Multi-Tenant Architecture

Overview

Denzing is built on a multi-tenant architecture where a single deployment securely serves multiple customer organizations. Each organization operates in a fully isolated environment with its own users, data, Agents, and configurations. Your data, settings, and access controls remain separate from those of any other organization.

The Model Denzing Follows

Denzing uses a dedicated schema model.

Your organization's data is stored in its own dedicated schema within our secure database environment, structurally separated from every other customer at the database level.

This means:

• No shared tables Your data is never co-mingled with another tenant's data.
• No cross-tenant queries Queries from one tenant cannot reach another tenant's schema.

Benefits of This Structure

• Complete data isolation Your information cannot be accessed, viewed, or referenced by any other customer.
• Privacy by design Isolation is enforced structurally, eliminating the risk of misconfigured access rules.
• Efficient performance Shared infrastructure keeps the platform fast and reliable without compromising isolation.
• Seamless scalability Isolation guarantees remain identical as the platform grows.
• Consistent updates Improvements and security patches are delivered to all customers simultaneously.

Security Standards

Tenant isolation is enforced at every layer of the stack:

• Application layer Tenant context is injected from the authenticated session token on every request.
• API layer All endpoints validate tenant membership before processing.
• Query layer Database connections are schema-scoped; cross-schema queries are disallowed.
• Storage layer Each tenant is provisioned a dedicated S3 bucket. Files and objects are physically separated, with access scoped exclusively to the owning organization.

Additional safeguards include:

• Role-based access control Roles (Owner, Admin, User) are enforced server-side at the API layer.
• Session scoping Sessions are bound to a single organization; multi-org users must explicitly select one at login.
• Encrypted credentials Connected data source credentials are encrypted at rest and accessible only within the owning organization.