> For the complete documentation index, see [llms.txt](https://docs.jetadmin.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.jetadmin.io/access-and-sharing/app-and-data-permissions/customer-data-isolation.md).

# Separate customer data

Use a two-customer test to verify that a portal does not expose one customer's data to another.

## Prepare a controlled example

Create two test customers, A and B, and one intended user for each. Give each customer a distinguishable test record. Use synthetic data so screenshots and test failures do not expose real customer information.

Associate each user with a trusted customer identifier using your application's identity model. If you use [user properties](/access-and-sharing/members-users-and-groups/user-and-team-properties.md), restrict who can edit the identifier.

## Run the isolation test

| Check                              | User A should observe                                    |
| ---------------------------------- | -------------------------------------------------------- |
| List and search                    | Only permitted customer A records.                       |
| Direct link to a customer B record | Access denied or no record returned.                     |
| Export or aggregate                | No unauthorized customer B data.                         |
| Update/delete customer B record    | Request denied; record unchanged.                        |
| Create a record for customer B     | Request denied or unauthorized ownership prevented.      |
| Missing customer identifier        | The explicit restricted behavior defined by your policy. |

Repeat as user B. Include linked records, uploaded files, background workflows, and APIs used by the app.

## Investigate failures

Trace the request to the data-access layer and check how the current identity is used. A customer ID supplied by the browser is not sufficient evidence of authorization.

Fix the underlying [record access rule](/access-and-sharing/app-and-data-permissions/record-access.md) and repeat the same failed case. Preserve expected and actual results in your release review.

The existing [Classic customer portal guide](/classic-app-builder/videos/build-apps-together/customer-portal.md) provides a builder-specific example; use the checks above for either builder.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.jetadmin.io/access-and-sharing/app-and-data-permissions/customer-data-isolation.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.