> ## Documentation Index
> Fetch the complete documentation index at: https://docs.postsider.com/llms.txt
> Use this file to discover all available pages before exploring further.

# PostSider tenant isolation

> How PostSider keeps organizations and their data separate.

PostSider is a multi-organization platform. Each organization has its own channels, posts, media, webhooks, API keys, and settings, and these are isolated from every other organization.

## How isolation works

* Every authenticated request re-resolves the user from the database, and the active organization (`req.org`) is always one the caller belongs to - it can never be switched to an unrelated organization.
* Public API keys and `pos_...` tokens map to exactly one organization.
* Repository methods are scoped by `organizationId`; cross-organization lookups require an explicit org filter.
* Media, posts, webhooks, and credentials carry an `organizationId` and are queried with it.
* Shared post previews are gated by a random share token rather than a guessable id.

## Self-hosted caveat

When billing is disabled (no `POLAR_ACCESS_TOKEN`), plan and role policy checks are bypassed, and every member effectively has broad access. On such instances the `USER` role is not a security boundary - rely on trusted members instead. Managed Cloud billing keeps the role model enforced.