What this is, and who it is for
Once an organization exists the console lets a Super-Admin see where it stands, read how big it is, follow its first administrator's invitation, switch its features and suspend or restore it. It never shows what is inside the organization: no study, person or record. Usage and invitation figures are read live from the data plane when the page opens and are never stored in the control plane; a figure that cannot be read is shown as unavailable, never as zero.
Where to find it
Dashboard for the platform as a whole; Organizations for the list; an organization's own page for one.
What you can do
The dashboard
Organizations on the platform, and where their first administrators are. Four tiles count organizations (Organizations, Active, Provisioning: Saved, not yet in the data plane, Suspended). Under First administrators: Invitations pending (Sent, not yet accepted), Invitations accepted and Organizations waiting (No administrator has come yet). Under Across all organizations: Users, Studies, Exports (All time) and Documents (Stored size). Recent organizations lists the six newest. The data plane figures arrive after the counts and carry a note when the data plane did not answer for some organizations (The data plane did not answer for {n} of {m} organizations; the figures cover the {k} that did.), so a total is never mistaken for the whole.
- The four entries of the console.
The organization list
Tiles for Total tenants, Active, Provisioning and Suspended; a table with the organization's Name (and first administrator's address), Code, Type, Status and Data plane (synced or pending), a search and Provision organization (Provision an organization). Choose a row to open it.
An organization's page
The header shows the name, the status and the code, with Retry sync (while still provisioning) and Suspend or Restore. Four tabs:
- Overview: the profile: code, type, country, the Org Admin (name and address) and whether the data plane is synced.
- Administrators: Administrator invitations, read from the data plane: tiles for Active administrators, Invited, not yet come and Mail delivery (Reported or Not reported: This mail service never says more than "Sent"); a warning while nobody has come (No administrator has accepted yet … Resend the invitation if the mail went astray); and a table with Person (marked Provisioned with this address), Invitation (Pending with when, Accepted, Revoked or Expired), Link (Works until …, Expired …, No link needed), Last mail (Queued, Sent, Delivered, Bounced, Failed or Cancelled, with what it means) and Mails. Resend invitation issues a new link and mails it; the earlier link stops working; a second press within a minute adds nothing (A mail was queued a moment ago. Nothing more was added.). Each resend is on the ledger as
org.admin_invitation_resent. Refresh reads the data plane again. If the organization has not been pushed, the tab says so and offers Retry sync; if the data plane cannot be reached it says that and offers Try again. - Usage: Read from the data plane just now. Totals since the organization was created. Users, Studies, Exports (all time) and Documents (stored size). Nothing is compared with a limit, because there is none.
- Feature switches: Feature switches.
- Suspends the organization; it asks for a reason.
- Overview, Administrators, Usage and Feature switches.
Suspend and restore
Suspend asks for a reason of at least five characters (Every user of this organization is signed out of every device at once and cannot sign in until it is restored. Their data is kept. The reason is recorded on the platform audit ledger with your name.). The control plane tells the data plane first, then records what happened, and the entry says whether the data plane applied it (dataPlaneApplied). Restore (Every user of this organization can sign in again) takes an optional reason. An organization that never completed its handshake is restored by a sync, not by a restore, and a closed organization stays closed.
- Why the organization is being suspended; recorded on the platform ledger.
Close, and correct an organization (API)
POST /organizations/{id}/close closes an organization for good, with a reason; the data plane treats it as suspended. PATCH /organizations/{id} corrects its name, code, type, country or first administrator, with a reason of at least five characters, writing both values to the ledger. The console has no screen for either today.
Every option
| Status | Colour on the list | Meaning |
|---|---|---|
| provisioning | warning | Saved here, not yet in the data plane |
| active | success | Running |
| suspended | error | Blocked; data kept |
| closed | muted | Final |
What the system records
On the control plane ledger: org.suspended, org.restored, org.closed, org.updated, org.data_plane_synced, org.admin_invitation_resent, entitlement.set. In the data plane: platform.tenant.status_applied when it applied a suspension or restoration. See The platform audit ledger.
What you cannot do, and why
- Read an organization's studies, people or data. The console holds none, by design.
- Delete an organization, or reopen a closed one by restoring it. Reopening would be a provisioning decision, not the inverse of a suspension.
- Suspend or close without a reason.
- Change an organization's feature switches that gate nothing. Two of the five are shown as not built.
Compliance Q&A
Yes. A suspension is pushed to the data plane first; every user is signed out and blocked, and the control plane's ledger records who decided, why, and whether the data plane applied it.
Evidence: control plane setStatus (data plane told first, then the ledger entry with reason and dataPlaneApplied)data plane platform.tenant.status_appliedsimulation of 20 Oct 2026, step 1 (all users lost their sessions)
Related
The platform console · Provision an organization · Feature switches · The platform audit ledger