Multi-Tenant Data Isolation: How to Prove Separation

The full executive answer

Because in our architecture the WHERE clause is not what protects you — the database itself is. Row-level security means the tenant policy is attached to the table inside Postgres: every query executes with the caller's organisation identity, and the database engine filters rows to that organisation before any result exists. An application developer who forgets a filter gets back only your rows anyway, because the enforcement point is below the application. That is the categorical difference between 'our code is careful' and 'the database will not comply' — isolation as a property of the data layer, not a habit of the code.

Now the two questions a good architect asks next. Where does the identity come from? Only from the verified sign-in token — the organisation is resolved server-side from the authenticated session in our standard middleware, and our working agreement is explicit that it is never, ever read from a request body or URL, so the boundary cannot be forged from the client side. And what stops the next table from forgetting the policy? A static test in the CI pipeline scans every one of our 192 database migrations, and if any table carrying tenant data lacks its row-level-security policy, the build fails — the mistake is caught before the code can even merge, by machine, every time. There are also dedicated cross-tenant access tests in the suite attacking the boundary directly.

Honest completion of the answer: 'impossible' is not a word I will use about any system, and the boundary has not yet been validated by an external penetration test — that is an explicit, funded roadmap item before enterprise go-live, and I would welcome your security team's own attempt during the pilot. What I can say is that the isolation is enforced at the deepest available layer, machine-guarded against regression, and aligned with OWASP ASVS access-control verification — which is the strongest claim any multi-tenant vendor can truthfully make ahead of third-party validation.