diff --git a/services/web/app/src/infrastructure/mongodb.mjs b/services/web/app/src/infrastructure/mongodb.mjs
index c9c75584e0..56ef14e334 100644
--- a/services/web/app/src/infrastructure/mongodb.mjs
+++ b/services/web/app/src/infrastructure/mongodb.mjs
@@ -123,6 +123,7 @@ export const db = {
   tokens: internalDb.collection('tokens'),
   userAuditLogEntries: internalDb.collection('userAuditLogEntries'),
   users: internalDb.collection('users'),
+  workspaces: internalDb.collection('workspaces'),
   onboardingDataCollection: internalDb.collection('onboardingDataCollection'),
   scriptLogs: internalDb.collection('scriptLogs'),
 }
diff --git a/services/web/app/src/models/Workspace.mjs b/services/web/app/src/models/Workspace.mjs
new file mode 100644
index 0000000000..bbbcba2362
--- /dev/null
+++ b/services/web/app/src/models/Workspace.mjs
@@ -0,0 +1,27 @@
+import mongoose from '../infrastructure/Mongoose.mjs'
+
+const { Schema } = mongoose
+
+export const MAX_WORKSPACE_NAME_LENGTH = 150
+
+export const WorkspaceSchema = new Schema(
+  {
+    subscription_id: {
+      type: Schema.Types.ObjectId,
+      required: true,
+      index: true,
+    },
+    name: { type: String, maxlength: MAX_WORKSPACE_NAME_LENGTH },
+    privilegeLevel: {
+      type: String,
+      enum: ['readOnly', 'review', 'readAndWrite'],
+      default: 'readOnly',
+    },
+  },
+  {
+    collection: 'workspaces',
+    minimize: false,
+  }
+)
+
+export const Workspace = mongoose.model('Workspace', WorkspaceSchema)
diff --git a/tools/migrations/20260820120000_create_workspaces_subscription_id_index.mjs b/tools/migrations/20260820120000_create_workspaces_subscription_id_index.mjs
new file mode 100644
index 0000000000..6250b5a7fa
--- /dev/null
+++ b/tools/migrations/20260820120000_create_workspaces_subscription_id_index.mjs
@@ -0,0 +1,29 @@
+import Helpers from './lib/helpers.mjs'
+
+const tags = ['saas', 'nonblocking']
+
+// Every read and write of a workspace looks it up by the subscription that owns
+// it, so this backs the group settings page. Not unique: a subscription is
+// allowed several workspaces, even though a group currently gets exactly one.
+const indexes = [
+  {
+    key: { subscription_id: 1 },
+    name: 'subscription_id_1',
+  },
+]
+
+const migrate = async client => {
+  const { db } = client
+  await Helpers.addIndexesToCollection(db.workspaces, indexes)
+}
+
+const rollback = async client => {
+  const { db } = client
+  await Helpers.dropIndexesFromCollection(db.workspaces, indexes)
+}
+
+export default {
+  tags,
+  migrate,
+  rollback,
+}
diff --git a/tools/migrations/lib/mongodb.mjs b/tools/migrations/lib/mongodb.mjs
index 935c4860dd..6f05266bfc 100644
--- a/tools/migrations/lib/mongodb.mjs
+++ b/tools/migrations/lib/mongodb.mjs
@@ -74,6 +74,7 @@ export const db = {
   tokens: internalDb.collection('tokens'),
   userAuditLogEntries: internalDb.collection('userAuditLogEntries'),
   users: internalDb.collection('users'),
+  workspaces: internalDb.collection('workspaces'),
   onboardingDataCollection: internalDb.collection('onboardingDataCollection'),
   scriptLogs: internalDb.collection('scriptLogs'),
 }