Entity Enricher uses organization-based multi-tenancy. Every user belongs to one organization, and all data — records, schemas, API keys — is isolated per organization.
Organizations are the top-level boundary for data isolation. When you sign up, you create a new organization or join an existing one. All enrichment records, schemas, and API keys belong to your organization and are accessible to team members based on their role.
Entity Enricher uses a 4-tier role hierarchy. Each role includes all permissions of the roles below it:
Every organization is one of two kinds, and most of what the rest of this page describes — joining, approving, roles — only applies to the second.
Created for you automatically when you sign up, named after your account. It has exactly one member, is hidden from the join search and refuses join requests even by direct link, and shows an upgrade prompt where a business account shows its Users page. Nothing else is missing: schemas, enrichments, database syncs and billing all work the same.
A multi-user organization: discoverable in the join search, with join requests, roles and owner approval. An owner switches either way from the organization settings — though going back to individual is refused while other members remain, since it would strand them.
Sign up with Google, GitHub, or email through Firebase authentication. You get a personal workspace straight away; from there you can create a business organization or ask to join one. Only business organizations appear in the search below.
Users go through an approval workflow when joining an organization:
| Status | Meaning | Can Log In? |
|---|---|---|
| Active | Full access to the system based on assigned role | Yes |
| Pending | Join request submitted, waiting for owner approval | No |
| Rejected | Join request was denied by an owner | No |
| Deactivated | Account was disabled (soft delete, preserves audit trail) | No |
Any user can leave their organization. The behavior depends on ownership:
Your account is deactivated and you are signed out. Your enrichment records remain in the organization for audit purposes.
If you are the only remaining owner, you must confirm organization deletion. Enrichment records and schemas are detached (not deleted), while users, API keys, and provider keys are removed with the organization.
Owners access the User Management page to manage their team, and system admins see one tab more:
Safety rules:
The Settings page is where an owner configures the organization itself, in two parts:
The organization's display name, contact details and postal address, and its account type (individual or business). The URL slug is fixed once created, since links and integrations are built on it.
Choices that apply to everyone in the organization rather than to one run: a preferred model per task (used whenever a request does not name one), how quality, speed and cost are weighted when ranking models, and the embedding model that semantic IDs resolve against. Defaults are a plan feature — on plans without it the section is read-only.
Entity Enricher supports multiple authentication methods:
Sign in with Google or GitHub via Firebase. No password needed.
Traditional email and password authentication via Firebase.
Programmatic access keys for CI/CD and service integrations.
After authentication, the backend issues short-lived JWT access tokens (15 minutes) and long-lived refresh tokens (7 days). Learn more about programmatic access in the API Keys guide.