Security
Is my data isolated from other tenants?
Yes. Every organization’s records are isolated at the database level by Postgres row-level security, not only by application code: a session scoped to one organization cannot read or write another organization’s rows. An automated cross-organization deny test runs against the real database role to prove it.
What that rests on
Row-level security, not app logicA database session scoped to one organization cannot read or write another organization's rows. Postgres enforces it, independent of the application code doing the querying.
Branch-level restrictionIn one multi-branch organization a role can be restricted to its own branches. An unrestricted session (owner, dispatch-all, scheduled jobs) sees every branch by default.
Isolation is tested, not assumedAn automated cross-organization and cross-branch deny test runs against the real restricted database role, so the boundary is proven rather than documented.