Tenant isolation
Every operator's twin lives in its own scope. One tenant's data is never reachable from another tenant's context.
Product / Security
Trust & security
Built multi-tenant from the first query.
Confidence comes from boundaries you can verify: tenant isolation, observability, and honest data states, designed in rather than bolted on.
TENANT · NORTHWIND
scoped twin store
query engineevery query tenant-scoped
TENANT · VOLTGRID
scoped twin store
Tenant-scopedevery single query
Audit logper-tenant, queryable
Stale-modeledloss is a state
Boundedno cross-tenant path
The boundaries
Six guarantees, designed in.
Bounded queries
Every query is tenant-scoped at the boundary; there is no query path that spans tenants, by construction.
Observability
Ingestion, freshness, and twin state are monitored end-to-end, so degradation is seen, not discovered later.
Tenant-scoped audit log
Security-relevant events are recorded to a per-tenant audit log, queryable within, never across, the tenant boundary.
Data integrity
A dropped feed becomes a stale or offline state; the twin holds last-known values rather than vanishing.
Modeled connectivity
Connectivity is a designed state (online / stale / offline), never an error badge papering over missing data.
Isolation
No path between tenants.
Isolation isn't a setting you toggle. It's the shape of the query layer.
Multi-tenant by design
Each tenant, its own scope.
The query engine binds to a single tenant at the boundary. There is no supported path that reads across tenants. Isolation holds because the alternative simply isn't expressible.
- Per-tenant data scope
- Boundary-enforced, not policy-only
- Tenant-scoped audit log
TENANT · NORTHWIND
scoped twin store
query engineevery query tenant-scoped
TENANT · VOLTGRID
scoped twin store
IsolationPer-tenant scope on every query; no cross-tenant path exists.
ReadsBounded and scoped to the calling tenant's context.
ConnectivityModeled as online / stale / offline, not dropped.
On feed lossTwin retains last-known state; freshness is surfaced.
Honest about gaps. When connectivity is lost, Rootd models it as stale or offline and keeps the last-known twin state. It never silently drops data or hides the gap behind an error.
Verify the boundaries before you trust the signal.
We'll walk your team through tenant isolation, audit trails, and data integrity.