Don't trust the filter. Re-run the proof.

Every incumbent scopes tenants with a metadata WHERE-filter. We separate them physically and cryptographically, then hand you a signed receipt you can verify yourself.

The four controls, bottom-up

1. Schema-per-tenant. Physical separation at the database layer, not a shared table. A breach of one compartment cannot reach another: there is no shared row surface to leak across.

2. FORCE ROW LEVEL SECURITY. An OWASP-recommended backstop: a NOLOGIN role with a GRANT per tenant.

3. AES-256-GCM envelope encryption. Each tenant’s data is envelope-encrypted under its own key, with the tenant id as additional authenticated data, and fail-closed key material.

4. Ed25519-signed attestation. A buyer-runnable verify_isolation runs live fault-injection probes and returns an Ed25519-signed receipt, checkable against a public JWKS. Do not trust us. Re-run it.

Machine-checkable, not a promise

verify_isolation runs live probes and returns a signed attestation. That is the point: isolation you can re-run, not a claim in a data sheet.

Honest ceiling

OWASP ranks fully separate databases above schema-per-tenant. Our answer is FORCE RLS plus per-tenant crypto plus the attestation, not a claim that we are unbeatable. See the write path for the other half of the story: keeping poison out of memory in the first place.