How do I keep customers' data separate?

Last reviewed 2026-09-30Written by Jacob Masse, TrazTech Inc.

Give every row that belongs to a customer an organization ID, derive the caller's organization from the server-side session, filter every query and database policy by it, and test with two organizations. AI-generated apps often start single-user and add teams later, leaving tables, files, caches or AI retrieval without the organization filter.

Where isolation has to hold

• Database tables and row level security policies.
• File storage paths and policies.
• Search indexes and vector stores for AI features.
• Caches and background jobs.
• Exports, reports and admin tools.
• Emails and notifications.

Testing it

1. Create organizations A and B with distinctive data.
2. As A, request B's records, files, exports and search results by ID and by search.
3. As A, ask any AI feature about B's data.
4. Any leak is a critical finding.

Where AI-built apps leak between customers

The data tables are usually right after a careful prompt. The leaks are in the corners added later:

• File storage using paths by user but not by organization, so a former member keeps access.
• Invitations that let anyone with a link join any organization, or that keep working after the inviter leaves.
• Exports and reports built for admins that query all organizations.
• Background jobs that process every row and email results to the wrong account.
• Search and AI retrieval indexes built once, across everyone.
• Caches keyed by URL without the organization.

When a member leaves an organization, test that their access to its data ends immediately, including files and API tokens they created. Tenant crossover is the finding business customers care about most, because it means their data reaching a competitor.

Getting it checked

TrazTech offers vibe-coding QA and security review, listed from $2,000 CAD. Get at least one other quote on the same scope; the questions to ask a testing firm help compare them.

Related questions

• What is IDOR?
• How do I secure a RAG feature?
• Supabase security checklist

Common questions