Team & Roles management

Renta uses a Role-Based Access Control (RBAC) model to manage user access and security. This system allows you to collaborate on data pipelines within isolated environments called Workspaces.

Workspaces

A Workspace is the fundamental unit of isolation in Renta. It functions as a secure container for your data infrastructure.

Isolation model

Every workspace operates as a completely independent environment. Resources created in one workspace are not visible or accessible from another.

1. Data isolation. Sources, Destinations, and Pipelines exist only within their parent workspace.

2. Billing isolation. Each workspace has its own subscription plan and billing settings.

3. User isolation. User access is granted per workspace. Being an Owner in "Workspace A" does not grant access to "Workspace B".

Data residency

When creating a workspace, you must select a Data Processing Location. This setting determines the physical location of the cloud infrastructure processing your data.

1. Europe (EU). Compliant with GDPR requirements. Data remains within the EU.

2. United States (US). Optimized for US-based data sources and destinations.

Roles and permissions

Renta provides two pre-defined system roles. Access is binary: users are either administrators (Owner) or standard operators (Member).

Permission matrix

The following table details the specific capabilities of each role.

Role definitions

The following table provides a breakdown of each role's capabilities and typical use cases.

Owner

The Owner role is effectively a "Workspace Administrator". Owners have unrestricted access to all aspects of the workspace.

1. Primary responsibility. Infrastructure management, billing, and team security.

2. Best practice. Assign this role to Team Leads, DevOps Engineers, and Project Managers. maintain at least two Owners for redundancy.

Member

The Member role is designed for daily operations. Members can build and maintain data pipelines but cannot alter the workspace configuration or security settings.

1. Primary responsibility. Building and monitoring data pipelines.

2. Best practice. Assign this role to Data Engineers, Analysts, and Developers.

Managing access

Managing team members involves inviting new users, updating roles as responsibilities change, and revoking access when necessary.

Invite a new team member

Grant workspace access to a colleague.

Navigate to Team membersStep 1

Go to Settings > Team members tab. Click the Add member button.

Configure AccessStep 2

In the Add member sidebar, enter the user's email address and select the appropriate role (Owner or Member).

Send InvitationStep 3

Click Invite member. The user will receive an email with a secure link to join the workspace. The status will remain Pending until accepted.

Modifying roles

You can promote a Member to Owner or demote an Owner to Member at any time.

1. Navigate to Settings > Team members.
2. Click on the user in the list to open the Edit member sidebar.
3. In the Role selection section, choose the new role.
4. Click Save to apply changes immediately.

Revoking access

To remove a user from the workspace:

1. Navigate to Settings > Team members.
2. Click on the user in the list to open the Edit member sidebar.
3. Scroll to the bottom to the Remove member section.
4. Click the Remove member button.

Leaving the workspace: Members can remove themselves from the workspace at any time but cannot remove other users. To leave, follow the same steps above for your own user profile.

Best practices

Follow these recommendations to maintain a secure and efficient workspace environment.

Security & governance

1. Principle of least privilege. Default to the Member role for all new users. Only grant Owner privileges to users who explicitly need to manage billing or access.

2. Audit regularity. Review your Team members list quarterly. Revoke access for employees who have changed teams or left the company.

3. Service accounts. For API integrations, avoid using personal user accounts. Create a dedicated email alias (such as etl-bot@company.com) and invite it as a Member to generate API keys.

Environment strategy

Use multiple workspaces to implement a safe software development lifecycle (SDLC) for your data infrastructure.

1. Development workspace. For testing new sources and pipeline configurations. Grant simplified Owner access to developers here.

2. Production workspace. For live business data. Restrict Owner access strictly to Senior DevOps or Team Leads. Lock down permissions to ensure stability.