# Multi-tenant isolation

> The tenant is an API's end customer: a company, a team, an account. Flexway reads it from a verified source and enforces it everywhere, not only in routing.

Concept - Since version 0.3.0 - Flexway v1.6.3 - https://flexway.io/en/docs/product-multi-tenant/

> Product guide: what the capability brings, for whom, its limits and the version that delivered it - no configuration syntax.
>
> Developer side: [Getting credentials](https://flexway.io/en/docs/developer-credentials/); operations side: [Wiring your identity provider](https://flexway.io/en/docs/operations-identity/), [Setting quotas](https://flexway.io/en/docs/operations-quotas/).

The **tenant** is an API's end customer: a company, a team, an account. Flexway reads it from a
verified source and enforces it everywhere, not only in routing.

| Where | What is guaranteed |
| --- | --- |
| **Identity** | The tenant comes from a signed claim, an API key, a certificate or a trusted mesh; the value the client writes never reaches the upstream |
| **Quotas and budgets** | Counted per tenant: a tenant never spends another's quota |
| **Cache** | An authenticated response is cached per tenant **and** per person; isolation test on every PR |
| **Asynchronous plane** | A subscriber reads its tenant only; a channel can be bound to one person |
| **Native Kafka** | A virtual cluster per tenant; no other tenant's name, neither in an answer nor toward the broker; proven by mutation on every PR |
| **Encryption** | An encrypted field is bound to its tenant, topic and path: copied elsewhere, it does not decrypt |
| **Console** | An account bound to a tenant sees that tenant only; elsewhere, `403` |

**Limit**: the isolation is **logical**, inside a shared gateway; physical isolation means deploying
one gateway per customer.