01Isolate
One schema per tenant
Real, dedicated database-schema isolation per tenant — not a shared table filtered by a tenant_id column.
Sovereignty · Encryption & Isolation
Isolation at the schema level. Encryption at the tenant level.
Schema-per-tenant multi-tenancy means each Voz360 customer gets its own dedicated database schema, not a shared table filtered by a tenant_id column — tenant data is isolated at the database level, not just the application layer. Voz360 encrypts tenant data with AES-256-GCM under a per-tenant Data Encryption Key (DEK), and every DEK is itself wrapped by a platform Key Encryption Key using AES-KW (RFC 3394) — no tenant shares another tenant’s key material.
Schema-per-tenant multi-tenancy means each Voz360 customer gets its own dedicated database schema, not a shared table filtered by a tenant_id column — tenant data is isolated at the database level, not just the application layer. Voz360 encrypts tenant data with AES-256-GCM under a per-tenant Data Encryption Key (DEK), and every DEK is itself wrapped by a platform Key Encryption Key using AES-KW (RFC 3394) — no tenant shares another tenant’s key material.
02Encrypt
AES-256-GCM per tenant
Recording, voicemail, and SIP-secret bodies are encrypted under each tenant’s own Data Encryption Key.
03Wrap
AES-KW key wrapping
Every per-tenant DEK is itself wrapped by a platform Key Encryption Key using AES-KW (RFC 3394).
04Rotate
DEK rotation
Data Encryption Keys can be rotated per tenant without re-architecting the tenant’s schema.
Questions, answered
What enterprise buying teams want to know.
Self-contained answers, so the questions a security or procurement reviewer asks first don't require reading the whole page.
What is the difference between schema-per-tenant and a tenant_id column?
A tenant_id column relies on every query correctly filtering by that column at the application layer — a single missed filter leaks data across tenants. A dedicated database schema per tenant enforces the boundary at the database level.
Who can decrypt a tenant’s data?
Decryption requires the tenant’s DEK, which is itself wrapped by the platform KEK — access to encrypted content requires both the wrapped key material and the platform-level unwrap operation, which is itself an audited action.
Talk to Voz360
Run it on your terms.
Bring your deployment constraints, compliance requirements, and channel mix. We will show you exactly where control lives in the architecture.