# Tenant Isolation {#tenant-isolation}


How Ever Gauzy ensures complete data isolation between tenants.


## Overview {#overview}


Multi-tenancy in Gauzy uses **row-level isolation** — all entities include a `tenantId` column, and all queries are automatically filtered by the current user's tenant.


## Isolation Layers {#isolation-layers}






```mermaid
graph TB
    A[Request] --> B[JWT Extraction]
    B --> C[TenantPermissionGuard]
    C --> D[RequestContext: tenantId]
    D --> E[TenantAwareCrudService]
    E --> F["WHERE tenantId = :ctx.tenantId"]
    F --> G[(Database)]
```






### Layer 1: JWT Token {#layer-1-jwt-token}


The JWT token contains the user's `tenantId`. This is validated on every request.


### Layer 2: TenantPermissionGuard {#layer-2-tenantpermissionguard}


The `TenantPermissionGuard` extracts the tenant from the JWT and sets it in the `RequestContext`.


### Layer 3: Base Entity Classes {#layer-3-base-entity-classes}


All entities extend `TenantBaseEntity` which includes:

```typescript
class TenantBaseEntity {
  @Column()
  tenantId: string;

  @ManyToOne(() => Tenant)
  tenant: Tenant;
}
```


### Layer 4: Service Layer {#layer-4-service-layer}


`TenantAwareCrudService` automatically appends `tenantId` to all queries:

```typescript
findAll(filter) {
  // Automatically adds: WHERE tenantId = currentTenantId
  return super.findAll({
    ...filter,
    where: { ...filter.where, tenantId: RequestContext.currentTenantId() }
  });
}
```


## Cross-Tenant Protection {#cross-tenant-protection}


| Protection              | Mechanism                     |
| ----------------------- | ----------------------------- |
| Read isolation          | Automatic WHERE clause        |
| Write isolation         | TenantId injected on create   |
| Update/Delete isolation | Ownership validation          |
| Relation traversal      | Tenant-scoped joins           |
| Public endpoints        | No tenant context (read-only) |


## Testing Tenant Isolation {#testing-tenant-isolation}


When developing new features, always verify:

1. User A (Tenant 1) cannot read User B's (Tenant 2) data
2. Cross-tenant IDs in requests are rejected
3. Public endpoints don't leak tenant-specific data


## Related Pages {#related-pages}


- [API Security Best Practices](https://sourcey-gauzy.pages.dev/security/api-security-best-practices/index.md) — API security
- [Multi-Tenancy Architecture](https://sourcey-gauzy.pages.dev/architecture/multi-tenancy/index.md) — architecture overview