Platform · Multi-Tenant Architecture
Tenant isolation, by construction.
Every tenant gets an isolated database, with per-application schemas underneath. Isolation is enforced at the connection layer, not left to application-level filtering.
Tenant isolation
Each tenant is a distinct logical boundary resolved on every request from session/identity context, not a client-supplied value trusted at face value. Every downstream query is scoped to that tenant before it reaches application code.
Database isolation
Each tenant is provisioned its own database. A schema-scoped connection pool resolves the correct database and connection for a request before any query executes, so cross-tenant data access is prevented by the connection itself, not by a WHERE clause an engineer has to remember to add.
Schema isolation
Within a tenant's database, each application owns its own schema — a shared ERP core schema plus one schema per app (HCM, CRM, Finance and so on). Entity Engine tables always route to the owning app's schema, verified live, not just asserted in configuration.
Regional deployment
Tenant infrastructure can be deployed per region, so a tenant's data and compute stay in the region it was provisioned in — relevant for data residency requirements as much as for latency.
Security
Tenant isolation is layered underneath the same identity, RBAC and audit model described on the Security page — isolation and access control are enforced together, not as two separate systems that have to agree.
Encryption
Data is encrypted in transit (TLS) and credentials at rest are encrypted (AES-256-GCM for per-tenant storage credentials, for example) rather than stored in plain configuration.
Backup
Each tenant database is backed up independently, so a restore for one tenant never touches another tenant's data.
Disaster recovery
Because the application layer is stateless and tenant data is isolated per database, recovery is a matter of restoring the affected tenant's database and repointing stateless compute at it — not untangling shared state.
Talk to us about your deployment model.
Regional deployment, data residency and disaster recovery requirements vary by organization — our team can walk through what applies to yours.