Multi-tenancy

Every Restow installation is multi-tenant internally, even the Community edition, which simply runs as a single tenant. What changes between editions is how many organizations (tenants) the license covers, and whether you get the management of several tenants, the provider team and the overview across tenants.

Roles

Provider administrators manage tenants at the installation level and invite tenant administrators. Since 0.3.1 every edition, Community included, has the provider team: several provider administrators with roles (owner, administrator, technician, read only). Limiting a member to chosen tenants is Service Provider.
Tenant administrators manage sources, schedules, storage, restores and users within their own tenant and see no other tenant. They can be invited in every edition, by the provider or by another tenant administrator.
Restore operators (from 0.3.5) see and restore every backup of their tenant without administering it: no jobs, no storage, no users. Since 0.4.0 they also reach the files of servers and clients, of Proxmox VE guests and SharePoint sites, see what a restore operator reaches. Every new user and invitation needs a role to be chosen.
Tenant users (end users) see and act on only their own mailbox/OneDrive data.

Data isolation

Each tenant’s data is isolated by PostgreSQL Row Level Security on a dedicated application database role (isolation is enforced by the database, not only by application logic), and each tenant has its own data-encryption key, wrapped with the installation’s master key.

Whoever operates the server (you) holds that master key and can, technically, unwrap and decrypt any tenant’s data with it. The isolation above stops one tenant reaching another’s data, not the operator reaching either. The application only ever unwraps a tenant’s key through logged operations (a restore, an export), never silently; there is no separate “operator cannot see tenant data” guarantee beyond that.

Editions

Community and Business: one organization (one tenant); Business is licensed for one organization. Managing several tenants is part of Service Provider. There is no mailbox limit in any edition.
Service Provider: any number of tenants (your own customers) in one installation, with delegated tenant administrators (each tenant has its own administrators, who see and manage only that tenant), limiting provider team members to chosen tenants, the provider overview across all tenants (tenant reporting: status, key figures, stale backups, failures, storage problems and alerts of every tenant; since 0.4.0 it also counts file shares and file shares without a job, and shows immutability warnings), the All tenants view under Jobs (since 0.4.0, Service Provider), which lists every tenant with its jobs per kind, what runs and waits and how the newest backups ended, with filters and sorting, and the integration API available across tenants through a provider key. The number of tenants is not technically limited. Scheduled summary reports per tenant come with Business and above. White-label branding for this edition is in development, not available yet.

A second tenant needs the full images with a Service Provider license key. Without one, the full images refuse it with 403 urn:restow:problem:edition-required and point to the license section (Installation → License); the Community images refuse it with 403 urn:restow:problem:feature-unavailable. See License and editions.

Monthly prices and the estimate per tenant (since 0.4.7)

If you charge your customers per month, Restow can show what each tenant comes to at your prices. It is an overview for you: Restow bills nothing and limits nothing, no mailbox count or storage figure is enforced, and nothing is sent to a customer.

Where you enter the prices. Installation → Prices: a monthly price per mailbox and a price for storage per GB or per TB of the tenant’s stored backups, in EUR, CHF, USD or GBP. A price takes at most four decimals; a price left empty is not shown.
What is counted. Mailboxes are counted as in the mailbox usage on Overview (a OneDrive does not count twice; imported mailboxes, SharePoint sites and Microsoft 365 group mailboxes do not count, see API reference). Storage is the tenant’s stored backups, deduplicated and compressed, in decimal units (1 GB is 10^9 bytes, 1 TB is 10^12 bytes).
Who may. Provider administrators with every tenant read the prices, and only the owner of the installation changes them. Each change is audited as settings.pricing.updated with the values before and after. Tenant users never see the prices.
What it shows. On the overview of each tenant, provider administrators with every tenant see a card Price per month: what the tenant comes to at these prices, one line for the mailboxes and one for the storage, with the link Adjust prices. The card appears once a price is set; after the update to 0.4.7 the prices are empty, so no card shows until the owner enters one.

Import folder and endpoints

Mail files for import can come from a server-side folder. There is one import folder for the installation, and every tenant gets its own subfolder, <folder>/<tenant slug>/, which you create. An administrator of one tenant cannot list or import the files in another tenant’s subfolder: the API and the worker both check that a path lies inside the tenant’s own subfolder. Servers and clients backed up with the agent belong to one tenant each, with their own restic repository in that tenant’s storage target, whose password is sealed with that tenant’s key (Endpoint backup).

Impersonation

When an administrator restores or accesses data on behalf of a user (rather than the user doing it themselves), that is impersonation, and it is always logged in the audit log: who acted, when, on whose data, what was done, and from which IP.