Multi-Tenant Org & Auth Trail — SmartLite Academy

Why multi-tenancy matters

Devon Cole · Platform Operations Lead

"We sell to hundreds of companies. Each one needs to feel like they have their own private CRM. But if we set up a brand-new server and database for every single customer, our costs and workload explode before we even reach a hundred customers."

This is called multi-tenancy: many customers — called "tenants" — sharing one platform, the way many businesses rent space in the same office building. Each tenant wants isolation: a guarantee that only their own company can ever see their own data. But building a separate, private system for every customer would cost far too much. SmartLite has to share infrastructure to stay affordable, without ever letting one customer see another customer's data.

💡

What this means for you

SmartLite runs as one shared, affordable platform that can serve any number of customer organizations. Data isolation isn't just a rule people are trusted to follow — it's built directly into the code, so nobody can skip it by accident.

Anatomy of tenant isolation

An org (short for "organization") is SmartLite's word for one customer company's account. SmartLite stores every org's data in the very same shared database and the very same tables. So how does one org's data stay hidden from every other org? A chain of checks runs on every single request. Here's the chain, step by step:

Step	Mechanism	What it guarantees
1. Login	You get a login token — called a JWT — with your company's ID stored inside it	Every request after that can prove which org it belongs to
2. Request enters	SmartLite reads your company's ID out of that token and keeps it on hand for the rest of the request	The current org is known for the entire request, start to finish
3. Every query	Every read and write is automatically limited to that company's ID	You can only ever see or change your own org's records
4. Every single-record fetch	One more check confirms the record actually belongs to your company before it's shown to you	Even a guessed or leaked internal ID can't be used to read another org's record

✅

Why the extra check matters

Filtering every query by your company's ID stops most leaks. But looking up one record directly by its ID is a special case — a missing filter somewhere could still let it slip through. That extra check is a final safety net. SmartLite's rule is simple: always tag new records with the org's ID, always filter queries by it, and always double-check on every read.

An object in SmartLite is just a type of record — think Lead, Contact, or Account — like a labeled folder or a spreadsheet tab. Registering a brand-new org sets everything up in one step. It creates the organization, its first Admin user, and all 16 standard objects (Lead, Contact, Account, Opportunity, Case, and more). A new customer can start working right away — no manual setup needed from your team.

1 Register a new org and prove the isolation

Open the registration pageGo to /org/register in your browser — this is SmartLite's sign-up page.

Create Org #1Type in a company name (try "Northwind Distributors") plus an admin email and password. Log in, then create one test Lead — a Lead is a potential customer who hasn't been qualified yet.

Log out, then register Org #2Sign up again, this time with a different company name (try "Contoso Supplies") and a different admin login.

Check the Leads list in Org #2It's empty — even though Org #1 already has a Lead saved, in that very same shared database.

Inspect the JWT (optional)This one's for the curious. After logging into either org, your browser stores a login token (JWT) in a spot called localStorage. Decode it on a site like jwt.io, and you'll spot a different orgId value in each org's token.

⚠️

What you just proved

Two organizations. Same database. Same application code. Yet neither one can see a single record that belongs to the other. That's tenant isolation working exactly as designed — not just a lucky coincidence because the test data happened to be empty.

Day-to-day: a new customer signing up

Register once, start working immediatelyA new company registers at /org/register and gets a fully set-up account with standard objects already in place — no waiting on manual provisioning.

Day-to-day: platform operations

Trust the isolation by defaultYou don't need to manually verify separation for every new customer — it's enforced automatically on every request, for every org.

🎯

What to try next

Look at the Profiles & Permissions trail — that's the next layer of access control, deciding who inside your own org can see what.

Test what you learned

1. When a request comes in, what piece of information does SmartLite keep on hand for the rest of that request?

The user's password

The company's ID, taken from their login token

A list of every org in the database

2. Why does SmartLite double-check who owns a record, even after finding it by its ID?

To speed up the database query

To stop a guessed or leaked internal ID from reading another org's record

It's only used for audit logging

Multi-Tenant Org & Auth: One Platform, Zero Data Leakage