What the shell owns
The shell is the part of erp.io that is not any particular application. It holds accounts, organisations, membership, roles, module entitlement, billing, the audit log, and the mechanism that signs you into a module without a second login. Modules hold everything else.
The division matters because it is what makes the suite a suite rather than a bundle. There is exactly one user directory, one place where a leaver is removed, one bill, and one place to answer "who did that". A twelve-app estate where each app owns its own users is twelve of each of those, and in practice it means nobody is ever quite sure who has access to what.
One origin, path-mounted modules, and what that buys.
Single sign-onAvailableHow a module signs you in without asking, and what it verifies.
OrganisationsAvailableThe tenancy boundary, switching, and multi-entity.
Roles and permissionsAvailableWhat each role can do, and where modules narrow it.
Module accessAvailablePer-person narrowing. Restrict-only, by design.
Billing and plansIn progressThe ladder, how seats are counted, and what is metered.
SecurityAvailableSessions, MFA, API keys, tenancy isolation.
Audit logAvailableWhat is recorded, where, and how long it is kept.
NotificationsAvailableWhat the suite tells you about, and where.
BrandingAvailableLogo and colour on client-facing surfaces.
The rail
The narrow strip down the left of every screen in the suite is the module rail. It shows the modules your organisation has enabled, minus anything removed from you personally, and it is present inside modules as well as in the shell — so switching from Accounting to CRM is one click from anywhere.
Rail links go straight to the module, not through the sign-in hand-off. That is a deliberate performance decision: routing every module switch through the token mint made it three sequential round trips and about two and a half seconds before anything rendered. Going direct works because the suite shares one origin, so a module that has no session of its own can see the shell cookie and start the hand-off itself.
Your suite
Names and keys
Four modules are stored under a key that is not their name. You will see the keys in API responses, in the audit log, and in entitlement records, so they are worth knowing.
| Product name | Stored key | Why it was not renamed |
|---|---|---|
| Accounting | finance | It is the audience claim on every hand-off token already issued. |
| Phony | sdr | Renaming would sign every existing customer out of a module they are entitled to. |
| Chat | messaging | Same reason. Only the label moved. |
| Projects | pm | Same reason. |
Anywhere you type a module name — a sign-up URL, an API parameter — the product name and the key both resolve. /sign-up/accounting and /sign-up/finance reach the same door. Everything downstream speaks the canonical key.
In this section
One origin, twelve path-mounted applications, and a shell that owns identity — what that architecture buys and what it costs.
Single sign-onAvailableHow erp.io signs you into a module without a second login: the hand-off token, what the module verifies, and why a module can still ask you to sign in.
OrganisationsAvailableThe organisation is the tenancy boundary in erp.io. Switching between them, belonging to several, and why multi-entity is not the same as multiple organisations.
Roles and permissionsAvailableThe three organisation roles in erp.io, exactly what each can do, and how modules narrow them further without adding new ones.
Module accessAvailablePer-person control over which erp.io modules somebody can open. Restrict-only by design, enforced at the hand-off, and invisible until you use it.
Billing and plansIn progressThe erp.io plan ladder, how seats are counted, what is metered on top, and which parts of billing are live today.
SecurityAvailableSessions, two-factor authentication, API keys, tenancy isolation and the security controls available to an erp.io administrator.
Audit logAvailableWhat erp.io records, where each kind of event lives, how AI actions are attributed, and how to use the log in a monthly review.
NotificationsAvailableWhat erp.io notifies you about, where those notifications appear, how to change them, and why some things deliberately do not notify.
BrandingAvailablePutting your logo and colour on the erp.io surfaces your customers see — invoices, signing envelopes and the client portal — and what white label does and does not cover.
What this does not do
Nothing in the shell reads across two organisations. Switching is the only way to see another.
Roles and module access attach to a person. There is no group or team object to attach them to instead.
The three roles are fixed. Finer control is module access, not a new role.