> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ontime.hosai.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Organizations, users and employees

> Why OnTime separates the person from their membership in an organization, and what that means day to day.

OnTime keeps three ideas apart on purpose. Getting them straight explains a lot of otherwise-surprising behaviour — why your employee code is different in two places, why changing your password changes it everywhere, and why switching organizations doesn't sign you out.

## The three things

<CardGroup cols={3}>
  <Card title="Organization" icon="building">
    A tenant. One company's data — its people, punches, rosters, payroll and filings. Organizations never see each other's data.
  </Card>

  <Card title="User" icon="user">
    The **person**. One login, one email address, one password, globally unique.
  </Card>

  <Card title="Employee" icon="id-card">
    A person's **membership in one organization**. Their code, role, manager, department, location and compensation *there*.
  </Card>
</CardGroup>

```mermaid theme={null}
erDiagram
  USER ||--o{ EMPLOYEE : "is a member via"
  ORGANIZATION ||--o{ EMPLOYEE : "has"
  ORGANIZATION ||--o{ LOCATION : "has"
  ORGANIZATION ||--o{ DEPARTMENT : "has"
  ORGANIZATION ||--o{ ROLE : "defines"
  EMPLOYEE ||--o| EMPLOYEE : "reports to"
  EMPLOYEE }o--|| ROLE : "is assigned"
  EMPLOYEE }o--o| LOCATION : "works at"
  EMPLOYEE }o--o| DEPARTMENT : "belongs to"
```

## What lives where

| On the **User** (the person)                        | On the **Employee** (the membership)               |
| --------------------------------------------------- | -------------------------------------------------- |
| Email address — unique across all of OnTime         | Employee code — unique **within one organization** |
| Password                                            | Role and its permissions                           |
| Which organization the current session is acting in | Manager, department, location, shift               |
|                                                     | Joining date, employment type, status              |
|                                                     | Compensation and salary revisions                  |
|                                                     | Documents, devices, attendance, leave              |

The practical consequence: **your email is yours everywhere; everything else is per organization.** Two organizations can both have an employee code `EMP-0421`, and they are different people. The same person can hold a different role in each organization they belong to.

## One login, several organizations

Because the password belongs to the person and not the membership, someone who works for two organizations on OnTime signs in once. An **organization switcher** changes which membership the session is acting as.

Switching is a deliberate action, not a re-login: your session stays alive and simply changes which organization it is pointed at. Every screen, every query and every export then reflects that organization only.

<Note>
  A user who belongs to exactly one organization — most people — never sees any of this. They sign in and they are in.
</Note>

## Isolation is enforced, not just intended

Separating tenants by convention would mean one forgotten filter is a data leak. OnTime does not rely on that. Every request runs inside an organization context enforced at the database level, and a query made with no context returns **nothing** rather than everything.

The visible consequence: asking for something that belongs to another organization does not produce a "you don't have access to that" message, because that message would itself confirm the thing exists. It simply is not found.

## Roles are per organization too

A **role** is a named set of permissions defined inside one organization. OnTime ships four presets — Employee, Manager, HR and Admin — and an administrator can define more. Because roles belong to the organization, one company's "Supervisor" role has nothing to do with another's.

See [Roles & permissions](/help/concepts/roles-and-permissions) for the full catalog.