Security first
Isolation, verification and audit — from the first day.
Tenant context is resolved from the authenticated membership or verified domain, never from a client-supplied id.
- Platform control plane separated from tenant data
- One PostgreSQL database per college
- Server-side entitlement checks on every module route
- Verified domain mapping and audit logging