Multi-Tenant Cryptographic Isolation and strict data boundary controls.
How Cura prevents cross-tenant data leaks by enforcing strict multi-tenant boundaries, fail-closed access scopes, and automated continuous CI release gates.
Why Application Code Filtering Is Not Enough
Most health platforms rely solely on software-level query filters. Cura adds an immutable second barrier at the storage enforcement layer.
Single Application-Layer Filter
Relies entirely on software developers remembering to include organization filters on every API endpoint and database query.
- ✕A single developer oversight or query bug can leak cross-patient records.
- ✕Direct database client access or background workers bypass application middleware.
- ✕Omitted filters default to returning all tenant records from the database table.
Dual-Tier Cryptographic Data Isolation
Role-Based Access Control (RBAC) middleware + storage-level isolation policies enforced simultaneously on every transaction.
- ✓Storage layer automatically discards records outside the caller’s verified care organization.
- ✓Queries execute in fail-closed mode: missing session context returns exactly 0 rows.
- ✓Automated CI release gates block deployment if cross-tenant leakage is detected.
How Multi-Tenant Isolation Protects Patient Data
// Request Authentication & Role Verification
AuthContext: Verified Organization Scope
Identity: Cryptographically Signed Practitioner Token
Scope: Active Direct Care Team Membership
The session context is bound strictly to the current verified transaction. Connection resets prevent context leakage across requests.
// Storage Isolation Gate
Enforcement: Tenant Partition Isolation Gate
Mode: Fail-Closed (Zero-Trust Default)
Action: Cross-tenant records automatically dropped
Even if an engineer writes an un-scoped query, the storage engine returns ONLY records belonging to the authorized care organization.
Automated Multi-Tenant Isolation CI Test Suite
Security policies are only as good as their automated tests. Cura executes a dedicated multi-tenant isolation test suite in CI on every code commit to empirically verify zero data leakage before any production release.
Cross-Org Zero Rows
Asserts that querying Organization B under Organization A’s session context returns exactly 0 rows.
Inactive Carer Rejection
Asserts that expired or revoked carer proxy accounts receive immediate query rejection.
Connection Context Reset
Asserts that recycled database connections clear session variables without context bleed.
Fail-Closed Scopes
Asserts that queries executed without explicit session variables fail safely with zero records.
Data Isolation FAQ
What happens if an API endpoint forgets to filter by organization?
Nothing leaks. Because data isolation is enforced inside the storage engine itself, queries executed in that session strictly return records belonging to the active organization, blocking cross-tenant visibility completely.
How are covering or locum clinicians granted access?
Locum clinicians are added to care team memberships with explicit active_from and active_until dates. Once the coverage window closes, the security policies automatically revoke access to the patient roster.