Workspaces that keep clients, campaigns and people apart

The workspace is the isolation boundary

Everything belongs to a workspace: links, folders, tags, domains, pixels, QR presets, API keys and the subscription that pays for it. Two workspaces under the same account share nothing, and that is enforced in the data layer rather than by careful screen design — every query that touches tenant data is filtered by workspace, and the isolation has its own test suite.

This is what makes one account able to hold a dozen clients. An agency runs a workspace per client, a company runs one per brand or region, and a reseller sells workspaces as the product itself. Switching between them is a menu, not a logout.

Four roles, chosen for the arguments they prevent

Owner controls the subscription and can delete the workspace. Admin manages links, domains and members but not the plan. Member creates and edits links and reads analytics, which covers most of a marketing team. Viewer reads links and analytics and changes nothing, which is the role a client or an external stakeholder should have.

The viewer role deserves a note, because it is the one competitors skip: as of August 2026 Linkly, for instance, had no read-only role at all. Without it, showing results to a client means either exporting screenshots or handing over an account that can edit destinations.

Invitations are sent by email with the role attached, and every permission check runs at the entry point of an action rather than being re-derived in the interface. A member who is shown fewer buttons is also refused by the server if they call the action directly.

• ✓Owner — billing, plan changes, workspace deletion, everything below
• ✓Admin — links, domains, members, settings; no billing
• ✓Member — create and edit links, read analytics
• ✓Viewer — read-only access to links and analytics

Folders and tags, for the moment there are a thousand links

Folders are a single level with a name and a colour, and a link belongs to at most one. Tags are free-form, unique per workspace, and a link can carry as many as it needs. The pairing is deliberate: folders answer "whose is this", tags answer "what was it for".

Both are first-class filters in the link list, they combine with search, domain and archive state, and the entire filter set lives in the URL so a view can be shared as a link. Bulk actions apply tags to a selection in one step, which is how a hundred links created for one launch get labelled without a hundred edits.

Archiving is separate from deletion. Archived links stop resolving but keep their history and can be restored; deleted links go to a recycle bin for thirty days before they are purged. Campaign clean-up should never be an irreversible act performed at speed.

Seats, partner-level teams and the audit trail

Seat counts come from plans. Your own partner plan sets how many people can work on the business side — three on Starter, ten on Growth, thirty on Scale — and each client plan you create sets seats for that client. Partner-side membership has its own roles, so a support colleague can help clients without gaining access to payouts.

Every meaningful action writes an audit entry: link created, destination changed, member invited, role changed, domain connected, key revoked. The log is readable in the dashboard and available through the API, which is the difference between an incident review that takes ten minutes and one that takes a day.