Entry proxy: The tenant ID (CMK) is assigned at the earliest point of system entry. Only verified requests with a valid tenant assignment can access the corresponding data. This strict separation is enforced throughout the entire request lifecycle.

Database (row-level security): Every query strictly filters by tenant ID. All entities require this field. All queries use exclusively parameterized, type-safe methods — SQL injection is therefore prevented by design.

Storage: Customer data in S3 is encrypted with tenant-specific KMS keys (CMK). Each tenant has its own encryption key, which is assigned already at the entry proxy.

Authorization: Object-based permission checks enforce access controls (ACL) at the level of individual documents, cases, and other entities — including delegation and expiration times.

API: The tenant ID is resolved from authenticated JWT claims. Every endpoint enforces role-based access control.