All features
Control
Multi-tenancy
Every firm isolated at the data layer, not by a filter someone remembered to add.
Tenant isolation is applied beneath the application rather than inside each query. Every request resolves to a firm-scoped database client, and code written above it cannot read or write another firm's rows even if a developer forgets a condition.
That property is checked rather than assumed: an automated verification runs against the isolation itself, so a regression is a failing test and not a disclosure.
Isolation
- Firm scope applied at the data layer, below the application code
- Automated tenant-isolation verification in the test suite
- Platform-level tables deliberately carry no firm identifier, so they are not welded to the tenancy model
Provisioning
- A new firm created with default roles, departments and holidays
- The defaults declared once and shared by provisioning and the backfill script, so the two cannot disagree
- Per-firm branding, domain and public-site configuration held on the firm record