Tenants and buildings. One roof.

Multi-tenant by design, not by configuration

Subdomain-per-tenant isolation is enforced at the middleware layer. Each tenant runs on its own URL, with its own users, brand, and audit log -- and you stay above the tree with portfolio reporting and tenant invoicing.

Subdomain-per-tenant isolation

Each tenant company runs on its own subdomain -- with its own users, rooms, visitors, audit log, and branding. The platform routes data by subdomain at the middleware layer, so cross-tenant access is impossible by design.

Per-building admins

Every building can have its own on-site management team with admin rights scoped to that building only. Lobby staff, facilities, and security each get the access they need -- nothing more.

Tenant-level usage tracking and invoicing

Track room hours, visitor volume, parking, and amenity usage per tenant. Tenant budgets and credit balances flow into invoices generated and delivered through Stripe.

Custom branding per tenant

Every tenant runs in its own visual identity -- logo, primary colour, transactional email headers, and lobby kiosk skin. The platform looks like the tenant's product, not a landlord's portal.

Aggregated portfolio reporting

Roll up bookings, occupancy, visitor traffic, and revenue across every building you manage. Tenant analytics, room analytics, and the audit log all answer questions at the portfolio level.

Enterprise security and SSO

OAuth, SAML, and LDAP single sign-on with JIT provisioning. TOTP MFA with backup codes, account lockout, encrypted at-rest secrets, audit logs across user, MFA, SSO, and watchlist events.

From a signed lease to a CFO-ready report

Four moments in the lifecycle of a tenant, mapped to the BellKeep surfaces that handle them.

Onboard a new tenant onto their own subdomain

Sign a new tenant. Create their company in BellKeep; the platform issues a dedicated subdomain. Upload their brand assets, invite the tenant admin via magic link, and they start setting up their own users -- on their own URL, in their own colours.

Hand the keys to on-site management

Per-building admins handle their own bookings, visitor flows, and screen content. Property managers stay above the tenant tree, with visibility everywhere but day-to-day in nowhere unless they ask for it.

Invoice tenants for what they actually used

Tenant budgets cap usage. Invoices line-item the base plan plus overage. Stripe charges the saved card, dunning takes care of failed payments, and tenant credits balance refunds and adjustments -- without spreadsheet exports.

Report on the portfolio without an analyst

Tenant analytics, room analytics, and visitor analytics roll up across every building. Occupancy, no-show rates, peak hours, and revenue per tenant land in dashboards you can show your CFO without preparation.

Property portfolios land on Enterprise

Enterprise removes the user and building caps, unlocks OAuth, SAML, and LDAP SSO, and adds custom integrations, a dedicated SLA, and white-label hosting. Subdomain-per-tenant isolation, custom branding, tenant invoicing, and portfolio reporting are all part of the package.

Five buildings, eighteen tenants, one quarter to migrate

What a mid-sized property manager with five buildings and eighteen tenant companies can do over a quarter on BellKeep -- without forcing every tenant onto a new tool on the same Monday.

Stand up the portfolio backbone

Create the five buildings and assign per-building admins. Configure SAML SSO against the corporate identity provider. Set tenant-level usage budgets and the chargeback model.

Bring the first six tenants online

Each tenant gets a dedicated subdomain. Brand assets uploaded, admins invited via magic link, kiosk URL handed to lobby staff. Calendar sync turned on; bookings flow without anyone re-learning a calendar.

Roll the remaining tenants over

The other twelve tenants come online over four weeks, two or three a week. Existing visitor logs import via the public API. Tenant invoicing runs on Stripe; failed payments surface as alerts.

Report up to the board

Tenant analytics, room analytics, and visitor analytics roll up across all five buildings. Occupancy, revenue per tenant, no-show rates, and visitor volume are board-ready -- from a single dashboard, with the audit log behind it.

Other shapes of workplace we fit

Corporate offices

Multi-building scheduling, Microsoft 365 and Google Workspace sync, OAuth/SAML/LDAP SSO, RBAC.

Coworking spaces

Member-company sub-tenants, Stripe billing, lobby kiosk, parking and amenities.

Calendar & bookings

Drag-to-create scheduling with recurring rules, conflict detection, and a multi-room booking cart.

Visitor management

Lobby kiosk, touchless QR check-in, wallet passes, NDA signing, badge printing, watchlist screening.

Room displays

Tokenised in-room screens, lobby signage, and a drag-and-drop builder for both.

Wayfinding

Interactive floor plans, QR-launched directions, point-to-point routing through the building.

What you'll want to know

How is one tenant kept separate from another?

Every tenant runs on its own subdomain. A middleware layer resolves the tenant from the hostname on every request and scopes the entire query layer to that tenant. Users, rooms, visitors, audit logs, and branding never cross between tenants. Reserved subdomains (www, api, admin, app, cdn) are blocked from being assigned.

Can each tenant look like its own brand?

Yes. Every tenant has its own logo, primary colour, transactional email headers, and lobby kiosk skin. On Enterprise we can also host tenants on fully custom domains. The platform never imposes a landlord brand on the tenant experience.

Can each building have its own management team?

Yes. Per-building admin roles are first-class. Facilities, lobby staff, and security each get rights scoped to a single building. Property managers retain visibility across the whole portfolio but never have to micromanage a single lobby.

How does invoicing tenants work?

Each tenant sits on a Stripe subscription. Tenant budgets cap usage, and overage rolls into the monthly invoice. Auto-pay, dunning for failed payments, and tenant credits for refunds and adjustments are all built in. Invoices export as PDFs.

What about audit logs and GDPR?

Audit logs cover user actions, MFA events, SSO sign-ins, and visitor-watchlist changes -- every entry tied to a tenant. GDPR tooling handles consent capture, data-retention policies, deletion requests, and breach-notification records from a single dashboard.

Can we migrate from a spreadsheet or legacy lobby tool?

Most property managers start by importing buildings and rooms, then connecting Microsoft 365 or Google Workspace for calendar sync. Legacy visitor logs can be imported via the public API. Tenants come online subdomain by subdomain -- you do not need a big-bang cutover.