oo-identity
authentication, workspaces, permissions, and billing. everything you need to manage who has access to your agents.
four pillars
sign in → organize → control → pay
authentication
sign in with passkeys or email. no passwords to remember or leak.
powered by hanko
workspaces
a workspace for you and one for each group you work in. memory stays inside its workspace.
zero data leakage
permissions
four roles: owner, admin, member, viewer. control who can do what.
enforced at every level
credits & billing
usage-based pricing. three credit pools: daily bonus, subscription, and purchased.
how it's organized
your account, your billing, your workspaces
your account
- • one identity across all workspaces
- • passwordless sign-in
- • personal preferences and style
- • can belong to multiple organizations
your organization
- • owns the subscription and credits
- • manages one or more workspaces
- • shared credit pool for the team
- • plan tier determines available features
your workspaces
- • isolated memory per workspace
- • separate agent memory per workspace
- • role-based permissions
- • its own plan and its own balance
beta launch (may 2026): workspaces are unlimited on every plan. each one carries its own subscription and credit balance.
roles & permissions
four roles with increasing access
owner
- • manages billing and credits
- • publishes agent knowledge
- • invites and manages team members
- • configures domains and integrations
admin (creator tier+)
- • invites members
- • manages workspace settings
- • creates and edits knowledge
- • cannot manage billing
member (creator tier+)
- • works with your agents
- • creates knowledge
- • uses credits
- • edits content
viewer (all tiers)
- • read-only access
- • cannot run your agents
- • doesn't use credits
- • ideal for people who only need to read
data isolation
zero data leakage between workspaces
workspace separation
every piece of data is tied to a specific workspace. your agents can only access memory within their own workspace.
- • agent memory stays within its workspace
- • knowledge belongs to one workspace only
- • your agents cannot query across workspaces
enforced at every layer
isolation is enforced by workspace scoping on every request, across the api and every internal service.
- • access tokens scoped to workspace
- • internal services verify permissions
- • unauthorized requests are rejected
example: a firm keeps two engagements apart by giving each its own workspace. one workspace's agents cannot read another's, enforced by workspace scoping on every request.
learn about custom builds →security & compliance
built for regulated industries
encryption
all data encrypted at rest (aes-256-gcm). short-lived access tokens with automatic rotation.
audit logs
every action logged with who did it, when, and in which workspace. gdpr-compliant retention.
eu sovereignty
german gmbh, eu-hosted infrastructure, gdpr-native. some subprocessors may be us-based (see /open-startup#subprocessors).