The system shall be designed to be multi-tenant.

Users of one tenant must never be able to access data specific to another tenant.