Multi Tenant Architecture

3. Data Isolation (Supabase RLS)

• Every table in Supabase must have a tenant_id column.
• Row Level Security (RLS) must be STRICT. Ensure that queries automatically filter by the active tenant_id.
• Never allow a Parish Admin from Church A to see or edit data from Church B.

4. Asset Management

• Logos and images must be fetched from Supabase Storage grouped by tenant_id.
• Use generic fallbacks if a tenant is missing a specific image.38:["$","$L3f",null,{"content":"$40","frontMatter":{"name":"multi-tenant-architecture","description":"Guidelines for building a white-label, multi-tenant church platform using Next.js App Router, Middleware, and Supabase RLS. Use when setting up subdomains, dynamic theming, or tenant isolation."}}]