# Data and company isolation

> One runtime, separate company Vaults and a shared identity with explicit authority.

_Updated: 2026-09-22_

Railbase uses one embedded database engine in one process. System stores shared
identity, company membership, installation permissions and lifecycle metadata.
Each company's working records live in its own encrypted Vault with an
independently generated key. Uploaded blobs use configured file storage.

## Company access

Signing in identifies the person. Company membership, company permissions and
object scope determine which records that person can use. A company selector
chooses a context; it does not grant membership. A session bound to a Cloud
company cannot be redirected to another company by changing a request header.
Installation permissions do not imply access to company work, and company roles
do not grant installation authority.

Each company has an independent write queue. Shared CPU, memory and disk still
limit total throughput. Separate files do not eliminate permission checks or
isolate a process failure. Every company transaction rechecks admission; a
suspended company cannot continue using a previously retained storage handle.

## Storage and recovery

New installations use the separate layout immediately. Existing installations
need the verified offline [company migration](/en/learn/company-vault-migration). An
executable update alone does not split the old database. Schema indexes are
reconciled before a company works with an updated schema.

Use the complete native installation backup: System, all companies, local assets
and identity material must agree. Capture briefly fences writes across files.
Keep the external unlock material separately and verify an off-host restore.
Never give one company the installation-wide bundle. See
[Backups and restore](/en/learn/backups-and-restore).

On-premise operators control hosting and backup schedules. Managed Cloud uses
the same storage boundary with additional admission and backup requirements
under the Cloud Schedule. Account shows deployment availability.