Multi-tenancy & data isolation

Cushy is multi-tenant: many organizations share one deployment, and each sees only its own data. Isolation is enforced at the data-access layer, not left to the UI.

Every request is org-scoped

An authenticated request carries the caller's organization id, and every Store query filters by it. There is no endpoint that returns another organization's users, cloud accounts, inventory, cost or audit rows. Listing endpoints return only your organization's rows; item endpoints look up by (orgId, id).

Cross-tenant identifiers return 404

Asking for a resource that belongs to another organization returns the same 404 as asking for one that does not exist — the API never confirms that an id is valid elsewhere. This holds for cloud accounts, budgets, users, API tokens and every other item route, so an id from one tenant is useless in another and reveals nothing.

Plan, status and support

Cushy staff administer each organization's plan, status and feature flags without any access to tenant data content — administration is metadata-level, and the staff data boundary structurally excludes your inventory, cost and secrets. If an organization is suspended, sign-in is blocked with a 403 and its existing sessions end immediately.

Isolation and API tokens

API tokens inherit the same isolation: a token authenticates as a user within one organization, its role is a capability ceiling, and it can never carry owner or platform powers. A token from one organization cannot address another's resources.