Logical data separation
Last updated: Nov 3, 2026
The platform stores all client data in a shared NoSQL database. Two layers keep the data of each client separate.
Data model layer: Almost all the records in the database belong to an organization, group, or user, and this identifier is part of their composite key. Queries require an exact partition key. The data access of the platform uses only these key-scoped queries, without full-table scans. This creates a logical barrier between the data of different clients.
Application layer: The platform evaluates authorization on each API request, not only at authentication time. This evaluation runs each time a function executes. The application denies access by default. A valid session does not give data access by itself. Access to each organization and group requires an explicit role assignment. For more details, read Authorization for clients.
The key structure helps to scope the data by client. But the authorization layer is the security control that stops the access of authenticated users to the data outside the organizations and groups that they have explicit access to.
Other confidentiality measures
Encryption in transit
Fluid Attacks ensures data security with TLSv1.3, HSTS, and short-lived certificates that renew automatically, maintaining an SSL Labs A+ rating across all connections.
No personal gain
Fluid Attacks prohibits the exploitation of discovered vulnerabilities for personal gain. It ensures confidentiality and integrity in all engagements.