Multi-tenancy & roles

Tenant model

MyRentalCalendar is multi-tenant at the top level: one tenant = one agency = one legal entity, with its own units, owners, users, bookings, branding, currency, tax settings and legal content.

• Shared database, tenant_id on every business table; unique keys are always composite with the tenant (e.g. unit slug, invoice number).
• The public website resolves its tenant by host name (custom domain per agency); portals resolve it from the user’s membership.
• Cross-tenant access returns 404 (not 403) — resources of other tenants must not even be confirmed to exist. An automated isolation test-suite guards this (see docs/08-testing-qualitaet.md).

Roles & visibility

Role	Scope	Calendar view	Guest PII
Agency Admin	all units	everything, all actions	full
Backoffice	all units	everything, booking actions	full
Manager / Concierge	assigned units	assigned rows, check-in/out	full (assigned)
Team Lead / Cleaner	task-based (turnovers)	task calendar, no prices	initials only
Accountant	all, read + finance	read-only	limited
Landlord (owner)	owned units	periods, source, value — no names	none

The prototype implements Admin, Backoffice and Landlord end-to-end; the field roles follow with the housekeeping module.

Per-tenant legal identity

Because each agency operates under its own company, the imprint, terms & conditions, privacy policy, disclaimer and cancellation policy are content of the tenant, not of the platform. Admins edit them in the backoffice (Legal editor); the tenant’s public website serves them under /legal/*. The platform operator never shares legal responsibility for tenant content — a standard SaaS separation that the disclaimer template also spells out.

SaaS layer (planned, P7)

Tenant self-service signup, plan limits & feature flags, Stripe billing, custom-domain automation (on-demand TLS via Caddy) and an audited platform-admin console with impersonation.