Tenant isolation
Multi-client credit audit software with tenant isolation
TL;DR
A multi-client credit audit workspace keeps each consumer file, report, and letter inside the owning account. Database row-level security, upload finalizers, and intake-link checks all have to agree before a teammate or a bearer link can see a file.
Definition
Multi-client credit audit software is the operator workspace for reviewing many consumer reports, drafting disputes, and tracking responses without mixing one client's evidence into another client's folder.
How tenant isolation supports a defensible client audit
Each client folder belongs to a workspace. Uploads are checked for that ownership in the server finalizer and again in database triggers, so a direct API write cannot attach one account's report to another account's client.
Intake links are bound to the same workspace's client and preparer. The email goes only to the address saved on that client folder. A caller cannot steer the message to an address supplied in the request.
Portal renewal requires an authenticated creator or admin through row-level security. An expired bearer link cannot mint a fresh session, and portal responses are not shared-cacheable.
- Selecting a folder updates uploads in the same window and in other tabs.
- Report finalization checks stored bytes and rejects reuse of the same object across folders.
- Team seats can work inside the owner's workspace. They do not inherit the owner's mail-provider key.
- Platform admin access is the pinned owner identity, not a stale admin-role row.
How an agency uses this
1. Open a client folder in the owning workspace
Create or select the client. The active folder is validated against clients the caller can access.
2. Upload the report into that folder
The finalizer confirms the object exists, matches the expected size, and is not already filed on another client.
3. Draft from the stored report
Letter generation reads the saved file. Read-only preview and export keep the saved body. A new draft is what picks up current legal wording.
4. Share access only through a bound link
An intake or portal link names the client and preparer in that workspace. Revoking the grant ends its subscriptions immediately.
Direct answers
Can one workspace read another customer's credit reports?
No. Client files, reports, and letters are scoped to the owning workspace through row-level security, and upload paths are checked again on the server. A failed status read is not treated as permission to cross accounts.
Do team members receive the owner's certified-mail API key?
No. The mail connection is stored for the workspace owner and read with the service role. The key is not sent to the browser, and teammates do not manage or replace it.
What happens to a client portal when its access link is revoked?
Revocation ends the link's subscriptions in the database. Paid-access checks ignore subscriptions that came from a revoked link, so withdrawn access stops immediately.
Agency workspace: credit repair business software. Published Unlimited plan: $149.99/mo. Single-file Analyze & Dispute: $15.