Organization, Workspace, Team — the 3-tier hierarchy

Wevion has 4 levels: Organization > Workspace > Legal Entity > Team. Each plays a different role. Personal Account belongs to many workspaces.

Written By Salvatore Sinigaglia

Last updated About 4 hours ago

Wevion has 4 levels: Organization > Workspace > Legal Entity > Team. Each plays a different role. Personal Account belongs to many workspaces.

Organization, Workspace, Legal Entity, Team — the hierarchy

Wevion has a 4-level model: Organization (top container + super admins) > Workspace (data isolation per project/brand) > Legal Entity (billing scope, created 1:1 with each workspace by default) > Team (work/people grouping inside a workspace). Your Personal Account is your user identity that can belong to many workspaces. Data is fully isolated between workspaces.

Who is this for

Owners and admins designing the right structure for their setup, especially first-time setup for agencies, holdings, or multi-brand teams.

The levels explained

Level 1: Organization

The top-level container. One Organization owns:

  • Super admins — users with cross-workspace power
  • The overall grouping of its workspaces

Enterprise SSO (SAML / OIDC) and SCIM provisioning are available on request as a dedicated configuration set up with Sales — they aren't self-serve toggles in the app.

Typical: one Org per company. An agency creating Wevion accounts for itself = 1 Org. A holding company billing centrally for 5 subsidiaries = 1 Org with 5 Workspaces (one per subsidiary).

Level 2: Workspace

The project / brand / client boundary. One Workspace owns its own:

  • Connected ad accounts (Meta, Google, TikTok, Taboola, Snapchat, Outbrain)
  • Campaigns, ad sets, ads, creatives, audiences
  • Rules and automation
  • Reports and dashboards
  • Team members and role assignments (per-workspace roles)
  • Workspace defaults (dashboard preset, hub layout, member policy flags, conversion source)
  • Audit log
  • A Legal Entity for billing (see below)

Data isolation is enforced at the backend via session_id patterns and getAccessibleTeamIds in apps/backend/src/lib/team-auth.ts. A user with access to Workspace A cannot see Workspace B's data unless explicitly added there. Multi-workspace setups are provisioned through enterprise onboarding (see navigation overview).

Billing lives on a Legal Entity, created 1:1 with each Workspace by default. It owns:

  • The Stripe subscription (and billing artifacts: payment methods, invoices, tax ID)
  • The seat cap for that workspace (enforced at invite time)
  • The AI credit balance

Level 4: Team

A grouping of users inside a Workspace, used for per-ad-account permission bundling — not for billing or data boundary.

Use case: agency with 10 clients managed in one workspace, but each mediabuyer only sees their assigned 1-2 ad accounts. Solution:

  • Create one Team per client inside the workspace
  • Assign the client's ad accounts to that Team
  • Assign each mediabuyer to the right Team(s)

The mediabuyer sees only the ad accounts of the Teams they belong to. Owners and admins always see all ad accounts regardless of Team membership.

If you don't need this granularity, don't create Teams. Assign roles directly to users at the workspace level (everyone sees all ad accounts of the workspace).

Personal Account

Your personal account is your user identity: email, password, 2FA, profile, preferred language. It lives at /settings/personal/*.

A personal account can be a member of many workspaces simultaneously, with a per-workspace role in each.

The seat cap is enforced per workspace's Legal Entity at invite time — seats are counted per Legal Entity, not as a single pool shared across the whole Organization.

How invitations move users across tiers

When you invite someone:

  1. Email is checked: if the email already has a personal account, they're added to your team; if not, they're guided through account creation first
  2. Role is set at invite time (one of mediabuyer / manager / viewer / finance)

The invite form takes exactly one email and one role — there is no workspace multi-select. See invite and manage team members.

Common patterns

Pattern A: Solo media buyer / consultant

  • 1 Org + 1 Workspace
  • You as owner
  • 0-2 additional contractors as mediabuyer

Pattern B: In-house team, single brand

  • 1 Org + 1 Workspace
  • Owner: head of marketing
  • Admin: 1-2 leads
  • Mediabuyer: rest of perf team
  • Finance: 1 from finance dept
  • Viewer: stakeholders (sales, exec, ...)

Pattern C: Agency

  • 1 Org + 1 Workspace per client
  • Super admin or owner: agency founder + ops lead (visible across all client workspaces)
  • Admin: client account manager (in their client's workspace only)
  • Mediabuyer: junior buyers (Team-scoped within client workspace)
  • The client may or may not be invited to their own workspace as viewer

Pattern D: Holding with subsidiaries

Choice:

  • Centralized billing: 1 Org + 1 Workspace per subsidiary. Subscription managed at HQ.
  • Decentralized billing: 1 Org per subsidiary. Each has its own subscription. Multiple super admins per subsidiary if needed.

Pattern E: Big advertiser with internal teams + agency partners

  • 1 Org + multiple Workspaces (one per region or product line)
  • Internal owner/admin per workspace
  • Agency partners invited as Mediabuyer with Team-scoped access to specific brand or region

Restructuring after setup

The biggest constraint: you cannot move data between workspaces. Get the structure right before importing.

If you started with one workspace and need to split into many, the path is:

A self-serve "create new workspace" UI is not a confirmed feature — additional workspaces are provisioned through enterprise onboarding, so contact Sales for a multi-workspace setup.

  1. Create the new workspace(s)
  2. Connect ad accounts there (re-import = re-OAuth)
  3. Re-create essential rules + audiences (no migration)
  4. Move historical reports via CSV export → import to a BI tool if you need it long-term
  5. Once the new workspace works, decommission the old (cancel its subscription if separate org, or just retire the workspace inside the same org)

What you'll see

In /settings/team:

  • Tabs for the current workspace's settings: People, Teams, Workspace Defaults, Billing, Branding, Audit Log

Common questions

  • Can data be shared across workspaces? No. Workspaces are isolation boundaries by design.
  • Can I move a campaign between workspaces? Not in the UI. Backend has migration tools — contact support for special cases.
  • Can I have one user in multiple Orgs? Yes — the personal account is global. Each Org adds you to its seat count separately.
  • What if our company restructures (split, merge, acquisition)? Contact support — common pattern is to spin up a new Org for the new entity, migrate workspaces via backend tools.
  • Does deleting a workspace cancel billing? The subscription lives on the workspace's Legal Entity (created 1:1 with the workspace by default). To stop billing entirely, cancel the subscription — see cancel your subscription.

FAQ

What are the levels in Wevion's hierarchy?

Wevion uses a 4-level model: Organization, Workspace, Legal Entity, and Team. The Organization is the top-level container for super admins and its workspaces. A Workspace is the project, brand, or client boundary owning its ad accounts, campaigns, rules, and reports. Each workspace has a Legal Entity (1:1 by default) that holds the Stripe subscription, seat cap, and credit balance. A Team groups users inside a workspace for per-ad-account permission bundling.

Can data be shared across workspaces in Wevion?

No. In Wevion, workspaces are isolation boundaries by design, so a user with access to Workspace A cannot see Workspace B's data unless explicitly added there. Data isolation is enforced at the backend. You cannot move a campaign between workspaces in the UI, though backend migration tools exist for special cases via support.

How is the seat cap counted?

The seat cap is enforced per workspace's Legal Entity (created 1:1 with the workspace by default) and checked against the plan at invite time — seats are counted per Legal Entity, not pooled across the whole Organization.

What is a Team used for in Wevion?

A Team in Wevion is a grouping of users inside a workspace, used for per-ad-account permission bundling — not for billing or data isolation. For example, an agency can create one Team per client so each mediabuyer only sees their assigned ad accounts. If you don't need this granularity, skip Teams and assign roles directly at the workspace level.

Does deleting a Wevion workspace cancel billing?

The subscription lives on the workspace's Legal Entity (created 1:1 with the workspace by default). To stop billing entirely, you cancel the subscription.

FAQ

What are the levels in Wevion's hierarchy?

Wevion uses a 4-level model: Organization, Workspace, Legal Entity, and Team. The Organization is the top-level container for super admins and its workspaces. A Workspace is the project, brand, or client boundary owning its ad accounts, campaigns, rules, and reports. Each workspace has a Legal Entity (1:1 by default) that holds the Stripe subscription, seat cap, and credit balance. A Team groups users inside a workspace for per-ad-account permission bundling.

Can data be shared across workspaces in Wevion?

No. In Wevion, workspaces are isolation boundaries by design, so a user with access to Workspace A cannot see Workspace B's data unless explicitly added there. Data isolation is enforced at the backend. You cannot move a campaign between workspaces in the UI, though backend migration tools exist for special cases via support.

How is the seat cap counted?

The seat cap is enforced per workspace's Legal Entity (created 1:1 with the workspace by default) and checked against the plan at invite time — seats are counted per Legal Entity, not pooled across the whole Organization.

What is a Team used for in Wevion?

A Team in Wevion is a grouping of users inside a workspace, used for per-ad-account permission bundling — not for billing or data isolation. For example, an agency can create one Team per client so each mediabuyer only sees their assigned ad accounts. If you don't need this granularity, skip Teams and assign roles directly at the workspace level.

Does deleting a Wevion workspace cancel billing?

The subscription lives on the workspace's Legal Entity (created 1:1 with the workspace by default). To stop billing entirely, you cancel the subscription.

Last updated: 2026-05-17