Trust boundary
Service Agent OS Remodelers security and tenant-isolation boundaries
Understand how Service Agent OS Remodelers separates tenant data, resolves workspace access, controls roles and assistant scopes, protects impersonation, and describes its security limits without unsupported certification claims.
By Tyler Thompson, residential remodeling contractor and product founder · Updated 2026-08-24
Answer first
Service Agent OS Remodelers uses a separate operational database for each tenant, a control database for platform identity and membership, tenant-resolved request wrappers, role checks, and scoped assistant access. These controls reduce cross-tenant risk; they are not a claim of perfect security or an unearned certification.
Database-per-tenant isolation
Each tenant's operational CRM data is stored in its own PostgreSQL database. The platform Control database stores tenant identity, users, memberships, subscriptions, and other cross-tenant platform state; it does not serve as a shared project-data table with tenant filters.
- Tenant database connections are resolved through the sanctioned tenant client factory
- Stored tenant connection details are encrypted before the application resolves them
- Preview database access is separately allowlisted and denied from production database hosts
Host, session, and role checks
Tenant hosts resolve the workspace before tenant data is queried. Authenticated routes then verify the human session and current tenant membership. Operator, technician, client, owner, admin, and impersonation boundaries are applied according to the action.
- Cross-tenant session replay is rejected
- Client-facing views are not mirrors of the internal project record
- Destructive or sensitive actions are blocked during administrator impersonation
- The protected first tenant has additional destructive-operation guards
Assistant and integration access
The MCP surface uses OAuth or scoped service-account credentials. Tools remain subject to tenant, user, role, scope, and operation gates. Arbitrary database access is not exposed as an assistant tool.
What this page does not claim
- No SOC 2, ISO 27001, HIPAA, PCI merchant, or other certification is asserted here
- No system is represented as immune from compromise or operator error
- A buyer should verify contractual, insurance, retention, incident-response, and compliance requirements before adoption
- Security-sensitive implementation details and credentials are not published as marketing proof
Responsible evaluation
Use the support channel for a current security review and report suspected vulnerabilities privately. Do not place real customer data into a trial until your company has approved the product's current legal, access, retention, and integration boundaries.