Organization boundaries are enforced
Apply organization scope to records, relationships, jobs, events, and audits, with database rules that reject cross-organization reads and changes.
Security and accountability
Your organization’s data stays separate, private, and accountable.
Protect membership records, payments, publication files, and connected work with enforced organization boundaries and narrowly authorized actions.
Preparing for a limited pilot. Production use follows an organization-specific migration, rehearsal, configuration, and approval.
The governing idea
One organization cannot read or change another organization’s data.
Organization identity follows records, relationships, files, jobs, and audit entries, while tested data policies reject access from the wrong organization.
Northstar in practice
Review change history without exposing private values
The role-aware history search explains that credentials, personal data, and before-and-after payloads stay outside this view.
Swipe or use arrow keys to inspect the full viewSeparation at the source
01Enforce the boundary with the data.
The browser does not get to decide which organization a person can access; verified relationships and permissions do.
Private files stay private
Keep member and publication assets in organization-scoped private storage and grant short-lived access only after a trusted decision.
The boundary is tested
Exercise reads, writes, files, audits, jobs, global identity, and guessed identifiers across multiple organizations in automated tests.
The right people and actions
02Make sensitive access explicit.
Named roles keep daily work understandable while stronger checks protect consequential actions and private member details.
Roles match the work
Give owners, membership staff, finance staff, publication teams, integration administrators, volunteers, auditors, and members only the actions they need.
Administrator work gets stronger checks
Require invitations, verified email, MFA, controlled role changes, session and account controls, and protection against removing the last owner.
Support cannot roam silently
Keep cross-organization support explicit, time-bound, reasoned, separately authorized, and audited alongside privacy, retention, and member-rights work.
Recovery and care
03Make trustworthy operations recoverable.
Security includes what happens during an outage, provider failure, restore, privacy request, or other difficult operational moment.
Important decisions leave a record
Record administrative, financial, publication, integration, and support actions with the actor, organization, time, reason, and affected record.
Recovery is a launch requirement
Define database and private-file recovery, incident ownership, secret rotation, and replay procedures; configured backups and production restore evidence remain explicit launch gates.
Sensitive processing stays private
Keep card details, service secrets, signed-link decisions, and cross-system effects out of the public client, with restricted headers and scoped service access.
Direct answers
Questions collector organizations ask.
Each answer links to the practical product guidance behind it.
Can one organization see another organization’s member data?
No. Organization identity follows records, files, jobs, and audit entries, while database policies reject reads and changes from the wrong organization. Read about data protection
How are administrator accounts protected?
Administrator access uses verified email, invitations, role-based capabilities, MFA for protected work, controlled role changes, and safeguards against removing the last organization owner. Read about accounts and roles
Are publication and member files public?
No. Member and publication assets remain in organization-scoped private storage. Short-lived access is issued only after a trusted membership or administrative decision. Read about private files