A workspace per entity, isolated by design
Each entity runs in its own workspace with dedicated per-tenant data isolation and workspace-scoped login — including workspace-scoped password reset, so an account in one entity is not a key to another.
For holding companies & groups
Several companies. One standard of control.
A separate workspace per entity with dedicated data isolation, the same permission matrix applied consistently across all of them, and an append-only audit log that can be verified rather than believed.
The reality
What you’re up against.
- Each subsidiary runs a different stack, so group reporting is a manual merge.
- Access is granted per company by whoever set that company up.
- The group asks for a control narrative that no single system can evidence.
- Onboarding a new entity means starting the whole argument again.
How CareIT Business OS fits
Capabilities, mapped to your work.
One permission model, applied everywhere
Roles are built from a permission matrix of module against view and manage, so the same standard of access is expressed the same way in every entity instead of being reinvented per subsidiary.
An audit log you can verify
The audit log is append-only and chained with SHA-256, and a verification command re-walks the chain. Group audit gets a checked result rather than an assurance.
The same reporting shape in every entity
Finance cockpit, accounting journal, reports and the print-optimised board pack, and analytics are the same modules in each workspace — so consolidating means comparing like with like.
Onboarding an entity is configuration
Settings are addressable per section, the role matrix is reusable, and the REST API v1 (Bearer tokens, a required Idempotency-Key on writes) lets a new workspace be provisioned and fed programmatically.
Other sectors
Bring your group structure.
We will walk workspace isolation, the role matrix, and audit-log verification across entities.