Data isolation

[01]

Why this page exists

A multi-station operator is trusting us with the thing that would hurt most if it leaked: their roster. This page describes how one workspace is kept away from another, in enough detail that your own engineers can judge it.

[02]

Organization is a column, not a deployment

Every tenant-owned row carries an organization identifier, and the query layer applies it. We chose a shared schema with enforced scoping over a database per customer deliberately: one code path that is always exercised is safer than a hundred that are each exercised once, and a migration that runs once cannot half-apply across tenants.

[03]

Station scope sits inside it

Most rows also carry a station. A person granted access to two stations out of five sees two, and the other three are not filtered out of a response, they are never selected. Station scope is a property of the request, resolved on the server from the caller’s own grants.

[04]

The server decides

Permissions and scope are enforced at the API. The interface reads the same permissions to decide what to show, but that is presentation. A request that the interface would never have made is still refused.

Gated fields arrive absent rather than empty, so a client cannot infer the existence of something it is not allowed to see.

[05]

Tested as a rule, not as a feature

Tenancy has its own tests. Every endpoint that returns tenant data is exercised against a second organization to prove it returns nothing, and a scoping rule without a test is treated as an untested claim rather than as a working one.

[06]

Where isolation deliberately stops

Two places, both by design and both visible to you:

• Platform staff can seed and reset demo data on a trial organization. It is refused outright against a paying one, and every action is attributed in the audit trail.
• Outbound integrations send to destinations you configure. Once a message reaches your Slack workspace, it is governed by your controls rather than ours.

[07]

Backups and restores

Backups are encrypted and cover the whole database. A restore is a whole-service operation used for incident recovery, never a way to reach into one customer’s history on behalf of another.

[08]

Evidence

We will walk any of this through with your engineers on a call, including the scoping tests. Ask at hello@alakili.com.