Tenant isolation, explained without the jargon

Software like Freightflow serves many companies from the same system. Each company is a tenant. Customers reasonably ask what stops one tenant's shipments, invoices and rates from showing up for another. The answer matters more than any badge.

Every record has an owner

Every row in the database, whether a job, a container, an invoice or a rate card, is stamped with the company it belongs to. That part is common. The important question is where the check happens.

Where should the tenant check happen?

In many systems each screen and report is responsible for adding "only this company's records" to its query. That works until one developer forgets, on one report, and that report shows everything. We apply the company scope underneath the application, on every database call, automatically. A query that forgets to filter returns nothing rather than everything.

Security that depends on every developer remembering is not security. It is luck.

Inside a company

Tenant isolation separates companies. Within a company, role-based permissions decide what each person can see and do, so a transporter's login does not open the accounts desk. Integration credentials such as GST and e-invoice logins are encrypted at rest and never sent back to the browser.