Physical tenant isolation
Each organization has its own logical Postgres database and its own object-storage bucket. A tenant boundary is a separate database, not a WHERE clause — there is no shared table to leak across.
Loading
Security
The guarantees below are not a checklist bolted on after the fact — they follow from decisions in the data model itself. Every claim here describes how Settrium is built today, not a certification we point at.
Isolation
Each organization runs in its own logical Postgres database and its own object-storage bucket. The shared control plane holds only global identity — accounts, the org registry, and routing. There is no shared business table for a bug to reach across, and login always happens at the organization's own subdomain.
Isolation boundaries
per tenantEach of these is a property of the model, enforced at runtime — not a policy that depends on every developer remembering to apply it.
Each organization has its own logical Postgres database and its own object-storage bucket. A tenant boundary is a separate database, not a WHERE clause — there is no shared table to leak across.
Every write lands on a per-tenant audit chain with a running head. History cannot be quietly rewritten, and each entry records the actor, the time, and the policy state at action time.
Access flows only through roles; a permission can never be attached to a person directly. What anyone can do is always inspectable by reading their roles — nothing is granted off to the side.
Reads are scoped to one entity, and a suite an organization is not entitled to returns not-found — never a partial or degraded view. Absence of access looks like absence of data.
The person who raises a document cannot approve it, and approval is separated from settlement. These are permission-enforced gates in the engine, not advisory guidance.
Files are tied to the document role they fulfil, and every download is authorized against the requester. Attachments survive a document’s closure as part of its permanent record.
Honest scope
Everything on this page describes the architecture as it is built. We deliberately do not display compliance badges we have not earned or data-residency promises we have not implemented — the isolation model makes several of those achievable, but a claim belongs here only once it is real.
If your organization has specific compliance or residency requirements, tell us what they are and we'll be straight with you about what is in place today and what would need to be built.
We onboard organizations by invitation. Tell us about yours and we'll set you up with your own isolated workspace.
Request access