Workspace

What it is#

A workspace in SendBriefs is the top-level multi-tenant container for everything an agency uses the product for. It holds:

• Clients — the client roster, each with their own brand kit + delivery settings
• Templates — the brief templates the agency uses across clients
• Integrations — connected data sources (HubSpot, Stripe, GA4, etc.)
• Team members — who can access the workspace, with role-based permissions
• Billing — the subscription tier + payment method
• Audit log — workspace-wide activity record
• Settings — branding, sender domain, compliance preferences

One agency = one workspace, typically. Some larger agencies operate multiple workspaces for hard separation (e.g., one per business unit or one per acquired sub-brand).

Multi-tenancy mechanics#

Workspaces are fully isolated at the database layer via Postgres row-level security (RLS). Cross-workspace data access is architecturally prevented — even an authenticated user from one workspace cannot query data from another, period. This is enforced in the database, not by the application code, which makes the boundary robust against application-layer bugs.

Why this matters for agencies#

Two reasons workspace isolation matters:

1. Client confidentiality. Even within an agency, some client data needs strict access control. Workspace-level + role-based permissions handle this.
2. Compliance. When an agency serves clients in regulated industries (legal, healthcare, finance), the workspace boundary is a hard line that regulators + auditors care about.

Roles within a workspace#

SendBriefs ships with these roles per workspace:

• Owner — billing access + everything else
• Admin — workspace settings, templates, integrations, team management
• Editor — can author briefs, manage clients, fill in narrative blocks
• Reviewer — read-only access to drafts, can leave comments + approve
• Viewer — read-only access to published briefs (typically for partner-level visibility)

Custom roles on Agency Pro and Enterprise.