Data Isolation

Multi-tenant data isolation for enterprise deployments.

Isolation Model

Implementation

Row-Level Security

All queries automatically scoped to organization:

-- Applied automatically
CREATE POLICY org_isolation ON documents
    USING (organization_id = current_org_id());

Encryption

• At Rest: AES-256 with per-org keys
• In Transit: TLS 1.3
• Keys: Stored in HSM

Workspace Isolation

Further isolate within organizations:

{
  "workspace": "production",
  "isolation_level": "strict"
}

Cross-Organization

Never allowed. Even admin APIs cannot access other org data.

Next Steps

• Data Residency - Geographic controls
• Compliance Overview - Compliance features