Tenant isolation

Isolation between tenants is enforced by the database itself, through PostgreSQL row-level security. It is enabled and forced on every table that holds a tenant's data.

• The application connects with a database role that cannot bypass it.
• Every request runs in its tenant's context.
• Filters written in the application's queries are defence in depth, not the boundary.
• Isolation is tested against a real PostgreSQL in every release.