Every ComplianceReport carries a tenantId that ties it to the organization it belongs to. This is the field that enforces multi-tenant isolation: a report created under one tenant is never visible to another. You rarely set tenantId by hand — it is derived from your authenticated session when the report is created — but it underpins every list and lookup, ensuring that the compliance reports you see are only those belonging to your own organization. It also drives the indexes used to filter reports by type, status, and due date within a tenant.
Technical section
Data model, API, and internals — visible to developers.