Data isolation
How one client's data is kept from another: separation enforced where data is read, not by filtering rows in the interface.
Outercite is multi-tenant: many organisations, and for agencies many client workspaces inside one organisation. This is how separation works and what it guarantees.
What you'll learn
- The two levels of separation
- Where it is enforced
- What an agency team member can and cannot see
Two levels
Between organisations. Your account and another customer's share infrastructure and nothing else. No query in the product returns another organisation's rows.
Between workspaces inside an organisation. For agencies, each client is a workspace. Prompts, competitors, citations, answers, changes and reports belong to one workspace, and they are read by that workspace's identity.
Where it is enforced
At the point data is read. Every query that touches workspace data resolves which profiles the caller is entitled to first, and reads only those.
That distinction matters more than it sounds. Filtering in the interface means the data was fetched and then hidden, so a missing filter anywhere leaks it. Scoping at the read means there is nothing to hide, and it applies equally to the app, the assistant, the public API and the MCP connector.
Isolation is covered by automated tests, so a change that broke it would fail the build rather than ship quietly.
The assistant obeys the same boundary
An answer is built from the workspace you are in. Ask the same question in two client workspaces and the two answers have nothing in common, because they were built from different rows.
What an agency team member sees
| Person | Sees |
|---|---|
| Owner or admin | The portfolio across clients, plus any workspace they open |
| Member of two workspaces | Those two workspaces. No portfolio roll-up |
| A client contact invited to their own workspace | Their own workspace only |
A client contact never sees your other clients, your portfolio, your allowance or your billing.
What the public knowledge base exposes
Nothing about any customer. This knowledge base contains no customer data, no aggregate of customer data, and no example built from a real account.
Try this in Outercite
Invite a colleague scoped to one workspace and sign in as them. It takes five minutes and it is the only way to see the boundary from the outside.
Related
Client permissions model
Roles, membership and client access.
Parent orgs vs workspaces
What sits at each level.
Security
Infrastructure, encryption and access control.
Last updated on