We employ a number of industry standard processes at both the application and database levels to ensure the separation of client data within what is a multi-tenant system.  In particular client access to data relies on short lived access tokens which encode the account ID the client has access to; this account ID must match the account ID of any returned records at every stage of processing and where it does not the data cannot be returned to the client.