Tenant
A tenant is a single Carriyo customer: typically an enterprise retailer, a 3PL, or a marketplace operator running shipping operations at scale. Everything in the platform is positioned inside a tenant: orders, shipments, merchants, locations, users, API clients, and the data they generate.
The tenant is the unit of:
- Subscription. One subscription record per tenant, carrying the plan, the resource quotas, and the feature toggles.
- Isolation. No data, no events, and no permissions cross the tenant boundary. See Tenant isolation for the enforcement detail.
- Configuration. Most platform-wide settings (custom attributes, reason codes, package templates, geo lists) attach at the tenant level and are shared across all merchants in the tenant.
Plan and quotas
Each tenant is assigned a Plan. Carriyo's plans target enterprise operations: the current set is Starter, Pro, and Enterprise. The plan's main practical effect is the resource quotas it allocates: how many of each kind of object the tenant can create.
Quotas are enforced per resource type with two numbers: a soft limit (warns at the Dashboard layer) and a hard limit (rejected at the API). Typical quota dimensions:
| Resource | What's counted |
|---|---|
| Shipments | Shipments booked per quota cycle (monthly for most tenants). |
| Orders | Orders created per quota cycle. |
| Merchants | Active merchants under the tenant. |
| Locations | Active locations under the tenant. |
| Carrier accounts | Configured carrier accounts. |
| Users | Active Dashboard users. |
| API clients | Active programmatic clients. |
| Webhooks | Configured webhook subscriptions. |
| Connectors | Installed plug-and-play connectors. |
Hitting a soft limit triggers a Dashboard warning; hitting a hard limit blocks the create operation. Usage-based quotas (shipments, orders) reset on the configured cycle. Capacity quotas (locations, users, API clients) persist across cycles. Enterprise plans typically negotiate quota dimensions individually rather than taking a packaged tier.
Feature toggles
Beyond quotas, the tenant subscription carries a set of capability flags: booleans that gate whether a feature is available at all. Examples of features that ship gated:
- Returns. The returns app and reverse logistics workflow.
- Premium tracking / branded customer experience. Branded tracking pages, notification templates, custom domains.
- Manifest. End-of-day manifest generation.
- Shipment costing. Costing-profile-based rate computation.
- Carrier capacity rules. Capacity-profile enforcement.
- Carrier network. Network-profile coverage filtering.
- Service-level estimation. SLA computation engine.
- Custom attributes. Extensibility on first-class entities.
- Click and ship. Operator-driven manual shipment creation.
- Carriyo SSO. SAML single sign-on for the Dashboard.
- Pinpoint location, what3words. High-precision delivery address tooling.
Most flags apply at the tenant level. A small number (notably returns, premium tracking, and the three notification channels: email, SMS, WhatsApp) gate at the tenant first and then require the merchant to enable them individually. This lets a multi-merchant tenant turn on a feature globally and let each merchant opt in.
Bundled vs add-on
The distinction between what's bundled in the base subscription and what's sold as an add-on is purely commercial. At the data-model level, every capability is the same shape. The bundled-versus-add-on labelling is part of the Dashboard's commercial layer, not the platform configuration.
Some commonly add-on-priced capabilities are Returns, Premium Tracking, Click and Ship, Carriyo SSO, and Pinpoint Location, but the exact split varies by deal. Treat the subscription record as the source of truth for what's enabled and your commercial agreement as the source of truth for what was paid for.
Tenant lifecycle
Tenants are provisioned by Carriyo's account team. The Dashboard's Account App holds the tenant's billing identity, subscription state, and plan-level configuration; day-to-day operators don't interact with it directly. Tenant deletion is a soft-delete operation managed by the account team and triggers a downstream cleanup of all associated data.