Client workspaces
If you run client sites, the question is not whether isolation is configured. It is whether it can fail.
Structural, not careful
Every client scoped repository takes the tenant id as its first argument, and every index on those collections leads with it. There is no code path that reads a client scoped collection without a client.
404, never 403
Asking for another client record returns not found rather than forbidden. Forbidden confirms the record exists, which is itself a leak.
The tenant comes from the request and is never defaulted
There is no fallback tenant and no ambient current client. Every scoped repository takes the tenant as its first argument, so a query that forgot to pass one does not quietly read across the whole database, it fails to compile or fails at the call. Isolation that depends on remembering is isolation that eventually breaks.
Indexes lead with the tenant
Every index on a scoped collection starts with the tenant id. That is partly for speed, because a query is answered from one client region of the index rather than scanning across all of them, and partly because it makes the cross tenant query shape unnatural to write in the first place.
Positioning is per client data
Each client carries its own guardrail rules, composed with the universal ones for every piece of content. One client never inherits another client positioning.
Questions
Can one client see another exists?
No. Not through the API, not through error messages, and not through timing.
More in Connect and scale
- Six engines, live answers
AI engine tracking
We run real prompts against six consumer answer engines and record whether you were mentioned, where in the answer, in what tone, and which sources were cited.
Read more - OAuth connection, real API reads
Search Console and GA4
Connect Search Console and Google Analytics 4 so ranking and traffic data sit next to the audit findings instead of in another tab.
Read more - AES-256-GCM, per client key via HKDF
Credential vault
Client credentials are encrypted with AES-256-GCM under a per-client key. No endpoint returns a plaintext secret, including to you.
Read more
Run it against your own site.
No signup, no card. It reports what it could not check as well as what it found.