How does Atlas isolate one tenant's data from another?
- Topic
- Security & compliance
- Asked by
- Security teams building B2B apps
Tenant isolation in Atlas is enforced at the repository layer — the lowest data-access layer — rather than relying on every route to remember to filter correctly.
Every query is scoped to its instance, and within an instance, organization-scoped data is scoped to its organization.
Because the check lives beneath the application logic, there is no route that can accidentally read across a customer or tenant boundary.
This is why Atlas advertises 100% tenant isolation: it is a structural guarantee, not a per-endpoint convention.
For B2B apps this means organizations are safely multi-tenant from your first commit. See the organizations guide.
Instance and tenant scoping is enforced at the repository (data-access) layer, not just in application logic — so no request can ever read across a customer or organization boundary, by construction.