Schema-Per-Tenant Isolation
Every organization gets its own PostgreSQL schema. Each request is served inside a transaction pinned to that schema, and the binding is cleared when the connection is released — not a tenant column filtered on a shared table.