Physically separated database
We're not talking about row-level security or tenant_id filters. Every Zephira customer has their own dedicated PostgreSQL schema with separate credentials. It's architecturally impossible for one customer to see another's data — there's no query that can do it, not even by mistake.