Isolation
Every query inside a workspace is scoped to that facility, so one facility can never see another's records.
Access control
Staff see only the modules their role allows. Owners decide who can view or change each module.
Backups & audit
Daily backups are retained for 30 days and an activity log records who changed what and when.