Tenants
Schools on the platform, their isolation, and what "cannot see" really means here.
Each school is a tenant, and tenants cannot see each other.
Isolation is enforced by the database
Separation is not a filter the application remembers to apply — it is enforced underneath, by the database, on every query. Code that forgot to scope a query returns nothing rather than another school's data.
That is why "a bug could leak another school's records" is not the risk here that it usually is.
A resource in another tenant returns "not found"
Not "forbidden". Telling somebody a record exists but is not theirs leaks the fact that it exists.
Hierarchy
A tenant can have several campuses, and a campus several school units. A chain of schools is one tenant with many campuses, not many tenants — which is what lets it report across them.
Deleting
Tenants are not deleted casually. Offboarding is a defined process with retention obligations, not a button.
Last updated