Chapter 076 min read

Organizations vs. teams

Learn how the platform, organizations, teams, and users relate in CCHP, which settings each organization keeps separately, which ones you set on teams, and what each role can do.

One CCHP deployment can hold several organizations. Organizations are isolated from each other: each organization configures its own providers, members can call only their own organization’s providers, and one organization’s traffic does not affect another organization’s routing or alerts. A team is a group of members inside an organization, and all teams in the same organization share that organization’s providers. If you have used CC Hub, think of one organization as a complete CC Hub.

Platform, organizations, teams, and users#

Platform: The whole CCHP deployment. A platform super admin manages all organizations and the settings that all organizations share.
Organization: A separate tenant with its own providers, members, LLM keys, limits, and call records.
Team: A group of members inside an organization, which can have its own sub-teams. A team cannot add providers and can only use the provider groups of its organization.
User: One sign-in account. One account can join several organizations, and its roles, wallets, and LLM keys in each organization are unrelated to each other. In one organization, a user belongs to at most one team, or to no team at all.

If your account has joined several organizations, click the organization name on the left of the top bar to switch the current organization. See Switch the current organization.

Which settings belong to organizations, teams, and users#

Separate for each organization#

Each organization has its own copy of the following, and it applies only to that organization:

Providers, endpoints, provider keys, and Provider groups, configured in Provider Management. Members can see and select only provider groups, not the specific providers in a group.
Models that you add for the organization in Model Management.
Members and roles, teams, invite codes, and Enterprise SSO.
The Shared organization limits and the Billing mode (prepaid or postpaid) that a platform super admin sets, and the Default limits per member that organization admins set. How the limits of every level apply together is described in Limits on every level and postpaid organizations.
Own multiplier, which is applied to the prices billed to the organization’s members.
Call records and usage statistics.
Client restriction: The clients that are allowed to call the organization.
Sidebar: The console sidebar that the organization’s members see after signing in. Without its own setting, the organization uses the global one. See Customize the sidebar.

Set on teams#

Teams in the same organization share the organization’s provider groups. In Org management → Team Management, open a team to set:

Members: Team members and team roles.
Provider groups: On top of the organization’s settings, turn a group on or off for this team only, and set Team ×. Sub-teams inherit this team’s settings.
Team multiplier: Multiplied by the organization’s multiplier, and applied to the prices billed to the team’s members.
Limits: Apply to the combined usage of the members of the team and all its sub-teams, and are set by organization admins.
Client restriction.

Separate for each user#

Sign-in account: The email, password, and two-step verification work across the whole platform. A user who joins several organizations still has only one account.
Wallet: A user has one wallet in each organization. Top-ups, redeem codes, and charges for calls change only the wallet in the current organization.
LLM keys: An LLM key created in an organization can call only that organization’s provider groups. When the user is suspended in or removed from that organization, or their membership expires, these keys stop working.

Shared by all organizations#

A platform super admin maintains the following settings, which apply to all organizations:

Administration → Sign-in Methods: Sign-in methods and whether external sign-up is allowed.
Administration → Operations Settings: Payment channels, packages, and redeem codes.
Administration → System Management: Global system settings.
Default organization: The organization that new users join automatically after they sign up.

Roles#

Each user has one organization role in an organization, and after joining a team, a team role as well. Platform super admin is an identity of the account itself and does not belong to any organization.

Role	Scope	What it can do
Platform super admin	The whole platform	Manages all organizations (creates organizations and sub-organizations, sets the default organization, suspends organizations), and maintains the platform-wide settings in the Administration menu
Organization super admin	One organization	The organization’s owner, with all permissions in the organization. Can appoint organization admins. Each organization keeps at least one
Organization admin	One organization	Manages the organization’s members, teams, invite codes, Enterprise SSO, permissions, providers, and models, sets the limits of teams, members, and LLM keys, and views the call records of the whole organization
Member	One organization	Creates their own LLM keys, calls the provider groups that the organization makes available, and views their own call records and wallet
Team admin	One team	Manages the basic info and client restrictions of the team and its sub-teams, sets the user limits of their members, removes team members, and views the team’s call records
Team member	One team	Permissions come from the organization role. Cannot manage the team

Only someone with higher permissions can change a role: an organization admin can suspend or remove a Member but cannot change anyone’s organization role. Appointing an organization admin requires an organization super admin or a platform super admin. See Change an organization role. The Org management menu in the sidebar appears only for roles with admin permissions, so a Member does not see this menu after signing in.

Sub-organizations and sub-teams#

An organization can sit under another organization as its sub-organization, forming a multi-level organization tree, which suits setups such as distribution agents. A sub-organization is still a separate organization: it has its own providers, members, and call records, and it does not inherit its parent organization’s providers. Multipliers, limits, client restrictions, and operations settings such as daily check-in apply down the organization tree. See Manage sub-organizations.

Teams can also have sub-teams. A sub-team inherits its parent team’s provider group settings and client restrictions. A team’s effective multiplier = the organization’s effective multiplier × the multiplier of every level of parent team × the team’s own multiplier. See Manage teams.

Manage organizations and teams#

Manage organizationsCreate organizations and sub-organizations, and set organization multipliers, limits, and the billing mode Manage teamsCreate teams, add team members, and set provider groups and limits for teams Manage usersInvite or create users, change roles, and suspend or remove members Default organization and invite codesHave new users join the default organization automatically, or join organizations and teams with an invite code Limits on every level and postpaid organizationsLimits of every level held together, usage counted upwards, and the postpaid credit limit of postpaid organizations Customize the sidebarHide or move sidebar entries, and add links or embedded pages

Frequently asked questions#

No. A provider belongs to only one organization, and a sub-organization does not inherit its parent organization’s providers either. If you want several departments to share providers, set them up as teams in the same organization. If you really need separate organizations, add the providers and provider keys in each organization separately. You can add the same upstream key to different organizations.