Tenant isolation
How one institution is kept from ever seeing another.
Where isolation lives
Every row that belongs to an institution carries its institution id, and every query is scoped by it at the repository boundary — not in route handlers.
Scoping in route handlers means every new endpoint is a chance to forget. Scoping at the data layer means a developer writing a new query gets isolation by default and has to work to bypass it. That change landed in 2026.05 and is the single most important piece of tenant security in the platform.
Layers
- The institution id is non-nullable on core tables, backfilled and enforced by trigger.
- Row-level security is applied on core tables as a second line.
- Tokens carry the institution, so a valid token for one tenant cannot read another’s rows.
- Subdomains resolve to exactly one institution.
Per-tenant keys
Sensitive artefacts are encrypted with a per-institution key rather than a shared one. Proctoring captures from Open Quiz attempts are written this way and purged on the retention schedule, so one institution’s captures are cryptographically separate from another’s.
Deletion
Deleting an institution removes its data. Recovery is a cluster restore and extract, not an undo. Treat it as irreversible.