Per-client database isolation by default
Each client's data sits in its own logical database boundary, not a shared tenant-keyed table — with dedicated-instance deployment available for buyers who need physical separation. The blast radius of any single-tenant issue is contained by design.
