Waypoint Claims
Trust / Tenant isolation

Two walls, because one of them is written by people

Every organization’s data sits in its own database, locked by its own key. Inside it, the data is walled off twice more: once in the database and once in the code.

This is the first question a carrier’s security review asks and the one where vendors are vaguest. Here is the whole mechanism, in enough detail to check.

Bring your security review How it works
The question this answers
Could another organization’s query ever return our rows?
Not through one mistake. In the code, a read filter clamps every query to the caller’s own organization by default, and a request with no organization context sees nothing. Underneath, row-level security on every tenant table refuses rows that belong to another organization or another client. A single bug defeats neither wall on its own, which is the entire point of having two.

How a request gets scoped, twice

Wall one, then wall two
The Organization Comes From The Session
Never from the request body, a query parameter or a header a client controls. A caller cannot name a different organization, because the platform does not accept the value from them at all.
The Code Clamps Every Query
A read filter scopes every query to the caller’s organization by default. A request that arrives with no organization context sees nothing, rather than everything.
Row-level Security Is Forced
Every tenant table carries row-level security set to force, so even the table owner obeys it. 187 database changes put these walls in place.
Two Walls In The Database
An organization wall and a client wall. An adjusting firm’s client books are walled from each other inside the firm, not only from other firms.
Operator Screens Never Open Your Records
Waypoint’s operator screens see organization names, packages and row counts, never the records themselves.
What a reviewer can verify

Claims a security team can actually test

Every line here is a statement about the running system that can be checked in a session with your engineers present, rather than a posture described in a brochure.

Control
How it is implemented
Tenant Resolution
From the authenticated session only; no client-supplied organization identifier is accepted
Application Scoping
A read filter clamps every query to the caller’s organization by default
Database Enforcement
Row-level security forced on every tenant table, with an organization wall and a client wall
Index Coverage
Waypoint’s Platform Health card shows every tenant-wall index present, and names any that is missing
Operator Access
Every organization session is refused at the Operator Portal’s doors, and a test proves it
Phones and Chats
A call, queue, voicemail or claim chat never crosses from one organization to another — enforced by the database as well as the screens
Database Options
Smaller clients share one core database walled this way; enterprise carriers get their own dedicated core database
Where we are honest

What two walls do not give you

Isolation is about one organization reaching another. It is not a claim about every other risk, and treating it as one is how security reviews get misled.

Not A Substitute For Access Control
Isolation stops cross-organization reads. Inside your own organization, what a person may see is governed by entitlements, roles and page grants — a different mechanism, documented separately.
Not A Compliance Certificate
These are engineering controls, described precisely. Where you need an attested audit, ask us for our current certification position rather than inferring one from this page.
Shared Unless You Choose Otherwise
Smaller clients share one walled core database. If you need your own, a dedicated core database comes with the enterprise plan or on request — every client gets the same features either way.

Read next

Encryption Your own key, and a separate vault for identity numbers. Audit & Retention Who did what, when, and how long it is kept. Admin Portal Entitlements, roles and page grants: the other half of access control.

Put your engineers in the room

This is a page that rewards a technical audience. Bring the person who will actually read the schema, and we will go through the policies rather than the summary.

Book a walkthrough Back to the overview