Tenant System

What Is a Tenant?

In intelliThings, a tenant is a fully isolated, encapsulated instance of the platform assigned to each customer. Whether you're on a white-label setup or a standard deployment, every customer operates within their own tenant — a complete, self-contained environment.

Think of a tenant as your own dedicated space on the platform. Within it, you have:

• Your own identity — a unique subdomain
• Your own storage — separate from all other customers
• Your own MQTT traffic — completely isolated message flows
• Your own configuration — devices, dashboards, workflows, users, and more

This tenant-based architecture ensures strict data isolation, security, and independence for every customer.

Tenant Slug

Each tenant is identified by a unique tenant slug — a short, human-readable identifier that becomes part of your custom subdomain.

Accessing Your Tenant

Once your tenant is created, you access the intelliThings platform through your tenant-specific subdomain:

{tenant_slug}.app.intellithings.io

For example, if your tenant slug is acme-corp, your platform URL would be:

acme-corp.app.intellithings.io

The tenant slug is assigned when you sign up for an intelliThings plan and serves as your unique identifier across the platform.

Tenant Creation

Tenants are automatically created when you sign up for an intelliThings plan. The process is seamless:

1. Sign up for an intelliThings plan (Developer, Startup, or Deployer)
2. Choose your tenant slug during registration
3. Receive your tenant URL — {tenant_slug}.app.intellithings.io
4. Start configuring — set up devices, dashboards, workflows, and more

Your tenant is ready to use immediately after signup, with all isolation mechanisms already in place.

Strict Tenant Isolation

Tenants are strictly separated from each other through multiple layers of isolation. This ensures that no data, configuration, or traffic from one tenant can ever access or interfere with another.

Isolation Mechanisms

Certificate-Based Tenant Enforcement

One of the strongest isolation mechanisms is certificate restriction. Device certificates are issued with tenant-specific constraints, meaning:

• A certificate issued for one tenant cannot be used to connect from another tenant
• Devices are cryptographically bound to their assigned tenant
• Even if someone tries to manipulate MQTT topics or URLs, the certificate validation will reject cross-tenant access

This ensures that even at the infrastructure level, tenant boundaries are enforced and cannot be bypassed.

MQTT Traffic Separation

MQTT messaging is fully isolated per tenant using topic prefixes based on the tenant slug.

MQTT Topic Structure

All MQTT topics for a tenant are prefixed with the tenant slug:

{tenant_slug}/fromDevice
{tenant_slug}/toDevice

• {tenant_slug}/fromDevice — Topics for receiving data from devices
• {tenant_slug}/toDevice — Topics for sending commands to devices

For example, with tenant slug acme-corp:

acme-corp/fromDevice/sensor-001
acme-corp/toDevice/sensor-001/command

This prefix-based approach ensures that:

• MQTT messages from one tenant are never visible to another
• Device publishing and subscription logic is tenant-scoped by default
• Even if two tenants use the same device topic names, they remain completely separate

Tenant Scope

Everything within the intelliThings platform is scoped to a tenant. This includes:

• Devices — Devices belong to a single tenant and cannot be shared across tenants
• Device Templates — Templates are tenant-specific configurations
• Dashboards — Dashboard configurations and widgets are isolated per tenant
• Workflows — Workflow executions only affect resources within the same tenant
• Users — User accounts and roles are scoped to a single tenant
• Documents — Uploaded documents and assets are tenant-specific
• OTA Updates — Firmware updates are managed within tenant boundaries

There is no cross-tenant sharing of resources. Each tenant is a complete, self-contained ecosystem.