Recommended setup for multiple legal entities in one EspoCRM instance

[newbie1]

Hello

We are evaluating whether one self-hosted EspoCRM instance can be used by multiple legally separate entities.

Users of each entity must only be able to access their own customer and operational data. Selected management users, however, need a consolidated view and consolidated reporting across all entities.

Our intended approach is to assign records and users to separate Teams and control access through Roles using the “own”, “team” and “all” access levels.

Is this the recommended architecture for this type of setup?

We would also appreciate clarification on the following points:

1. Can Teams and Roles provide reliable data separation between the entities?
2. Do Advanced Pack reports respect record-level and field-level access permissions of the user viewing or executing the report?
3. Do workflows and BPM processes respect the permissions of the initiating user, or can they access fields and records beyond that user's permissions?
4. Are there any known limitations when management users require consolidated reporting across all entities?
5. Are there situations in which separate EspoCRM instances would be recommended instead?

No legal or contractual tenant isolation is required for this question. We are specifically interested in the technical access-control model.

Thank you.

[victor]

1. Teams and Roles grant or restrict access of certain users to certain records in certain entities and/or to the entity as a whole. That is, the answer to your question is yes. When you explore the functionality of Teams and Roles in more depth, I advise you to move on to studying the functionality of EspoCRM Portal:
- quick tour: https://docs.espocrm.com/administration/portal;
- documentation: https://docs.espocrm.com/administration/portal/.

2. Yes. There are restrictions to the Role for Regular User (as for most other entities) and there is additionally "Apply access control" in Grid Reports:

Report results will depend on user's access. Records the user does not have access to will be excluded from the result data.

- quick tour: https://app.supademo.com/demo/cmca8j...18qszrhdt68jy;
- documentation: https://docs.espocrm.com/user-guide/reports/.

3. Access to Workflows is possible only for Admin users. For the rest, the only option is to access the Button in the Detail view of a specific record, created in Manual Workflow: https://docs.espocrm.com/administrat...kflows/#manual. As for Flowcharts, Process User Tasks, Processes, Report Categories, Reports, access to them and to individual fields is implemented as in other entities.

4. Please describe in more detail what is meant by "consolidated reporting across all entities"? You may have already found the answer in the previous three points.

5. Partially answered in the first point. But you can also configure interaction between different EspoCRM instances if you have programming skills. Personally, I don't remember such cases.