How we isolate tenants in multi-tenant portfolios

Each published portfolio lives on its own subdomain or custom domain, and content is scoped per tenant at every layer.

The public site renderer is deliberately stateless: it has no access to auth, sessions, or app chrome, which keeps the blast radius small.

Immutable publication snapshots mean what a visitor sees is exactly what was published — never a half-saved draft.