Trust · Architecture
Per-tenant by default. Your data is yours alone.
Most multi-tenant products pool every customer into one shared database and rely on application code to keep the rows apart. That makes isolation a property of every query anyone ever writes. We took the boundary out of the code and put it in the architecture: each customer gets their own database, their own storage, and their own scoped credentials. Isolation is not something our code has to remember to do correctly on every query.
To be precise about what that does and does not buy you: this design reduces cross-tenant risk, but it does not absolutely eliminate it, and no automated test makes a multi-tenant system perfectly isolated. Our contractual commitments are the ones in the Master Services Agreement and Data Processing Addendum, not this page.
The boundary
Four layers, one tenant.
Data, storage, credentials, and the agent itself all stop at the same edge. A gap in any one of them would not be covered by the others, so none of them is left to convention.
A database per customer
Not a shared table with a tenant column and application code trusted to filter it. Each customer's records live in their own database, so a query that forgets a filter does not return another customer's rows — those rows are not in the database being queried.
Storage separated the same way
Files, uploads, and generated assets land in a storage container belonging to that tenant alone, on the same boundary as the data. Some working files the agent authors — capsule source, for example — reside on shared platform storage under per-tenant paths; the Data Processing Addendum sets out which.
Credentials in a separated vault
Integration credentials are held in a managed, tenant-scoped secrets vault. The agent uses them to reach your systems; they are never written into capsule source and never logged. Platform, tenant, and model-provider secrets live in separate vaults so a compromise in one class does not widen into another.
An agent bound to one tenant
Inscendo IQ operates inside a single tenant's boundary. Its available actions are an explicit, audited set rather than open-ended system access, and its workspace is scoped to that tenant's own source. It is not given a route to another customer's data, files, or credentials.
Checked, not asserted
129 architectural invariants run before any change ships.
Isolation guarantees decay when someone lands a reasonable-looking change that quietly widens a boundary. So the boundaries are tests. 44 architecture test suites, 129 individual invariants, executed on every change alongside the unit and integration suites. A change that violates one does not merge.
- Tenant scoping
- Records that must be tenant-scoped are verified to be. Hard-coded tenant identifiers are rejected. Overriding the active tenant is blocked. Endpoints reachable without authentication are verified to carry no tenant context.
- Secret handling
- Source is scanned for embedded credentials. Secrets are checked to resolve from their intended source. Vault separation between platform, tenant, and model-provider classes is asserted, not assumed. Agent session events are checked for redaction.
- Agent containment
- The agent's tool allowlist is verified to stay within its declared bounds. Sandbox mount scoping and container environment are checked so a session's workspace cannot reach past its own tenant.
- Blast-radius controls
- Destructive operations are verified to sit behind an administrative gate. Wallet and marketplace boundaries are checked so billing cannot be crossed. Purge routines are checked for completeness, so deleting a tenant genuinely removes it.
- Structural integrity
- Dependency direction between layers is enforced, so the core cannot take a dependency on infrastructure. Middleware order is pinned. Migrations are checked for backward compatibility, because old and new code both run against the migrated schema during a zero-downtime deploy.
These run continuously rather than at audit time, which is the difference between a control that holds and a control that held once. Isolation is treated as work that is never finished: when we find a way to make a boundary structural instead of conventional, we take it, and it becomes another invariant that cannot regress.