Layer 1 — Data

Where state lives. One database per organization, distributed across multiple Postgres instances — smaller orgs share an instance, larger orgs run on dedicated ones — plus a separate platform instance holding the tenant catalog and cross-tenant data (users, auth, membership). Every instance is replicated (primary + replica) for reliability.

Layer 1's contract upward is simple: given a tenant identifier, return a connection to that tenant's database.

Detailed schema, instance topology, and tenant-routing design will live under this section.