One company can never see or touch another

Every admin route resolves the caller's company first and refuses to read or write anything outside it.

What it is

Tenant scoping enforced at the server, not the UI: the user list, the approval routes, the roster, the permission and lead-visibility tables, and the integration credential routes all resolve the caller's organisation and filter or refuse on it.

Also called: data isolation · multi company security · my competitor uses the same software

See it
One company can never see or touch another
Area
Platform & Admin
Group
Team & access
System
Team & Access
Solves
2 named problems
01getAuthedUser / requireAdmin resolve the caller's organisation honouring subdomain, custom domain and owner impersonation.
02The user list returns only the recorded owner plus users whose metadata names the caller's organisation.
03Approval and role routes compare the target's organisation to the caller's and 403 on mismatch.
Not visual — a diagram of a request resolving org from host/session, then every query filtered by that org id. Sample data — no customer information appears here.
How it works
  1. 1getAuthedUser / requireAdmin resolve the caller's organisation honouring subdomain, custom domain and owner impersonation.
  2. 2The user list returns only the recorded owner plus users whose metadata names the caller's organisation.
  3. 3Approval and role routes compare the target's organisation to the caller's and 403 on mismatch.
  4. 4Admin-only, org-scoped tables (permission presets, lead visibility) are registered as such in the database proxy, which stamps the organisation id server-side so the browser never supplies it.
Why we built it

The user-list route records the original defect: 'Previously this endpoint returned ALL Clerk users platform-wide, which meant an admin in Tenant A could enumerate Tenant B's users — and the Settings → Team Members tab couldn't tell who actually belonged to its tenant.' The approval route carries a matching note about cross-tenant promotion.

The problem
  • A tenant-wide endpoint enumerated every user on the platform.
  • Admin actions could target users in other companies.
Sound familiar?
What you get
Your staff, pricing and customers stay inside your account.
Isolation is enforced on the server, so a UI bug cannot leak across companies.

See it on your own jobs

Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.

or keep browsing features →