# Tenants

> A tenant is one client: its own host, its own data, isolated by row-level security.

A **tenant** is one client of LightHouse: its own address, its own people, keys and settings, and its own data, kept apart from every other tenant’s by row-level security in the database.

## The tenant ID

Every tenant has a **tenant ID**: `t-` followed by ten characters. The characters are lower-case letters and digits, without the ones that are easily misread (`0` and `o`; `1`, `i` and `l`), so an ID read aloud or copied by hand survives. The ID is random. It never names the client, because a hostname is public: it shows up in DNS records, certificates, browser history and screenshots.

Atlantic generates the ID when the tenant is created. Nobody chooses it. Atlantic can replace it, which is audited; the old ID then never answers again.

## The tenant’s address

Your tenant lives at `https://<tenant id>.atlanticagenticlabs.com`: the portal, the [API](/api/) and the [MCP server](/mcp/) all answer there. You start at `platform.atlanticagenticlabs.com`, enter your tenant ID, and are sent to your tenant’s address to sign in.

The tenant comes from the address and only from there. No header or parameter can name another tenant, and a key belongs to the tenant that issued it: at any other tenant’s address it does not exist (`401`).

## Isolation

Every read and write runs under the tenant’s own scope, and PostgreSQL’s row-level security enforces it underneath: a query that does not filter by tenant is refused as a bug, never answered. See [API security](/security/api/).

## People, roles and keys

- **People** sign in through your own identity provider (Microsoft Entra ID, Google, Okta, GitHub, GitLab, or any SAML or OIDC provider), and must prove a second factor. Who may sign in, and with which role, is your tenant’s **access rules** (**Settings → Users and roles**).
- **Roles** are cumulative: `viewer`, `content_viewer`, `handler`, `client_admin`. Beside them, `billing` lets a viewer run the tenant’s payments. See [Roles](/api/roles/).
- **Machine keys** let your own tools read the API and MCP. A key is `viewer` or `content_viewer`, never more. See [Authentication](/api/authentication/).
- **Atlantic staff** hold `viewer` on every tenant, and `content_viewer` only where your access rules say so. They never administer your tenant. See [Who can see what](/data-sovereignty/access/).

## States

| State       | Sign-in | Notes                                                                                                                       |
| ----------- | ------- | --------------------------------------------------------------------------------------------------------------------------- |
| `sandbox`   | Yes     | A tenant made by self-serve sign-up. It can read and set up, and cannot spend until a payment method or invoice terms exist |
| `active`    | Yes     |                                                                                                                             |
| `suspended` | No      | Sign-in and reads are off; deployments’ telemetry still arrives. See [Suspension](/operations/suspension/)                  |

## In the API

`GET /api/v1/me` returns your tenant (`client.tenant_id`, `client.hostname`, `client.portal_url`), who you are and your role. See [Me](/api/reference/people-and-preferences/#me).

Source: https://docs.atlanticagenticlabs.com/concepts/tenants/