restructuring after setup

The biggest constraint: you cannot move data between workspaces. Get the structure right before importing.

If you started with one workspace and need to split into many, the path is:

  1. Create the new workspace(s)

  2. Connect ad accounts there (re-import = re-OAuth)

  3. Re-create essential rules + audiences (no migration)

  4. Move historical reports via CSV export → import to a BI tool if you need it long-term

  5. Once the new workspace works, decommission the old (cancel its subscription if separate org, or just retire the workspace inside the same org)

What you'll see

In the workspace switcher (top-left header):

  • Your Organization name as the header label

  • A list of all workspaces you have access to (with role badges)

  • Click any → reload into that workspace

  • "Create new workspace" link if you're admin or owner in the Org

In /settings/team:

  • Tabs for the current workspace's settings: People, Teams, Workspace Defaults, Billing, Branding, Audit Log

Common questions

  • Can data be shared across workspaces? No. Workspaces are isolation boundaries by design.

  • Can I move a campaign between workspaces? Not in the UI. Backend has migration tools — contact support for special cases.

  • Can I have one user in multiple Orgs? Yes — the personal account is global. Each Org adds you to its seat count separately.

  • What if our company restructures (split, merge, acquisition)? Contact support — common pattern is to spin up a new Org for the new entity, migrate workspaces via backend tools.

  • Does deleting a workspace cancel billing? No — the subscription lives at the Org level. Deleting workspaces only removes data inside. To stop billing entirely, see cancel your subscription.

Related