​
White-label mode

One deployment serving multiple tenants, each with its own branding and domain.

​
Isolation is enforced at the data layer

Tenant scoping is not a WHERE clause applied by convention in application code. The only way to reach tenant data is through a scoped callback — everything inside it runs under that tenant’s identity, and there is no query path around it. The distinction matters because convention-based scoping fails silently: one query that forgets its filter returns another tenant’s rows, and nothing about the result looks wrong.
The specific failure this defends against is connection pooling.A pooled connection can inherit the previous tenant’s identity. The mechanism intended to guarantee isolation then becomes the thing that breaks it — and it breaks under load, when connections are being reused fastest, which is also when it is least likely to be noticed in testing.Do not “optimise” the scoped-callback pattern into a flattened query that appears to work. Its apparent overhead is the isolation.

​
Branding is a security boundary

Tenant branding is not cosmetic. A tenant’s users see their own brand, and rendering the wrong one is a disclosure that tenant B exists to tenant A’s users. Domain routing lookups are necessarily not tenant-scoped — they run before a tenant is resolved — and are the one deliberate exception, isolated in their own module.

​
Deployment checklist

1

Verify isolation under concurrency, not serially

A serial test passes on a broken pool. Exercise concurrent requests across tenants and assert no cross-tenant rows appear.
2

Confirm row-level security is active in your database

RLS policies are part of the design. Confirm they are enabled in your environment — this has not been verified across every deployment target.
3

Terminate TLS per tenant domain

Each white-label domain needs its own certificate.
4

Put the identity proxy in front of every listener

Dashboard and engine both. See SSO.
5

Set per-tenant retention

Nothing expires automatically. See Data handling.

​
LP and downstream usage

White-label mode contemplates showing tenant-branded output to a tenant’s own clients — including LPs. That changes the compliance question, because the disclaimer a downstream reader sees is the tenant’s responsibility as publisher. The disclaimer text is version-locked and travels with the delegation record. Do not replace it as part of a branding change; it is the artifact that supports the publisher’s exclusion. See Compliance.
Full design rationale: docs/WAVE3_ENTERPRISE_MOAT.md §1.
Scienter publishes impersonal market signals of general and regular circulation. Nothing here is investment, legal, or tax advice, or a recommendation to buy, sell, or hold any asset. Scienter is not a registered investment adviser or broker-dealer. Trading digital assets can result in the total loss of your funds — see Disclaimers for the full text.