Three levels per model
For every model you set in the Hub the level its data lives on. The level answers two questions at once: which database holds the data, and who sees which records?
- System: data of the whole installation, shared by all tenants.
- Tenant: data of one customer – the default.
- User: data that belongs to a single person, such as drafts or personal settings. Other people at the same customer do not see it.
One database per tenant
An installation runs either with one database for everything or with a shared system database plus a separate database per tenant. In the second case a request only reads and writes in its own tenant’s database and in the system database. Other customers’ data is simply not on its path.
Files and history follow the same separation: each tenant has its own storage directory and its own revision log. Separation by person at the user level works in both operating modes.
Rules without exceptions
The isolation rests on a few rules that apply everywhere:
- The tenant always comes from the signed sign-in credential. A field in the data cannot change it.
- If the tenant is missing, the access stops. Tenant data never ends up silently in the shared system database.
- A suspended or expired tenant reaches no data – Identity & Access checks this before every access.
- A tenant database is only created with explicit approval in operations, and Data Management never deletes a database.
Switching under control
Sometimes someone has to work in another tenant on purpose – a person who belongs to two companies, or support staff. A tenant switch only takes effect if the sign-in credential covers it: as a member of the target, or with a dedicated permission and the target on the list of allowed tenants. It is checked twice, in Identity & Access and again in the data layer. A suspended tenant stays suspended even after a switch.
If support needs to see what a specific person sees, there is the user switch. It requires a dedicated permission and, by default, the consent of the person concerned. The history then also records who actually acted.
What this means day to day
When in doubt, an access fails visibly. An error is harmless compared with data ending up in the wrong tenant.
- Multi-tenancy does not have to be rebuilt in every project.
- A customer can be suspended without moving any data.
- The isolation is visible in the structure, not just in individual queries.