Isolation is the feature
A multi-tenant system that leaks between tenants is worthless to the organisations this product is built for. Here is how it is prevented.
Architectural guarantees
Properties of the build, enforced by tests that block a merge — not policies in a document.
Tenant isolation
Every table carries a tenant identifier and every query leads its index with it. Filtering is banned on tenant tables because discarded rows still count against the scan limit.
Least privilege by default
Eleven roles across forty-seven permissions. An explicit denial always beats a grant, and no member can escalate their own role.
Immutable audit trail
Every state-changing operation writes an audit entry in the same transaction as the change, so the record cannot drift from reality.
Authenticated media
Storage URLs are never returned to a client. All media is served through a proxy that verifies tenant ownership on every request.
Secret hygiene
No secret appears in code, logs, error messages or API responses. Publishing tokens are encrypted at rest with versioned keys.
Consented support access
Our staff see metadata and health, never your content. Content access requires a time-boxed, logged, tenant-notified break-glass grant.
Data protection
Questions procurement asks, answered directly.
- How is Saudi PDPL handled?
- Photographs of identifiable people are treated as personal data. Breach notification runs to a 72-hour clock, and retention is configurable per tenant.
- Where does data live?
- In the region chosen at deployment. There is no Middle East region on our hosted database, so in-Kingdom residency requires a self-hosted deployment — we will say so rather than imply otherwise.
- How long is content kept?
- Content retention is a tenant setting. Voice recordings have their own, shorter default because they are higher-risk personal data.
- Do you run facial recognition?
- No. Biometric data is sensitive personal data under PDPL, and no automatic facial recognition runs on uploaded photographs. This is a deliberate architectural exclusion.
Certifications
BrandSphere AI does not currently hold SOC 2 or ISO 27001 attestation. The controls described above are implemented and tested, but they are not yet independently audited. We would rather state that plainly than let a procurement process assume otherwise. Ask us about the current roadmap for formal certification.