SECURITY
Every read is bound to one client before it runs.
Not a policy document. A single door to the data, and it only opens onto the client it's scoped to.
THE CLAIM, PLAINLY
Every read is scoped to one client before it executes. A query that reaches for another client's data is refused, not quietly trimmed.
WHERE THIS LIVES
This isn't a rule written down somewhere that a person has to remember to follow. There's one entry point every read goes through, and the scoping happens there, every time, for every query. The isolation is in the code path, not in a policy document.
FOR AGENCIES MANAGING MORE THAN ONE CLIENT
An agency owner can see their whole portfolio in aggregate. That view can't surface another client's individual rows, because the query that would do that doesn't compile — it isn't blocked after the fact, it was never a query the system can build in the first place.
WHAT WE'RE NOT CLAIMING
We're not going to tell you this is cryptographically enforced, or that mixing data is impossible by construction, or hand you a certification. What we've described above is what the code actually does, and we'd rather tell you exactly that than something that sounds more impressive and isn't precisely true.