# Workspaces & organizations
Source: https://docs.tensormachine.ai/workspaces

## The dual-account model

Tensor Machine has **one account per person** — your verified email, reached by whichever
sign-in method you use ([more on that](/accounts)) — and **two kinds of workspaces**:

- **Personal workspace** — created automatically the first time you sign in, named after you
  (e.g. `ananyas-workspace`). Your own wallet, API keys, and usage — and it can never be
  taken away from you. You *can* invite people into it for lightweight collaboration, but it
  stays a personal space: it can't claim email domains, so the enterprise features that hang
  off a verified domain (SSO, SCIM, domain-based joining) don't apply here.
- **Organization** — a company workspace with members, teams, roles, shared billing, and the
  full admin controls (verified domains, SSO, SCIM, audit). You join one by invite, by your
  company's domain policy, or by signing in through your company's SSO — or create one any
  time from the workspace switcher (**New organization**).

The same login reaches both. The console's workspace switcher (bottom of the sidebar) moves
you between every workspace you belong to; each one keeps its own keys, wallet, models, and
usage.

## How you end up in each

| You… | What happens |
|---|---|
| Sign up by yourself | You get a personal workspace and start there. |
| Accept an invite, or join via your company's domain | You're added to the work org **and still keep** your personal workspace. The work org becomes your default landing. |
| Sign in through your company's SSO for the first time | You're provisioned into the work org automatically (the org assigned your email domain to its identity provider) — and a personal workspace is created for you too. |

## Money never moves between workspaces

Wallets, invoices, and credits are **scoped to one workspace**. Funds you add to your personal
workspace stay there when you join a company org — they are never merged into the company's
balance (they're different tax entities: your personal invoices are issued to you, the org's to
its GSTIN). If you no longer need a personal balance, request a refund; it can't be transferred.

The same goes the other way: your company's wallet pays only for keys minted in the company
org. Usage on your personal keys never bills the company.

## When your company enforces SSO

An organization can require that members sign in through its identity provider
([**Enforce SSO**](/console-management/sso)). This gates access **to that organization only** — it never blocks your login:

- Signing in with a password or Google still works, and your **personal workspace stays fully
  reachable**.
- Opening the enforced organization shows a *"requires SSO"* screen with a **Continue with
  SSO** button — one fresh authentication at your company's IdP and you're in.
- The org still appears in your workspace switcher; it's the content that's gated, not the
  listing.

So an enforced org can never strand you: your identity, your login, and your personal
workspace (and its funds) remain yours.

## Leaving an organization

If you leave (or are removed from) a work org, your seat and your org API keys are revoked —
but your login and personal workspace are untouched. Offboarding removes access to the
*organization*, never to the *account*.