How isolation works
- Every database query is scoped to your organization. It is architecturally impossible for one store to access another store’s data.
- Products, inventory, customers, orders, and all other records are tied to your organization ID.
- Staff members can only see and interact with data belonging to their assigned organization and branch.
- PayMongo API keys are stored per organization, ensuring payment processing is completely independent.
Security guarantee: Data isolation is enforced at the application layer, not just the interface. Even if someone attempted to manipulate API requests, they cannot access data outside their organization. This is the same architecture used by enterprise SaaS platforms.

