> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useshipd.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Data isolation tiers

> Standard, dedicated-schema, and dedicated-database placement boundaries and limitations.

## Overview

Standard organizations share the control-plane database schema and data-plane namespace. Contracted Enterprise organizations can be operator-provisioned into a dedicated Postgres schema or database. Dedicated placement is not self-service.

| Tier | Tenant data | Data plane | Region |
| - | - | - | - |
| Standard | Shared public schema | Shared KV namespace | Service default |
| Dedicated schema | Organization schema on a shared cluster | Organization namespace | Shared cluster region |
| Dedicated database | Organization database | Organization namespace | Contracted database region |

Authentication, entitlement, usage, SSO, SCIM, heartbeat, and placement control records remain in the shared control plane for every tier. Cloudflare KV cannot currently be pinned to one jurisdiction, and regional compute routing is not offered. Do not interpret database placement as end-to-end data residency.

During a placement migration, tenant operations fail closed with `503 tenant_migrating` or `503 tenant_unavailable`; clients continue using their last good snapshot. Point-in-time recovery and database row-level security are not part of the current isolation guarantee. Backup retention beyond the standard policy must be explicitly contracted and verified as deployed.

Contact support ([hey@useshipd.com](mailto:hey@useshipd.com)) for provisioning, migration scheduling, current restore objectives, and evidence for your contracted placement.

Related: [Reliability and data handling](/reference/reliability-and-data) · [Local evaluation](/concepts/local-evaluation).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.