Documentation / Platform glossary / Tenant isolation
Tenant isolation is the guarantee that one customer's data, users, and configuration remain unreachable from another's on shared infrastructure. It is the property that makes multi-tenancy acceptable for regulated data, and it holds only if enforced systematically rather than remembered feature by feature.
Isolation is not a single control but a property that must hold across several dimensions at once.
Data isolation prevents a query from returning another tenant's records. Access isolation ensures credentials and role assignments are meaningful only within their own tenant, so an administrator in one organization has no standing in another. Operational isolation limits how far a failure or a maintenance action spreads. Performance isolation stops one tenant's load from degrading service for others.
The architectural question is where isolation is enforced. If each query is responsible for filtering by tenant, then correctness depends on every developer remembering every time, and a single omission is a cross-tenant exposure. If enforcement sits at the data layer, an omission in application code produces no rows rather than the wrong rows. The second approach fails safe; the first fails silently.
Isolation also has to survive the paths that are easy to overlook: background jobs, exports and reports, caches keyed without tenant context, search indexes, and support tooling. These are where real cross-tenant defects tend to originate, because they run outside the request path where the obvious checks live.
A cross-tenant data exposure is among the most serious failures a SaaS platform can have. It is reportable, it affects trust for every customer rather than one, and it cannot be remediated by rotating a credential.
This is why evaluators press on how isolation is enforced rather than whether it is claimed. Enforcement that fails closed on omission is a materially different assurance than enforcement by convention.
QueryTek enforces tenant scope at the data layer so a query cannot return records outside its tenant even if calling code is incorrect. Isolation covers background processing and exports as well as interactive requests. Policy detail is not published.
