Account Models and Tiers

RiskOS™ has two account models: standalone and managed. A managed account is also assigned a tier that controls its feature access. This page explains the two models first, then the tiers — they're separate ideas, and keeping them straight avoids a common point of confusion.

📘
"Standalone" means two different things — read this first

A standalone (direct) account is an account model: a RiskOS™ account with no Channel Partner (for example, an account that signed up with Socure directly or through self-service).

A Standalone tier is one of the two tiers a Channel Partner assigns to a managed client account — the other tier is Centrally Managed.
In other words, a "Standalone tier" account still belongs to a Channel Partner, while a "standalone account" has no Channel Partner at all. This page says "standalone account" for the model and "Standalone tier" for the tier so the two never blur together.

Why it matters

The account model decides whether a Channel Partner is involved at all. For managed accounts, the tier then decides what the client can do on their own — what features they access, whether they can create workflows, and how much of their configuration the Channel Partner controls. Knowing both lets you make informed tier assignments and explain account capabilities to your clients.

Part 1: Account models

The account model is the top-level distinction. Every RiskOS™ account is either standalone or managed — never both.

RiskOS account models

Standalone (direct) account
No Channel Partner
Customer manages everything
e.g. direct or self-service signups

Managed account
Created and managed by a Channel Partner
Assigned a tier (see Part 2)

Standalone (direct) account

A standalone account is a standard RiskOS™ account where the customer manages everything themselves. There is no Channel Partner involvement, and there is no tier — the account owner has full control over workflows, users, settings, and configurations.

This includes accounts that sign up with Socure directly and self-service signups. In all cases, the defining trait is the same: no Channel Partner manages the account.

Managed account

A managed account is a client account created and administered by a Channel Partner. The Channel Partner onboards the client, assigns a tier, and can switch into the account to perform administrative tasks. The client's feature access depends on the tier.

Examples: Channel Partner client accounts (assigned the Standalone tier or the Centrally Managed tier).

Model comparison

Attribute	Standalone (direct) account	Managed account
Channel Partner	None	Created and managed by a Channel Partner
Account type	Direct or self-service signup	Channel Partner client
Who manages it	The account owner (direct customer)	The Channel Partner organization, with some capabilities delegated to the client based on tier
Tier	Not applicable — full feature access	Standalone tier or Centrally Managed tier determines feature access
Account switching	Not applicable	The Channel Partner can switch into the account
User management	Self-managed by the account owner	The Channel Partner and the client can both manage users (depending on tier)
Product configuration	Fully self-service	May inherit or be restricted by Channel Partner settings. See Product Configuration.
Onboarding	Customer signs up directly	Channel Partner creates the account via the onboarding wizard

Part 2: Tiers within a managed account

Tiers apply only to managed accounts. A standalone (direct) account has no tier. A Channel Partner assigns one of two tiers to each managed client:

Standalone tier — the client runs its own workflows and configurations, much like a standalone account.
Centrally Managed tier — the client has view-only access; the Channel Partner runs workflows and configurations on the client's behalf.

Managed account

Standalone tier
Client runs its own workflows

Centrally Managed tier
View-only; the Channel Partner
runs workflows on the client's behalf

Your Channel Partner management account itself has full, unrestricted access and isn't subject to these tiers.

Tier capabilities

The two tiers grant different feature access within a managed client account.

Workflow capabilities

Capability	Standalone tier	Centrally Managed tier
View workflows	Yes	Yes
Create workflows	Yes	No
Modify workflows	Yes	No
Delete workflows	Yes	No
Test workflows	Yes	No
Move workflows to live	Yes	No

Case management capabilities

Capability	Standalone tier	Centrally Managed tier
View cases	Yes	Yes

Administration capabilities

Capability	Standalone tier	Centrally Managed tier
Configurations (tags, statuses, queues)	Full access	No access
Allow/Deny Lists	Full access	No access
Reason Codes	View	No access
Reports	View and create	View and create
Audit Logs	View	View
Users and Roles	View	View
Dashboards	View	View
Event Managers	View and create	No access

Workflow execution

How workflows run depends on the account model and, for managed accounts, the tier.

Standalone (direct) account

The account owner has full control: create, modify, test, and deploy workflows.
Enrichment steps reference the account's own product configuration and profiles.
The account owner manages the entire deployment lifecycle independently.

Managed account — Standalone tier

Clients on the Standalone tier have full workflow capabilities, much like a standalone account.
They can create, modify, test, and deploy workflows independently.
Enrichment steps may reference profiles configured by the Channel Partner or by the client. See Product Settings for details.

Managed account — Centrally Managed tier

Clients on the Centrally Managed tier can only view workflows. They cannot create, modify, delete, test, or deploy them.
The Channel Partner manages workflow configuration by switching into the client's account.
When the Channel Partner switches into the account, they retain management-level permissions and can create and modify workflows on the client's behalf.

📘
Note:
Regardless of tier, the Channel Partner can always switch into a client's account and manage workflows on their behalf. The tier only restricts what the client's own users can do.

Choosing the right tier

Use this decision guide when assigning a tier during client onboarding:

Yes

No

Yes

No

Does the client have a
technical team that
manages workflows?

Does the client need
configuration access?
(tags, statuses, queues,
allow/deny lists)

Assign the Centrally Managed tier
Channel Partner manages
everything

Assign the Standalone tier
Client is self-service

Assign the Standalone tier
with restricted roles

Choose the Standalone tier when	Choose the Centrally Managed tier when
The client has a technical team that needs to build and manage their own workflows.	The Channel Partner manages all workflows on the client's behalf.
The client needs full case management capabilities.	The client only needs to view cases and dashboards.
The client requires access to configuration tools (tags, statuses, queues, allow/deny lists).	The client does not need self-service configuration access.
The client wants to manage their own enrichment and product settings.	The Channel Partner controls all product configuration.

⚠️
Important:
Set the client's tier during onboarding. You can't change it afterward from the Dashboard. There is no self-service tier upgrade or downgrade in the Clients hub. Decide on the right tier before you onboard the client.

Namespace delegation

Behind the scenes, RiskOS™ uses namespace delegation to link managed accounts to their Channel Partner. Each managed account (child namespace) is linked to the Channel Partner's account (parent namespace). This relationship controls:

Aspect	How it works
Resource resolution	Shared resources (such as enrichment profiles and product configurations) are resolved across the parent and child namespaces. Some resources inherit from the parent; others are scoped to the child.
Permission inheritance	The tier assigned to the child namespace determines which features are available to the client's users.
Account switching scope	Channel Partner users can only switch to child namespaces that are linked to their parent namespace. You cannot access accounts outside your organization.

You do not need to manage namespace delegation directly — it is handled automatically when you onboard a client.

Governance considerations

When managing multiple client accounts, consider these operational guidelines:

Area	Recommendation
Tier assignment	A client's tier is fixed at onboarding and can't be changed from the Dashboard afterward, so choose deliberately. If you're unsure whether a client needs self-service, start with the Centrally Managed tier and keep workflow control with your team. If a client's needs change later, discuss options with your Socure account representative.
Product configuration inheritance	Settings locked at the Channel Partner level override client-level settings. Use this to enforce consistent enrichment profiles across clients. See Product Configuration.
User access	Each client account has independent users and roles. When you switch into a client's account, your actions are recorded in that client's audit logs.
Environment separation	Sandbox and Production environments have independent user lists and role assignments. Test configuration changes in Sandbox before replicating them in Production. For a full governance guide, see Access Governance Best Practices.