Features · Operate

Multiple sites and teams — one workspace, clean boundaries

Unlimited sites per workspace, invite your team, switch between properties without logging out. Every query is scoped to the site before it runs.

Start free API reference docs

Tenancy is resolved first

Access is checked before a metric is computed, not filtered afterwards. A site you cannot reach returns 404, never 403 — a 403 confirms the site exists.

A gate enforces it

gate:tenant-leak fails the build if a query can run without a resolved site id. Isolation is a test, not a convention.

Built for agencies

Group client sites in one workspace and hand each client a report whose numbers they can check themselves.

Per-site settings

Privacy mode, vertical and digest subscriptions are all per site, not per account.

The evidence

How a request resolves a site

resolveSite(user, siteId)
  → not a member?        404 (identical to "no such site")
  → member?              site row + allow-list
  → every metric query   WHERE site_id = ?  (always a parameter)

There is no code path that reaches the events table without a resolved site id.