Harden Startup Multi-Tenant Security

Right now our young Fintech SaaS platform shares a Postgres database across all customers, and the current tenancy filter lives only in middleware. We have no live clients. Before we do, we need airtight, provably correct multi-level data and customer separation (one user may have data from many clients, which must be separate, but they need a single dashboard view and access to each client's project). The task • Review the existing Python (Vibe) back-end and Python/ React front-end. • Understand and improve the flow of data between partially masked form inputs, field assignments, baseline establishment facts per client, transient and comparative multi-dimensional sandbox scenarios and draft outputs, secure chat feedback with client, narrowing of scenarios, application of scenarios per year or as a whole, up to 5 years, and optimization of results which are saved. • Design and implement strict customer-level access rules inside the shared database—row-level security, schema isolation or a clearly argued alternative. • Design and create access for product development data mining and use while keeping client data anonymous • Create a safe elevation path for those partner admins who legitimately manage multiple tenants. • Add automated tests and detailed audit logging that demonstrate the control works even if application code misbehaves- suitable for SOC2 • Produce concise developer-facing documentation and artifacts we can hand to SOC 2 auditors. Acceptance criteria A request originating from one tenant must never return data that belongs to another. Integration tests must cover every public endpoint, and audit logs must record who accessed which tenant and when. Collaboration happens over GitHub, Slack, and a weekly video check-in. Familiarity with SOC 2 evidence-collection tools such as Vanta will help you move quickly, but deep experience designing secure multi-tenant SaaS systems for Fintech or similar regulated industries is the key to success. Long-term employment available.