Customer Data Isolation Policy

Document owner: Chief Information Security Officer (CISO), with VP Engineering as co-owner Version: 3.0 Effective date: January 1, 2026 Last updated: January 15, 2026 Classification: Public — Trust Center Review cadence: Annual review; updates for architecture changes Company: Acme Cloud, Inc. Address: 1200 Market Street, Suite 400, San Francisco, CA 94103, USA Primary contacts: trust@acmecloud.com | security@acmecloud.com | privacy@acmecloud.com

---

Definitions and Key Terms

Term	Definition
Customer Data	Any data uploaded, created, or processed by customers using Acme Cloud services
Data Isolation	Technical and administrative controls preventing unauthorized access between customer data boundaries
Tenant	A customer organization with a distinct data boundary within the Acme Cloud platform
Multi-Tenancy	Architecture where multiple customers share infrastructure while maintaining logical data separation
Tenant ID	A unique, immutable identifier assigned to each customer organization
Namespace	A logical partition providing isolated scope for resources within a tenant boundary
Data Boundary	The logical perimeter defining the extent of a customer's data isolation
Cross-Tenant Access	Any access pattern that traverses customer data boundaries (prohibited except for authorized support)
Logical Isolation	Separation achieved through software controls, access policies, and data partitioning
Physical Isolation	Separation achieved through dedicated hardware or infrastructure components
Row-Level Security	Database controls enforcing tenant isolation at the individual record level
Column-Level Security	Database controls restricting access to specific fields based on tenant context
Encryption Boundary	The scope within which encryption keys provide protection
Key Isolation	Separate encryption keys for each tenant's data
Network Isolation	Separation of network traffic between tenants
Compute Isolation	Separation of processing resources between tenants
Storage Isolation	Separation of data storage between tenants
Blast Radius	The scope of impact if a security control fails or is bypassed
Noisy Neighbor	Performance impact from one tenant affecting others on shared infrastructure
Data Commingling	Unauthorized mixing of data from different tenants
Tenant Context	The authenticated identity and authorization scope of a tenant request
Service Account	A non-human identity used for inter-service communication within tenant boundaries
Break-Glass Access	Emergency access procedures for authorized support with full audit
Data Residency	The geographic location(s) where customer data is stored and processed

---

Scope and Purpose

This Customer Data Isolation Policy establishes Acme Cloud, Inc.'s requirements for maintaining strict separation between customer data in our multi-tenant SaaS platform. The policy covers all customer data across all product tiers, including data at rest, data in transit, data in processing, metadata, logs, backups, and derived data. The purpose is to ensure that no customer can access, view, modify, or infer information about another customer's data, and that Acme Cloud personnel access is strictly controlled, audited, and minimized.

Isolation Objectives

Objective	Description	Benefit
Confidentiality	Prevent unauthorized disclosure of customer data between tenants	Trust and compliance
Integrity	Prevent unauthorized modification of customer data by other tenants	Data accuracy
Availability	Prevent one tenant from impacting another's service availability	Reliable service
Compliance	Meet regulatory requirements for data separation	Legal compliance
Auditability	Demonstrate isolation effectiveness to customers and auditors	Transparency
Defense in Depth	Multiple layers of isolation controls	Reduced blast radius

Scope Applicability

Component	In Scope	Isolation Level	Implementation
Customer Application Data	Yes	Logical + Encryption	Tenant ID partitioning; per-tenant keys
Customer Uploaded Files	Yes	Logical + Encryption	Tenant-prefixed storage; per-tenant keys
Customer Configuration	Yes	Logical	Tenant-scoped settings
Customer Metadata	Yes	Logical	Tenant ID filtering
Audit Logs (Customer)	Yes	Logical	Tenant-partitioned logs
API Traffic	Yes	Logical + Network	Tenant authentication; rate limiting
Database Storage	Yes	Logical + Encryption	Row-level security; field encryption
Cache Storage	Yes	Logical	Tenant-prefixed keys
Search Indexes	Yes	Logical	Tenant-partitioned indexes
Backup Data	Yes	Logical + Encryption	Tenant-isolated backups
Analytics/Derived Data	Yes	Logical	Tenant-scoped processing
System Logs (Operational)	Partial	Access Control	Redacted customer data

---

Isolation Architecture

Multi-Tenancy Model

Layer	Isolation Model	Technology	Tenant Boundary
Application	Shared application; logical tenant context	Next.js/Node.js	Tenant ID middleware
API Gateway	Shared gateway; tenant-scoped routing	AWS API Gateway	Auth + tenant validation
Compute	Shared compute; tenant-scoped processing	AWS Lambda/ECS	Request-level isolation
Database	Shared database; row-level security	PostgreSQL	Tenant ID column + RLS
Object Storage	Shared buckets; tenant-prefixed paths	AWS S3	Prefix + IAM policies
Cache	Shared cache; tenant-prefixed keys	Redis	Key prefix isolation
Search	Shared cluster; tenant-partitioned indexes	Elasticsearch	Index per tenant
Message Queue	Shared queues; tenant-tagged messages	AWS SQS	Message attributes
CDN	Shared CDN; tenant-scoped paths	Cloudflare	Path-based routing

Tenant Identification

Component	Tenant ID Source	Validation	Propagation
User Authentication	JWT claim (tenant_id)	Token signature; tenant membership	Request context
API Key Authentication	Key → tenant mapping	Key validation; tenant lookup	Request context
Service-to-Service	Request header (X-Tenant-ID)	Service auth + header validation	Distributed tracing
Background Jobs	Job metadata (tenant_id)	Job queue validation	Job context
Webhooks (Outbound)	Webhook configuration	Tenant-owned webhook	Payload context
Webhooks (Inbound)	Request signature	Signature verification	Processing context

Isolation Boundaries

Boundary Type	Enforcement Point	Control Mechanism	Failure Mode
Authentication	API Gateway	Token validation; tenant claim	Reject request (401)
Authorization	Application Layer	Tenant context check	Reject request (403)
Database	Query Execution	Row-level security policies	Filter or block query
Storage	Object Access	IAM policies; prefix validation	Deny access
Encryption	Data Access	Per-tenant key derivation	Decrypt failure
Network	VPC/Security Groups	Network policies	Connection refused
Rate Limiting	API Gateway	Per-tenant quotas	Throttle (429)

---

Database Isolation

Row-Level Security (RLS)

Table Category	RLS Policy	Enforcement	Verification
Customer Data Tables	tenant_id = current_tenant()	Always enabled; no bypass	Automated testing
Audit Log Tables	tenant_id = current_tenant() OR is_admin()	Admin with audit	Access logging
System Tables	Role-based access	No tenant column	Role validation
Cross-Tenant Views	Prohibited	N/A	Schema validation

Database Access Patterns

Access Pattern	Tenant Context Required	Additional Controls	Example
Application Query	Yes (always)	RLS + query validation	SELECT * FROM orders
Report Generation	Yes	RLS + scope limiting	Analytics aggregation
Data Export	Yes	RLS + rate limiting	Customer data export
Admin Query	Yes (with elevation)	Audit logging; approval	Support investigation
Migration Script	N/A (schema only)	No data access	Schema changes
Backup/Restore	Yes (per tenant)	Encryption; access control	Point-in-time recovery

Database Security Controls

Control	Implementation	Purpose	Monitoring
RLS Policies	PostgreSQL policies on all tenant tables	Query-level isolation	Policy audit
Connection Pooling	Tenant-aware pool; no connection reuse	Context isolation	Pool metrics
Query Parameterization	Prepared statements only	SQL injection prevention	Static analysis
Tenant ID Validation	UUID format; existence check	Invalid tenant prevention	Error logging
Cross-Tenant Query Block	Application-layer validation	Accidental exposure prevention	Query analysis
Field-Level Encryption	Sensitive fields encrypted with tenant key	Defense in depth	Encryption audit

---

Storage Isolation

Object Storage Architecture

Isolation Control	Implementation	Enforcement	Verification
Path Prefix	s3://bucket/{tenant_id}/...	IAM policy; application validation	Path audit
IAM Policies	Condition: StringEquals s3:prefix/{tenant_id}/	AWS IAM	Policy review
Encryption	Per-tenant KMS key	AWS KMS; key policy	Key audit
Access Logging	S3 access logs with tenant attribution	CloudTrail	Log analysis
Cross-Tenant Prevention	No wildcard paths; no cross-prefix access	Application validation	Automated testing
Pre-Signed URLs	Tenant-scoped; time-limited	URL generation	URL validation

Storage Access Patterns

Operation	Tenant Validation	Additional Controls	Audit
Upload	Path prefix check; size limits	Virus scan; type validation	Upload log
Download	Path prefix check; ownership	Rate limiting	Download log
Delete	Path prefix check; soft delete	Retention policy	Delete log
List	Prefix-scoped listing only	Pagination limits	Access log
Copy	Same-tenant only	No cross-tenant copy	Copy log
Bulk Export	Tenant-scoped; approval required	Encryption; expiration	Export log

Encryption Key Isolation

Key Type	Scope	Rotation	Access
Tenant Master Key	Per tenant	Annual	HSM; tenant admin
Data Encryption Key	Per tenant; derived	Per-use (envelope)	Application only
Field Encryption Key	Per tenant; per field type	Annual	Application only
Backup Encryption Key	Per tenant	Annual	Backup system
Transport Key	Per tenant session	Per session	TLS termination

---

Application-Level Isolation

Request Processing

Stage	Isolation Control	Failure Handling	Monitoring
Request Receipt	Extract tenant from auth	Reject if missing	Auth metrics
Context Initialization	Set tenant context in request scope	Reject if invalid	Context metrics
Authorization	Verify tenant membership	Return 403	Auth failures
Business Logic	Pass tenant context to all operations	Propagate context	Operation metrics
Database Query	Apply tenant filter (automatic via RLS)	RLS blocks unauthorized	Query metrics
Response	Filter response to tenant data only	Sanitize response	Response audit
Logging	Include tenant ID; exclude cross-tenant	Redact sensitive	Log analysis

Service Isolation

Service Type	Isolation Mechanism	Context Propagation	Verification
API Services	JWT tenant claim	Request header	Token validation
Background Workers	Job metadata tenant ID	Queue message	Job validation
Event Processing	Event envelope tenant ID	Event payload	Event validation
Scheduled Tasks	Per-tenant task scheduling	Task context	Task audit
Webhooks	Tenant-specific endpoints/secrets	Webhook config	Signature validation

Code-Level Controls

Control	Implementation	Enforcement	Testing
Tenant Context Required	Middleware injection	Compile-time check	Unit tests
Query Builder Validation	Automatic tenant filter injection	ORM integration	Query tests
Cross-Tenant Detection	Static analysis; runtime checks	CI/CD pipeline	Security tests
Logging Sanitization	Automatic PII redaction	Logging framework	Log audit
Error Message Filtering	Generic errors for isolation failures	Error handler	Error tests

---

Network Isolation

Network Architecture

Layer	Isolation Control	Implementation	Monitoring
Edge	WAF rules; DDoS protection	Cloudflare	Attack metrics
Load Balancer	No tenant-specific routing	AWS ALB	Traffic metrics
Application	Tenant context from auth	Application code	Request metrics
Database	Private subnet; no direct access	VPC	Connection metrics
Inter-Service	Service mesh; mTLS	Internal network	Service metrics
Outbound	NAT gateway; egress filtering	VPC	Egress metrics

Network Security Controls

Control	Purpose	Implementation	Verification
VPC Isolation	Network boundary	AWS VPC	Network audit
Security Groups	Port-level access control	AWS SG	Rule review
Network ACLs	Subnet-level filtering	AWS NACL	ACL review
Private Endpoints	No public database access	VPC endpoints	Endpoint audit
TLS Everywhere	Transport encryption	TLS 1.2+ mandatory	Certificate audit
mTLS for Services	Service authentication	Internal CA	Certificate validation

---

Support and Administrative Access

Support Access Model

Access Level	Purpose	Scope	Controls
No Access (Default)	Normal operations	Automated systems	Full isolation
Metadata Access	Troubleshooting	Account info; usage stats	Audit; time-limited
Read Access	Investigation	Customer data (read-only)	Customer consent; audit
Write Access	Data correction	Customer data (specific fix)	Approval; supervision; audit
Full Access	Emergency	All tenant data	Break-glass; post-incident review

Access Request Process

Step	Requirement	Verification	Documentation
1. Request	Support ticket with justification	Ticket system	Request record
2. Customer Consent	Customer approval (if data access)	Written confirmation	Consent record
3. Approval	Manager + Security approval	Approval workflow	Approval record
4. Access Grant	Time-limited; scope-limited	IAM policy	Grant record
5. Activity	All actions logged	Full audit trail	Activity log
6. Access Revoke	Automatic expiration	Automated	Revocation record
7. Review	Post-access review	Security review	Review record

Break-Glass Procedures

Scenario	Authorization	Time Limit	Post-Incident
Production Incident	On-call engineer + manager	4 hours	Incident review
Security Incident	Security team + CISO	As needed	Full investigation
Legal Requirement	Legal + CISO	Per requirement	Compliance record
Customer Emergency	Customer + Support lead	2 hours	Customer debrief

---

Monitoring and Verification

Isolation Monitoring

Monitor	What It Detects	Alert Threshold	Response
Cross-Tenant Query Attempt	Queries attempting to access other tenants	Any occurrence	Immediate investigation
RLS Policy Failure	Row-level security not enforced	Any occurrence	Block + alert
Unauthorized Storage Access	S3 access outside tenant prefix	Any occurrence	Access revocation
Tenant Context Missing	Requests without tenant identification	Any occurrence	Request rejection
Key Access Anomaly	Unusual encryption key usage patterns	Deviation from baseline	Investigation
Admin Access	Support access to customer data	Any occurrence	Audit review

Verification Testing

Test Type	Frequency	Scope	Owner
Automated Isolation Tests	Every deployment	All isolation controls	Engineering
Penetration Testing	Quarterly	Cross-tenant attack scenarios	Security
RLS Policy Audit	Monthly	All database policies	Database team
Access Control Review	Quarterly	All access configurations	Security
Key Isolation Audit	Monthly	Encryption key boundaries	Security
Code Review	Every PR	Isolation-related changes	Engineering

Compliance Verification

Verification	Method	Frequency	Evidence
SOC 2 Audit	External auditor	Annual	Audit report
ISO 27001 Audit	External auditor	Annual	Certification
Customer Audit	Customer review	On request	Audit response
Internal Audit	Security team	Quarterly	Internal report
Automated Compliance	Continuous monitoring	Real-time	Dashboard

---

Incident Response

Isolation Breach Response

Severity	Definition	Response Time	Actions
Critical	Confirmed cross-tenant data access	Immediate	Containment; customer notification; forensics
High	Attempted cross-tenant access (blocked)	1 hour	Investigation; control verification
Medium	Isolation control degradation	4 hours	Remediation; monitoring increase
Low	Isolation monitoring gap	24 hours	Gap closure; process improvement

Breach Notification

Stakeholder	Notification Trigger	Timeline	Content
Affected Customer	Confirmed data exposure	72 hours max	Scope; impact; remediation
All Customers	Systemic isolation failure	72 hours max	Incident summary; assurance
Regulators	Reportable breach	Per regulation	Required details
Internal	Any isolation incident	Immediate	Full details

Post-Incident Actions

Action	Timeline	Owner	Output
Root Cause Analysis	5 days	Security + Engineering	RCA document
Control Enhancement	30 days	Engineering	Improved controls
Customer Communication	As appropriate	Customer Success	Updated trust documentation
Process Improvement	30 days	Security	Updated procedures
Audit Trail Preservation	Immediate	Security	Evidence package

---

Numbered Policy Statements

1. Tenant Isolation Mandate: All customer data must be logically isolated using tenant identification at every layer of the application stack.

2. Tenant ID Requirement: Every request, query, job, and operation involving customer data must include and validate tenant context.

3. Row-Level Security: All database tables containing customer data must have row-level security policies enforcing tenant isolation.

4. Storage Path Isolation: Customer files must be stored in tenant-prefixed paths with IAM policies preventing cross-tenant access.

5. Encryption Key Isolation: Customer data must be encrypted with tenant-specific keys derived from unique tenant master keys.

6. Cross-Tenant Prohibition: Direct cross-tenant data access is prohibited at all layers; no API, query, or process may access multiple tenants' data in a single operation.

7. Support Access Control: Acme Cloud personnel may only access customer data with documented justification, appropriate approval, customer consent (where required), and full audit logging.

8. Access Time Limits: Administrative access to customer data must be time-limited and automatically revoked upon expiration.

9. Isolation Testing: Automated tests verifying tenant isolation must run on every deployment; failures block release.

10. Monitoring Requirement: Cross-tenant access attempts must be monitored in real-time with immediate alerting on any anomalies.

11. Audit Trail: All access to customer data must be logged with tenant context, accessor identity, timestamp, and action performed.

12. Breach Notification: Confirmed cross-tenant data exposure must be reported to affected customers within 72 hours.

13. Defense in Depth: Multiple isolation controls must be implemented at each layer; single-point-of-failure isolation is prohibited.

14. No Data Commingling: Customer data may not be combined, aggregated, or processed together with other customers' data except in anonymized, aggregated form for product improvement.

15. Vendor Isolation: Third-party integrations must maintain equivalent tenant isolation; customer data may not be shared across vendor tenant boundaries.

---

Framework Appendix

Compliance Mapping

Requirement	SOC 2 Criteria	ISO 27001 Control	GDPR Article	Implementation
Logical access controls	CC6.1	A.9.1.1	Art. 25, 32	Tenant isolation architecture
Data segregation	CC6.1	A.8.1.1	Art. 25	Multi-tenancy model
Encryption	CC6.1	A.10.1.1	Art. 32	Key isolation
Access monitoring	CC7.2	A.12.4.1	Art. 32	Monitoring section
Breach notification	CC7.3	A.16.1.1	Art. 33, 34	Incident response
Data processing limits	CC6.7	A.13.2.1	Art. 28	Cross-tenant prohibition

NIST CSF Mapping

CSF Category	Subcategory	Policy Implementation
PR.AC-4	Access permissions managed	Tenant-scoped authorization
PR.DS-1	Data at rest protected	Encryption key isolation
PR.DS-2	Data in transit protected	TLS; tenant context propagation
PR.DS-5	Protections against data leaks	Cross-tenant controls
PR.PT-3	Access to systems controlled	Support access model
DE.CM-7	Monitoring for unauthorized access	Isolation monitoring

SOC 2 Trust Services Criteria

Criteria	Description	Policy Implementation
CC6.1	Logical access security	Tenant authentication and authorization
CC6.2	Registration and authorization	Tenant provisioning and access grants
CC6.3	Role-based access	Tenant context in roles
CC6.6	Restriction of access	Cross-tenant prohibition
CC6.7	Transmission protection	Network isolation; TLS
CC7.2	System monitoring	Isolation monitoring

---

Related Trust Center documents

security overview, access control, encryption standards, information classification, data retention, audit logging

---

Document revision history

Version	Date	Author	Summary of changes
1.0	2024-06-01	Legal & Compliance	Initial Trust Center publication
2.0	2025-03-15	GRC Program	SOC 2 Type II alignment refresh; expanded subprocessors
2.5	2025-09-01	Security Engineering	Encryption standards update; ISO 27001 mapping
3.0	2026-01-15	Trust Center Program	Full procurement-grade expansion; 34-document set

---

Contact

Acme Cloud, Inc. 1200 Market Street, Suite 400 San Francisco, CA 94103, USA

Channel	Email	Use case
Trust & procurement	trust@acmecloud.com	Security questionnaires, trust reviews
Security	security@acmecloud.com	Incidents, vulnerabilities, control questions
Privacy	privacy@acmecloud.com	DSRs, privacy assessments
Legal	legal@acmecloud.com	Contractual, DPA, legal notices

---

Data Isolation Support Contacts

Contact	Role	Use Case
security@acmecloud.com	Security Team	Isolation concerns; incident reporting
privacy@acmecloud.com	Privacy Team	Data boundary questions; compliance
support@acmecloud.com	Customer Support	Access requests; data questions
trust@acmecloud.com	Trust Team	Audit requests; security questionnaires

---

Appendix: Tenant Isolation Verification Checklist

Layer	Verification Item	Test Method	Frequency
Authentication	Tenant claim present in all tokens	Automated test	Every auth flow
Authorization	Cross-tenant access rejected	Penetration test	Quarterly
Database	RLS policies active on all tenant tables	Schema audit	Monthly
Database	Cross-tenant query returns zero rows	Automated test	Every deployment
Storage	Cross-prefix access denied	IAM policy test	Monthly
Storage	Pre-signed URLs scoped to tenant	URL validation	Every deployment
Encryption	Tenant keys isolated	Key access audit	Monthly
API	Tenant context propagated	Request tracing	Every deployment
Logs	No cross-tenant data in logs	Log audit	Weekly
Backups	Tenant backup isolation	Restore test	Monthly

Document Version: 3.0 Last Updated: January 15, 2026