Data Isolation

For agency customers, keeping client data separate is not optional. It is a core requirement. This page explains how Outercite's architecture enforces that separation and what guarantees it provides.

What you'll learn

• How the parent org and client workspace model works
• Where isolation is enforced and why that matters
• What the public Outercite knowledge base does and does not expose

The multi-tenant model

Outercite uses a two-level structure for agency customers:

Parent organisation

This is the agency's own account. It has access to the agency portfolio view, billing, and the ability to create and manage client workspaces. The parent org can see aggregated health signals across all workspaces (the portfolio health buckets: Needs Attention, Monitoring, On Track). It cannot see raw citation data from one client mixed into another client's view.

Client workspaces

Each client gets their own isolated workspace. A workspace contains that client's prompts, citation history, competitor settings, dashboard metrics, and reports. No data from one workspace bleeds into another.

Where isolation is enforced

Isolation is enforced at the data layer, not just at the user interface level. This is an important distinction.

A UI-only isolation would mean that two workspaces share an underlying data store and are simply filtered by a workspace identifier in the query. If that filter were misconfigured or bypassed, one client's data could be exposed to another.

In Outercite's model, the separation is structural. Each client workspace's citation data is scoped at the storage level, not just filtered at query time. A user with access to one workspace cannot reach another workspace's data by changing a query parameter or manipulating an API call.

What the public knowledge base exposes

The Outercite public knowledge base (this site) contains no client data. It does not mention client names, prompt lists, citation results, or any information derived from customer accounts. All worked examples in the knowledge base use generic, anonymised businesses.

This is deliberate. A knowledge base that leaked client names or industry categories would undermine the isolation promise even without exposing raw data. The knowledge base is published content, not a product interface.

What agency team members can see

A team member added to a specific client workspace can see data only for that workspace. They cannot browse across workspaces unless they have explicit access to each one. The parent org admin controls access assignment.

This means you can give a client's in-house team member access to their own workspace without exposing any other client's information.

One client, one view

The practical outcome of this model is straightforward. If you run a workspace for a healthcare brand and a separate workspace for a retail brand, those two clients' prompts, citation histories, competitors, and reports are fully separate. Neither client can see the other. A report generated for one workspace contains only that workspace's data.

Try this in Outercite

To see your agency's workspace list and how access is structured, visit your agency portfolio. Each workspace is listed separately with its own health status and entry point.

Related