One client can never see another. Try it yourself.
A working engagement platform, built for Sue Foster in response to her post. Every button in it sends a real request to a real database.
Not an error. Not a warning. An empty result. Those rows sit a few centimetres away on the same disk, and this account cannot tell that they exist.
“I asked for the security clearance sponsorship I was promised at offer stage. Eighteen months in, still nothing, and it is blocking every interesting project.”
One value changed in one address. No tools, no password, no skill. That is the whole attack, and it is the most common way software built from a prompt gives one client another client’s staff by name. Both results are real, and you produce them yourself by pressing a button.
Produce both of those yourself
Three minutes, and no sign up. Start with the first card.
One click, no sign up. Every account uses the password MedenaDemo2026 if you would rather type it yourself.
- 01Sign in as Northgate
You will see one company's engagement results, including what their employees wrote.
- 02Open the separation test
Press one button. It tries to read the other company's data, and the database refuses.
- 03Switch to prototype mode
Press the same button again. This time it works, and you see the other company's staff by name.
Also waiting inside
- An oversight portal
Every client and every programme in one view, with the ability to drop into a client's results exactly as they see them.
- Erasure that finishes the job
Delete a person and watch them vanish from every table, including the second copy reporting tools leave behind.
- A log nothing can rewrite
Consequential actions are recorded where no account, including the application itself, holds permission to change them.
Before you go further
This is not a Medena product and I do not work for Medena. I am Rees Calder. I read your post, guessed at what you are building, and spent a day building the part that is hardest to get right.
Every company, person, score and comment in it is invented. I have borrowed your typeface and colours so you can picture it as yours. Nothing here is owed and nothing is expected.
Your five points, and which ones I have not done