Your choices about data
We use cookies that are required for this site to work. Anything beyond that — measuring how the site is used, or personalising what you see — happens only if you say yes.
The tenant travels with the request.
Not inferred from a hostname, not read
See pricing
How a request proves who it is
Four steps, none of which trust the caller.
01
Sign in against the application
02
Resolve the tenant
03
Carry it into every query
04
Let the database insist
What we hold ourselves to
Stated as the failure it prevents, because that is the only useful way to state it.
A tenant read from ambient state
Passed explicitly, always. Ambient tenancy is how one customer ends up seeing another's rows.A session that outlives its purpose
Short-lived tokens with explicit refresh, so a stolen one has a deadline.Permissions resolved in one place
Three layers — plan, tenant, principal — so a plan change cannot silently grant more than it sold.