Every tenant’s workspace is partitioned at the platform level:

• Data — channels, schedules, planners and logs are scoped to the owning tenant; one tenant can never see another’s.
• Media — uploads are separated per tenant.
• WordPress access — tenant accounts use a dedicated minimal role that can only read and upload files; they work in their own panel, not wp-admin.

If the FS Poster core on the site ever falls below the supported version, the platform fails closed: tenant access is blocked until the core is updated, instead of running unscoped.