Tenant Isolation

Overview

In Survanta, each subscribing organization is a tenant. Tenant isolation is enforced through tenant context, tenant-owned entities, EF Core query filters, explicit tenant predicates for pre-context credential lookup, authorization policies, and focused tests. Security depends on preserving these controls on every new flow.

How Isolation Works

Every piece of data in Survanta — surveys, responses, users, settings, files — is associated with a specific tenant. When a user signs in to the Survanta dashboard, the system enforces that all operations they perform are restricted to the data of their own tenant only.

This means:

• A Tenant Admin at Organization A cannot view any surveys, responses, or users from Organization B.
• A Tenant User assigned to a project in Organization A cannot see projects from Organization C.
• Invitations, public tokens, files, integration keys, and exports have tenant-specific validation; external sharing is intentional only through the corresponding authorized feature.

What Platform Admins Can Access

Authorized Platform users can operate on tenant data through platform actions, often after establishing a validated selected-tenant context:

• Access is available through specific platform-level support and billing tools.
• Sensitive operations have explicit System permissions and selected-tenant checks where required; audit coverage is action-specific and should not be assumed universally.
• Platform response management uses dedicated permissions such as System.ManageTenantResponses or System.EditTenantResponses, not unrestricted browsing authority.

Public Respondents

Public token boundaries vary by scope:

• SingleSurvey/QR is one-survey answering; TenantActiveSurveys intentionally lists eligible tenant surveys; ResponseViewer is read-only and can cover all permitted surveys or one survey.
• Access any survey from a different tenant.
• View any dashboard, user list, or administrative information.

Every public request is tenant-stamped only after token validation, and each route rechecks its scope/capabilities and resource association.

File and Asset Isolation

Files uploaded within a tenant — such as survey attachments or media — are stored in a way that associates them with that tenant. A user from a different tenant cannot access another tenant's uploaded files even if they know the file exists.

Why This Matters

Tenant isolation protects the confidentiality of your organization's research data, respondent information, and business configuration. You can use Survanta with confidence knowing that other organizations sharing the same platform cannot see your data.

Frequently Asked Questions

Can Survanta merge or transfer data between tenants? Data transfers between tenants are not a self-service feature. If a legitimate business need arises (for example, an organization restructuring), contact the platform team through official channels.

What happens to our data if we cancel our subscription? The repository documents subscription access blocking but does not establish a confirmed cancellation retention period or automatic permanent-deletion schedule. This requires a product/legal owner decision before publishing a retention promise.

Does Survanta use a separate database per tenant? Survanta uses a shared multi-tenant data architecture with logical isolation controls. Those controls must be maintained in services, controllers, background work, exports, and any query-filter bypass.