Isolation
How Express keeps tenants apart — admins see everything; members see only the customers they belong to, never unattached studies.
Express isolation is membership plus a label on the study. There is no second channel. A member of one customer cannot see another customer’s studies. Unattached studies never leak to members.
Each study may carry an expressCustomerId (cus_…). Each user is either an admin (hosting-company staff) or a member (everyone else), and members are added to zero or more Express customers.
Who sees what
Section titled “Who sees what”| Role | Studies with an Express customer they belong to | Studies for an Express customer they do not belong to | Studies with no Express customer | |---|---|---|---| | Admin | Yes | Yes | Yes | | Member | Yes | No | No |
Admins see every study in the organization, including studies with no Express customer attached. Reserve admin for your staff. Do not grant it to end-customer users.
Members see a study only if they belong to that study’s Express customer. They never see studies tagged with a customer they are not in. They never see studies with no expressCustomerId.
No leakage
Section titled “No leakage”- Customer A’s members cannot see customer B’s studies.
- A member who belongs to several customers sees the union of those customers’ studies only — still not other tenants, still not unattached studies.
- Creating a study without
expressCustomerIdhides it from every member. Admins still see it. That is by design, not a way to share work across tenants.
Attach the customer on study create. Add the people who should see that tenant on Users.