Bigger than our largest published plan?
Our largest published plan, Growth, includes 10 team members. There is no seat top-up above it and no separate edition of the product sitting behind a sales call. If you are past that line, or you are running several businesses that need to report as a group, we work it out case by case on the same platform everyone else runs.
This page is short on purpose. It tells you what that platform can already do for a group, and then it tells you what it cannot, so you can decide before either of us spends a fortnight on it.
No enterprise price list and no implementation project. It is the same product every other customer runs.
What we can do for a group today
Three things, all of them shipped and in use. The detail behind each one lives on the multi-location business software page, which is the honest version of the same story at branch scale.
Several businesses under one login
Each business is its own account with its own data, its own numbering and its own subscription. One login can belong to more than one of them, and a switcher in the dashboard header moves between them without signing out or keeping a second password.
How multi-location worksGroup reporting across a parent and its branches
Flag a head-office business as the parent, link the others to it, and the franchise consolidation report rolls revenue, GST collected, expenses and net profit for every child business into one table for the period you choose. It is a group profit view, not a consolidated balance sheet, and it is the one thing here that genuinely does not exist in the tools most operators are coming from.
How multi-location worksIsolation enforced at the database, not in the app
Every table carries Postgres row-level security scoped by tenant, so one business cannot read another business's records even if application code gets a query wrong. It is the same guarantee for a two-person operator and a twenty-branch group, and it is hosted in AWS Sydney.
How multi-location worksThe isolation claim is not marketing language. Every practice behind it is written up on the OneBookPlus security page, including where the data is hosted and how tenant scoping is enforced.
What we do not have
If you are running a procurement process, these are the gaps that usually end the conversation. It is cheaper for both of us to find that out on this page than three meetings in.
- No single sign-on
- There is no SSO and no SAML. People sign in with an email address and a password, with multi-factor authentication available per user. If your IT policy requires identity-provider sign-in, we cannot meet it today.
- No contractual service level agreement
- We publish no uptime commitment and offer no service credits. Priority support is already included on every paid plan, so it is not an extra we can sell you a second time.
- No dedicated tenancy
- Everyone runs on the same shared infrastructure in AWS Sydney. There is no private instance, no separate region, and no customer-managed encryption keys.
- No per-location permission scoping
- Roles are tenant-wide: owner, admin, accountant, staff, advisor and viewer. You cannot restrict a manager to one branch inside a single business. The only way to separate branches today is to run them as separate businesses and consolidate the reporting.
- API access is by application, not by plan
- API keys and webhooks sit behind a manual approval queue rather than a plan entitlement, so integration work starts with a request and a reply, usually within one or two business days. Buying a bigger plan does not unlock it.
- No published seat tier above the largest plan
- Growth includes 10 team members and there is no seat top-up to buy. Past that number the arrangement is worked out case by case, which means a conversation rather than a checkout.
If you need identity-provider sign-in, a signed availability commitment and an environment of your own, we are not the right vendor yet, and we would rather say so now than sell you something you unwind in six months.
If what you need is more seats than the published plans carry, or a group of businesses that has to report together, that is a conversation we can have today. It starts with the shape of the group: how many businesses, how many people in each, and what has to roll up to head office.
What you get instead of an enterprise tier
There is no enterprise edition, no account manager and no implementation partner. Rather than dress that up as a feature, here is what it means in practice at your size. The person who answers your email is the person who writes the code. There is no support tier to escalate through and no partner network sitting between you and the product, because the team behind OneBookPlus is small enough that the distance between a problem and the person who can fix it is one message. Priority support is already on every paid plan, so it is not something we can sell you again at the top of the range.
The advantage that comes with that is speed. A change that fits the product can ship in an ordinary week rather than waiting on a release train, and what ships is published in the OneBookPlus changelog rather than announced at your renewal. The limit that comes with it is scope. We say no to work only one customer would ever use, because a product this size cannot carry bespoke branches and remain the same product everyone else runs. So the useful conversation about a missing capability is whether it belongs in the product for everybody, not whether we will build you a private version of it.
Where the group's data sits, and what we are not certified for
For an Australian group the residency question usually arrives before the feature list, so it is worth answering precisely. Your business data is hosted in Australia: Postgres on AWS ap-southeast-2 in Sydney through Supabase, with the dashboard application running on AWS Fargate in the same Sydney region. It is encrypted in transit and at rest, and every table carries row-level security scoped to the business, which is the control that stops one company in a group reading another's takings even if application code gets a query wrong.
What we do not hold is a certificate of our own, and that is the answer most procurement teams are really asking for. AWS, Supabase and Stripe each publish independent SOC 2 or ISO 27001 attestations, and those controls are part of the posture underneath us, but an attestation held by a supplier is not an attestation held by us. We have scoped an ISO 27001 program targeting a first certification in 2027, which is a plan rather than a credential. If your process needs a current certificate on file before it can proceed, we will not clear it this year. Every practice behind these claims, including the hosting detail and how tenant scoping is enforced, is written up in the OneBookPlus security and compliance overview.
Send us the shape of the group
How many businesses, how many people, and what head office needs to see. We will tell you plainly whether the platform fits, including when it does not.
Worth reading first: multi-location business software, software for small teams, or our security practices.
Last reviewed and updated: by Bishal Shrestha
About the author
Bishal Shrestha
Founder & CEO, OneBookPlus
Bishal spent a decade running digital projects for Australian small businesses before founding OneBookPlus. OneBookPlus is one product across every business size, so a group of businesses runs the same platform a sole trader does. Where the product genuinely cannot serve a larger buyer yet, we publish the gap rather than route it through a sales call.
Read the founder bio