“Per-tenant isolation” is easy to claim and hard to prove. In Arteliox it’s enforced in the database itself, not in the app layer where a single missed check could leak data.
Every tenant-scoped table carries a tenant id and runs under row-level security, so a query can only ever see the rows that belong to the active tenant. Foreign keys are composite — they include the tenant id — so it’s impossible to link a record across tenant boundaries even by mistake.
The upshot: one studio can never read another’s clients, galleries, or invoices. Isolation isn’t a setting you can forget to turn on — it’s the default the whole system is built around.