Understand workspace isolation and safe sharing

How workspace isolation works

Finanly opens your session in one active company workspace at a time. Protected actions are checked against that active workspace, your membership, and your role before the app allows them.

If you belong to more than one company, you can switch between them in the sidebar. After a successful switch, the app reloads so the rest of the interface matches the new company context.

Who can see what

Your access depends on both your current company membership and your role in that company. The app verifies that you belong to the active company before it allows protected company data and actions.

• You need a current company membership to open company-scoped protected data.
• Owner and admin roles can use workspace admin actions in the current company.
• A role alone does not override a missing company membership.
• If you are not a member of the current company, protected access to that workspace is blocked.

Exports and sharing authority

Only share an export or report when you are authorized to access and share the underlying company information. An owner or admin role can allow workspace admin actions, but it does not by itself grant permission to disclose company information outside the workspace.

Treat exported files and shared reports as sensitive because they can contain financial details, names, and other company information.

Safe secret entry and diagnostics

Enter passwords, reset codes, and other secrets only in the fields that explicitly ask for them. Do not paste secrets into notes, page URLs, messages, or support tickets unless the field is clearly meant for secure entry.

For diagnostics, share only the minimum information needed to troubleshoot the issue. A support reference shown on screen is useful if the app provides one. Avoid sending full account numbers, passwords, reset links, or private messages unless support specifically asks for them.

• Use the on-screen sign-in, password reset, or company switch controls when the app provides them.
• Share the error text shown in the app, not your password or other secrets.
• If a request reference appears on screen, include that reference in your support message.
• Do not include bank credentials, API keys, or one-time codes unless the setup screen explicitly asks for them.

How to share information safely

1. Confirm you are in the correct company before sharing anything.
2. Share only the minimum information needed for the request.
3. Remove anything that is not needed, such as unrelated names, account details, or personal notes.
4. If you are sending a support request, include only the visible error and any on-screen reference.

What not to assume

• Do not assume every enabled page is available to every role.
• Do not assume a menu item proves a feature is active for your company.
• Do not assume a successful sign-in or page load means you can access every company.
• Do not assume support can use a secret or export to see other companies without permission.

If a page is hidden, disabled, or unavailable, that can be due to your company membership, your role, or the features enabled for your company. Use the app’s visible messages to guide your next step.

If access or sharing does not work

1. Make sure you are signed in with the account that belongs to the correct company.
2. If the app shows a session or workspace message, use Retry session or sign in again if prompted.Retry session
3. If the company switch fails, stay in the current company and try again after the error clears.
4. If a page is missing, check whether your role in that company should have access to it.
5. If you still cannot proceed, contact your company owner or admin and include the exact message shown on screen.

If a secret was entered into the wrong field, do not reuse it in another place unless the app explicitly asks for it again. If you think a sensitive value may have been exposed, change it through the appropriate account or company process as soon as possible.