How isolation actually works
There are two different stories here and they deserve different levels of confidence.
Enterprise: physically separate
Enterprise clients get their own database, their own application containers, and their own domain. Reaching another client’s data is not access-controlled — it is structurally impossible, because there is no shared database to reach across. That is a stronger claim than row-level security, and it is one we can keep.
Shared instance: one audited path
Every community-scoped query goes through a single audited helper that applies the community filter centrally — not a filter each developer has to remember. An ad-hoc query against a community-scoped table fails code review.
Every endpoint carries a refusal test
An automated test attempts each request from a different community and requires a refusal. A community-scoped route that is not registered in that harness fails the check.
There is no database-level row-level security on the shared instance. Isolation there is enforced in the application and verified by tests, and we would rather tell you that than imply a mechanism we do not run.
What is not true yet
Overstating a certification loses a deal permanently. Admitting a gap costs one awkward sentence, so here are all of them.
SOC 2 Type II — not started. We would rather do it properly than rush a checkbox audit.
Third-party penetration test — planned, not yet carried out.
Encryption at rest for the database is on the roadmap and is not in place today.
There is no database-level row-level security on the shared instance.
SSO, SCIM provisioning, and admin audit logs are not built — they are on the plan, not in the product, and you should not sign anything on the assumption they exist.
Dependency scanning, static analysis and secret detection are configured in the pipeline but are not running while CI is paused.
Procurement checklist
| Document | Status |
|---|---|
| Data processing agreement (DPA) | Available |
| Security architecture overview | Available |
| Sub-processor list | Available |
| GDPR records of processing | Available |
| Third-party penetration test report | Planned |
| SSO / SCIM provisioning | Not built |
| Admin audit logs | Not built |
| SOC 2 Type II report | Not yet |
Vulnerability reports and security questionnaires go to [email protected] and are answered by the founding team, not a ticket queue.