Matsivo is multi-tenant by design. Authorization is enforced in the database, so a permission decision cannot be bypassed by calling a different interface.
Tenant isolation
- Every record belongs to an organisation, and access is filtered by the caller's membership.
- Row Level Security is enabled on application tables; there is no anonymous read access to customer data.
- Establishment-level scoping restricts managers to the sites they are responsible for.
Roles and permissions
- Roles are granted per organisation and resolved to granular permissions.
- Permissions are stored separately from user profiles to prevent privilege escalation through profile edits.
- The principle of least privilege applies to both people and service accounts.
Accountability
- Domain actions record the acting user, so changes are attributable.
- Audit entries cannot be edited or deleted by application users.
Questions about this area?
Our team answers security questionnaires and reviews. Write to security@matsivo.com.