--- id: CON-PFM-SEC-001 name: Customer feature: FEAT-PFM-SEC-01 product_area: platform module: security revision: 1 status: draft product_intent: confirmed implementation_evidence: observed source_sha: services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 react-console: baf6dae382d6f41dce976c7f848667ccc37e076f definition: >- A customer represents the paying organization and the administrative boundary for its console accounts, with zero or more workspaces beneath it. owned_by: MOD-PFM-SEC synonyms: - paying organization - account (commercial) not_to_be_confused_with: - Workspace - CRM organization - Licence facets: - name: Identifier meaning: >- A stable readable reference identifies the paying organization, including continuity for migrated accounts. used_for: Recognizing the customer in administration and ownership references. - name: Customer type meaning: 'The classification distinguishes customer, trial, demonstration and training accounts.' used_for: Separating commercial accounts from evaluation and internal use. - name: Commercial and accounting links meaning: Commercial and accounting references connect the organization to HubSpot and QuickBooks. used_for: Relating workspace licensing and billing to the paying relationship. - name: Contact address meaning: A normalized e-mail address provides the organization’s contact point. used_for: Communicating with the customer as an organization. - name: Rhythm’s own customer meaning: Rhythm keeps employee console membership under its own customer. used_for: Distinguishing platform staff from customer members. - name: Record protection meaning: Update and deletion locks preserve records against the corresponding changes. used_for: Safeguarding customer records that need deliberate protection. relationships: - to: CON-PFM-SEC-002 statement: A customer may own several workspaces or none; each workspace has one customer. provenance: test source: >- services-platform:modules/customers/tests/integration/db/customers.table.integration.spec.js#refuses deleting a customer that tenants still reference by tenants_customer_fk - to: CON-PFM-SEC-003 statement: 'Console membership belongs to one customer, so membership elsewhere uses another account.' provenance: documented source: 'services-platform:docs/security/security-administration.md#1. What the area is for' - to: CON-PFM-SEC-003 statement: 'Custom definitions remain customer-owned, while built-in roles and policies are shared.' provenance: test source: >- services-platform:modules/security/tests/e2e/definitions.e2e.spec.js#lists the customer's own policies beside Rhythm's, each with the reference a client sends back - to: CON-PFM-SEC-003 statement: Rhythm Administrators receive standing customer access outside Rhythm’s own customer. provenance: test source: >- services-platform:modules/security/tests/integration/services/staff-access/rhythm-administrator-standing-access.integration.spec.js#gives each Rhythm Administrator one active customer-level standing grant in every customer but Rhythm’s own lifecycle: [] acted_on_by: - CAP-PFM-SEC-001 - CAP-PFM-SEC-002 - CAP-PFM-SEC-003 - CAP-PFM-SEC-017 visible_to: - ACT-PFM-001 - ACT-PFM-004 - ACT-PFM-005 evidence: - >- Pinned services-platform references for the structured rows: docs/security/security-administration.md; modules/customers/tests/integration/db/customers.table.integration.spec.js; modules/security/tests/e2e/definitions.e2e.spec.js; modules/security/tests/integration/services/staff-access/rhythm-administrator-standing-access.integration.spec.js. supersedes: [] --- # Customer ## What It Is A customer is the paying organization represented in Rhythm. It may be an association buying for itself or a management company serving several associations. The record can exist before its first workspace is provisioned. It establishes the commercial and administrative relationship under which those workspaces are organized. Rhythm staff create the record in Rhythm HQ. Its readable identifier remains stable as names and other details change, and migrated customers retain their earlier identifier. The record carries a name, classification, contact address and links to the commercial and accounting systems. These details help staff recognize the account and connect operational work to the organization responsible for it. The customer also defines the boundary for console users and customer-owned security definitions. Administrators manage colleagues and reusable access definitions within that boundary. A management company can therefore organize access across its workspaces without gaining authority over another company's people. ## What It Is Not The customer is distinct from the workspace where association records reside. Contacts and organizations maintained by an association belong to CRM within that workspace. A licence describes application availability, while a user account identifies a person who signs in. Neither is interchangeable with the paying organization. ## How It Is Used Onboarding begins with identifying the paying organization. Staff can establish it before requesting a workspace, or include its creation in the provisioning request. Rhythm HQ presents customers together with their workspace counts, making a newly created customer with no workspaces a valid starting point. Staff use the detail page to maintain the available commercial fields. Customer administrators work within their own customer boundary. Choosing that boundary carefully matters: creating two customer records for one administrative relationship separates the people and custom access definitions that staff may expect to manage together. ## Its Facets **Identifier.** The permanent readable reference helps staff recognize the customer across operations and preserves continuity for migrated accounts. **Customer type.** Customer, trial, demo and training distinguish commercial use from evaluation and internal preparation. **Commercial and accounting links.** HubSpot and QuickBooks references connect the record to contracts and billing. Workspace provisioning can use the customer's commercial link as its starting choice. **Contact address.** A normalized e-mail address gives staff a contact point for the organization rather than a sign-in identity for an individual. **Rhythm's own customer.** Rhythm keeps its staff accounts under its own customer, distinguishing staff membership from customer membership. **Record protection.** Update and deletion locks safeguard records that need deliberate preservation. ## How It Relates Every workspace has one customer, while a customer can have none yet or several. Console accounts and custom roles belong within the customer boundary. Shared built-in definitions provide common starting points. Staff access connects Rhythm's people to customer workspaces without making them customer employees. ## What It Could Become The product should implement the remaining customer-deletion safeguards described in the approved plan, including dependent security records, explicit confirmation, a reason and an audit entry. Product should also settle whether changing a customer's commercial link needs authority comparable to changing a workspace's link. These questions affect account administration and commercial control before they affect screen design.