Perâtenant isolation, by design.
Separate databases, queues, and storage for every customerâclear data boundaries for privacy, performance, and compliance.
What "isolation" means here
Separate Database
PostgreSQL schemas/DBs per tenant with strict connection scoping.
Dedicated Queues
Redis queues per workflow; crossâtenant traffic cannot mix.
Segregated Storage
Object storage with bucket/prefix strategy and signed access.
Tenantâscoped Config
SMTP, OAuth, LLM keys, and retention policies per tenant.
Why it matters
Reduces blast radius, simplifies audits, and supports dataâresidency commitments.
Architecture Overview
Requests hit the API, which resolves the tenant from subdomain and issues tenantâscoped connections to DB/Redis/Storage. Workers subscribe to tenantâspecific queues. SSE streams are tenantâbound for live status. Admin actions are auditâlogged without PII.
Client
Edge/Router
API
Tenant DB
PostgreSQL
Tenant Redis
Queues & Cache
Tenant Storage
Object Storage
Workers
Tenant Queues â SSE
Security Controls (TOMs)
đ Auth & RBAC
Tenant roles (Admin/Recruiter/User); enforced per request.
đĄď¸ Network Safety
SSRF protection, input validation, rateâlimiting; TLS everywhere.
đ Encryption
AESâ256âGCM at rest; AESâ256âCBC for credentials; HMAC state signing for OAuth.
đ Logs
No PII in logs; audit trail at 70+ points with retention policies.
Data Lifecycle & Retention
Configurable Retention
30â365 days (configurable)
Nightly Purge
Automated removal of expired CV data
Right to Erasure
Covers primary data and attachments
BYOâLLM Routing
đ Data Control
We never send data to a model unless you configure a provider.
đ Provider Choice
You choose provider and region (OpenAI, Anthropic, Groq, or local via Ollama for onâprem).
đ PII Protection
Prompts minimize PII; redaction available before prompt.
Note: Airâgapped installs run local models only.
Operations & Scale
Automated Provisioning
Subdomain routing and tenant setup
Resource Controls
Connection pools, worker concurrency per tenant
Health & Metrics
Monitoring at tenant and worker level
Compliance Mapping
Quick references
GDPR Art. 5(1)(c) Minimisation
PIIâlight prompts; no PII in logs.
Art. 25 Privacy by Design
Isolation boundaries and default protections.
Art. 32 Security of Processing
Encryption, RBAC, rateâlimits, SSRF protections.
Art. 30/44 Transfers
BYOâLLM gives regional control of model traffic.
Frequently Asked Questions
Is data ever coâmingled across tenants?
Noâseparate DB/queues/storage.
Can we choose data region?
SaaS: EUâfriendly options. Onâprem: your infrastructure.
How do you audit access?
Every admin action is logged (no PII) and attributable to a user and tenant.
Does isolation affect performance?
Positivelyâno noisyâneighbor effect across tenants.
Ready to see it in action?
Experience per-tenant isolation and enterprise security controls.