How your data is separated, and how you can check.

Every agency's rows are separated at the database. A change that would let one agency read another's rows fails the build before it merges, and the evidence is the build record rather than an assurance.

Named roles with the least privilege each one needs. The application role cannot bypass row security under any condition. Production access is held to a named list and every entry to it is recorded.

You can take your data out at any time, in a documented format, without asking us and without a fee.