Organizations, users and employees

OnTime keeps three ideas apart on purpose. Getting them straight explains a lot of otherwise-surprising behaviour — why your employee code is different in two places, why changing your password changes it everywhere, and why switching organizations doesn’t sign you out.

​

The three things

​

What lives where

The practical consequence: your email is yours everywhere; everything else is per organization. Two organizations can both have an employee code EMP-0421, and they are different people. The same person can hold a different role in each organization they belong to.

​

One login, several organizations

Because the password belongs to the person and not the membership, someone who works for two organizations on OnTime signs in once. An organization switcher changes which membership the session is acting as. Switching is a deliberate action, not a re-login: your session stays alive and simply changes which organization it is pointed at. Every screen, every query and every export then reflects that organization only.

​

Isolation is enforced, not just intended

Separating tenants by convention would mean one forgotten filter is a data leak. OnTime does not rely on that. Every request runs inside an organization context enforced at the database level, and a query made with no context returns nothing rather than everything. The visible consequence: asking for something that belongs to another organization does not produce a “you don’t have access to that” message, because that message would itself confirm the thing exists. It simply is not found.

​

Roles are per organization too

A role is a named set of permissions defined inside one organization. OnTime ships four presets — Employee, Manager, HR and Admin — and an administrator can define more. Because roles belong to the organization, one company’s “Supervisor” role has nothing to do with another’s. See Roles & permissions for the full catalog.