Security questionnaire answers › Data protection
How do you separate one customer's data from another's? How to answer it in a security questionnaire
Why buyers ask this
In a multi-tenant product, a flaw in isolation could expose one customer's data to another.
What a strong answer includes
- Describe the isolation model: tenant IDs enforced in the data layer, per-tenant databases, or row-level security.
- Say how isolation is tested.
- Mention how support staff access is controlled.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
Our application is multi-tenant. Every record is tagged with a tenant identifier enforced at the [data access layer/database row level], and automated tests verify that one tenant cannot read another's data. Support access to customer data is restricted, approved and logged.
Evidence to attach
- Architecture description
- Tenant isolation test results
- Support access procedure
Common mistakes
- Isolation enforced only in the UI and not the data layer.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.