> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cyberopsource.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Client Isolation

> How Compliance OS separates client contexts and prevents cross-client access.

# Client Isolation

Client isolation is a foundational Compliance OS design requirement.

The platform is intended to prevent a valid user for one client from using that identity to access another client's data simply by changing a URL, identifier, or request.

## Multiple checks work together

Isolation is not based on one field.

At a high level, Compliance OS can verify:

* the client-specific portal or host being accessed,
* the authenticated user identity,
* the user's authorized client membership,
* active account status,
* engagement access,
* application permissions,
* publication audience,
* assignment or ownership when applicable.

## Hostname context

Client Portal addresses identify the client environment a user is attempting to enter. The portal resolves that client context and verifies that the authenticated account is permitted to use it.

A user should not gain access to another client by manually changing the host name.

## Engagement boundaries

Client membership can still be broader than engagement participation. Engagement-scoped access allows the system to restrict a user to only the engagements in which they are involved.

## Published data boundaries

Even within a valid client and engagement, client-facing applications operate on authorized client-safe information. Internal Cyber Op Source working data is not automatically visible.

## Defense in depth

The Client Portal is only one part of the boundary. Each application validates its own requests rather than assuming that navigation from the portal proves authorization.

This layered approach reduces reliance on a single routing decision.

## What users should do

If you ever see information that appears to belong to another organization or engagement:

1. stop interacting with the content,
2. do not download, copy, or redistribute it,
3. sign out,
4. report the issue to Cyber Op Source immediately.