Your own web address

Your company gets its own address on the platform, and being on that address is what tells the software whose account it is showing.

What it is

Each account has a slug. That slug becomes a subdomain, and the subdomain is the authoritative statement of which company a request is for. The lookup is cached in-process for five minutes so a rename or suspension takes effect quickly without hitting the database on every request. Reserved labels (www, app, api, admin, mail, support, dashboard and others) can never be claimed as a company slug.

Also called: subdomain · acme.leads2build.com · my own URL · company URL

See it
Your own web address
Area
Platform & Admin
Group
Tenancy & isolation
System
Multi-Tenancy & Identity
Solves
3 named problems
01extractSubdomain() pulls the first label off the Host header, returning null for the apex, localhost, bare IPs and preview hosts.
02resolveOrgIdFromSlug() looks the slug up in organizations and caches the answer for five minutes.
03A suspended account resolves to nothing — except when it is locked for non-payment, which still resolves so the tenant can reach the pay-to-unlock screen.
The browser address bar showing acme.leads2build.com next to the same app on a different tenant's address. Middleware is invisible; show the address bar plus the sidebar brand block from src/components/layout/Sidebar.tsx. Sample data — no customer information appears here.
How it works
  1. 1extractSubdomain() pulls the first label off the Host header, returning null for the apex, localhost, bare IPs and preview hosts.
  2. 2resolveOrgIdFromSlug() looks the slug up in organizations and caches the answer for five minutes.
  3. 3A suspended account resolves to nothing — except when it is locked for non-payment, which still resolves so the tenant can reach the pay-to-unlock screen.
  4. 4The resolved id is injected as x-org-id and read by every route through getOrgFromRequest().
  5. 5Provisioning registers <slug>.<root> with the hosting provider so the address gets a TLS certificate automatically.
Why we built it

The subdomain is not cosmetic — it is the tenancy signal. Middleware notes that being on a real org subdomain 'is itself proof of org context', because a session token does not reliably carry the org across subdomain boundaries. A billing-locked account still resolves on purpose: 'A billing lock is a suspension the tenant can lift by paying — the subdomain must still resolve so they reach the lock screen (Keith 08-18).' The reserved list exists because infrastructure labels and a customer slug share one namespace, and the day someone registers 'admin' as a company name that namespace collision becomes an outage.

The problem
  • The app needs an unambiguous, cacheable answer to 'whose account is this request for' before authentication even runs.
  • A tenant renamed or suspended must stop resolving quickly, not on the next deploy.
  • Infrastructure hostnames must never be claimable as a company slug.
Sound familiar?
What you get
Your team logs in at your own address.
The URL itself scopes the data, so a mistyped link lands you nowhere rather than in someone else's account.
Certificates and DNS are set up for you at provisioning time.

See it on your own jobs

Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.

or keep browsing features →