Security & Compliance
Organisation Isolation
Available todayUnderstand how Telblu securely separates organisational data using logical isolation and organisation-scoped security policies.
Every organisation operates within its own logical security boundary. Access to data is continuously validated using authentication, organisation membership, Role-Based Access Control and PostgreSQL Row-Level Security before information is returned.
Logical Isolation
Organisations are separated using organisation-scoped security policies rather than physical infrastructure.
Organisation Membership
Every user must belong to an organisation before organisational data can be accessed.
Role Validation
Permissions are evaluated using the user's assigned organisational role before data is returned.
Database Security
PostgreSQL Row-Level Security filters unauthorised rows before they reach the application.
What is Organisation Isolation?
Organisation Isolation ensures that users can only access information belonging to organisations where they have authorised membership.
Every request is evaluated against the authenticated user's organisation before data is returned.
Isolation is enforced through database security policies rather than client-side filtering.
Organisation Security Model
Every request must successfully pass through multiple security checks before organisational information becomes available.
User
Authentication
Session
Organisation Membership
Role Validation
Row-Level Security
Organisation Data
Authorised Response
How Organisation Isolation Works
Multiple controls work together to maintain a strict boundary around each organisation's data.
Authentication
Users must successfully authenticate before accessing the platform.
Organisation Membership
Every authenticated user belongs to one or more authorised organisations. Organisation membership determines which organisational information may be accessed.
Role-Based Access Control
Permissions are evaluated using the user's assigned organisational role. Different roles provide different levels of access.
Row-Level Security
Database security policies ensure only authorised organisational records are returned. Unauthorised rows are filtered before they reach the application.
Workspace Access
Department Workspaces inherit organisation boundaries automatically. Users cannot open workspaces belonging to unauthorised organisations.
Executive Visibility
Executive users can view information only for organisations where they have authorised access.
Organisation Access Flow
The diagram below shows the sequence of checks applied to every request for organisational data.
Login
Authenticated Session
Organisation Membership
Role Evaluation
Row-Level Security
Authorised Organisation Data
Login
The user provides valid credentials and, if required, completes Multi-Factor Authentication.
Authenticated Session
A secure session is established after the user's identity is verified.
Organisation Membership
The platform checks which organisations the user is authorised to access.
Role Evaluation
The user's role within the organisation determines what actions are permitted.
Row-Level Security
Database policies enforce organisation-scoped access, filtering out unauthorised rows.
Authorised Organisation Data
Only data belonging to the user's authorised organisations is returned.
What is Protected?
Organisation isolation applies to every category of organisational information stored within Telblu.
Departments
Department Workspaces remain isolated between organisations.
Strategies
Strategic plans are only visible within authorised organisations.
Objectives & Initiatives
Execution data follows the same organisation boundary.
KPIs
Performance information is organisation-specific.
Governance
Approvals and governance records remain within organisational boundaries.
Executive Reporting
Executive Control Centre only aggregates information from organisations the user is authorised to access.
Logical vs Physical Isolation
Telblu uses logical organisation isolation enforced through PostgreSQL Row-Level Security. It does not use physical database separation.
| Logical Isolation | Physical Isolation |
|---|---|
| Organisation-scoped security policies | Separate databases |
| Shared platform infrastructure | Independent infrastructure |
| Database access controlled using Row-Level Security | Separate database instances |
| Implemented within Telblu | Not part of the current architecture |
Relationship to Platform Security
Organisation Isolation sits between identity, access control and database security. Each layer contributes to protecting organisational information.
Authentication
Roles & Permissions
Organisation Membership
Organisation Isolation
Row-Level Security
Protected Data
Authentication establishes identity, Roles & Permissions define what a user may do, Organisation Membership scopes access to the correct tenant, Organisation Isolation enforces the boundary, Row-Level Security filters data at the database layer, and Protected Data is returned only when every preceding check succeeds.
Current Implementation
The table below lists the organisation isolation capabilities available in the current Telblu deployment.
| Capability | Status |
|---|---|
| Organisation Membership Validation | Available |
| Logical Organisation Isolation | Available |
| Role-Based Access Control | Available |
| PostgreSQL Row-Level Security | Available |
| Department Workspace Isolation | Available |
| Executive Data Protection | Available |
Best Practices
Organisation isolation is enforced for every protected database request
InformationReview organisation membership regularly
Best PracticeOrganisation Isolation works together with other security controls
Note