Keep each client’s subscriptions and access separate.

Workspaces separate subscriptions, members and encryption keys. An agency can organize each client in its own workspace, avoiding a shared vendor list that exposes information across client accounts.

Workspace roles and subscription-level permissions let an agency decide exactly what an employee, contractor or client can reach. Guests can be limited to subscriptions shared with them, which is useful when a client needs access to one account rather than the entire workspace.

Keep ownership, billing details, renewals, credentials and TOTP context with the subscription. The activity log gives workspace admins a record of sensitive access; exported subscription data does not contain secrets. See Security for the documented protections.