Isolate every customer with row-level security, custom branding, and per-tenant licensing.
TOTP-based two-factor for every account. Compromised passwords blocked at signup.
Super admin, tenant admin, manager, and learner roles with strict separation of duties.