Engineering/ Company
Every request, one firm: how Asem isolates tenants
In a multi-tenant legal platform, one cross-firm leak is one too many. Isolation has to be structural, not a convention.
The firm is never a parameter
Every tenant record carries the firm it belongs to. But apps never tell the server which firm they’re acting for: the server resolves the firm from the signed-in user’s membership on every request. A modified app or a crafted request has nothing to change.
Gates on every read and write
On top of the firm scope sit three more layers: the firm’s feature gates, the role preset (with person-level exceptions), and ethical walls on restricted matters. Sensitive actions additionally require a named capability and a recorded reason.
A coverage test enumerates every server endpoint and fails the build if a new one is added without a gate. Walls have their own regression tests across documents, AI results, projects and connected drives.
Data in one jurisdiction
Firm documents are stored in object storage restricted to the EU jurisdiction and the application database runs in the EU, so isolation and residency rules apply to every tenant identically.
