Security & Architecture
Each client sees only its own data
A secure, Eclipse-hosted platform that brings HubSpot and Airtable data together and shows each client exactly what belongs to them.
How the real build works
Hosted in Eclipse's environment, built through an Eclipse-owned service account, each client isolated for CPNI
HubSpot + Airtable
Existing sources of record
Sync and cleanup layer
Validate, map, dedupe
Central SQL database
Row-level security per tenant
Secure API
Auth, roles, audit on every call
Client Portal
What clients and staff use
Tenant isolation
- Every record (site, circuit, contract, invoice, ticket) carries a tenant ID.
- Each user login is tied to exactly one tenant. Eclipse staff are scoped to their assigned clients.
- Row-level security in the database filters every query, so one customer never sees another's data, even if a URL is changed.
- Denied attempts are written to the audit log with user, IP and time.
CREATE POLICY tenant_isolation ON circuits USING (tenant_id = current_user_tenant());
CPNI controls
Multi-factor authentication
Required for every client and staff login.
Session timeouts
Idle sessions end after 15 minutes.
Encryption
TLS 1.2+ in transit, AES-256 at rest.
Audit logging
Sign-ins, exports, view-as and denials.
Least privilege
Built and deployed through an Eclipse-owned service account with least-privilege access.
Role-based access
Enforced in the API and database.
Role-based access
| Role | Customer views | Billing actions | User management | Internal Reporting | Data Sync | Audit Log |
|---|---|---|---|---|---|---|
| Client Admin | Allowed | Allowed | Allowed | No access | No access | No access |
| Client Viewer | View-only | View-only | No access | No access | No access | No access |
| Eclipse Admin | Allowed | Allowed | Allowed | Allowed | Allowed | Allowed |
| Account Manager | Allowed | Allowed | No access | Allowed | No access | No access |
| Support Agent | View-only | No access | No access | No access | No access | No access |
Support Agent works tickets and messages for all clients. Client Viewers can be limited further by region or site.
Try it
Sign in as Halvorsen, then open a Meridian circuit link to see isolation in action.