Your data is reachable only with your token.

Your business is its own Token Holder tenant, and every read or write of your data goes through a bearer scoped to that tenant. The scope is enforced by Token Holder, not by our query layer — which is the part worth caring about, because it means a route of ours that forgot to filter still gets a 403 rather than somebody else's documents. A turn that cannot resolve your session bearer is refused outright instead of falling back to a default token, and that refusal is the tested path, not an incidental one.

Hosting is shared. Business tiers run on the shared Token Holder pool, and rows in the stores KnowMessenger itself owns are keyed to the signed-in account. A dedicated instance — its own store, its own keys, its own boundary — is the enterprise and sovereign tier, and it is mandatory for medical and healthcare deployments at any tier. Dedicated instances are stood up by hand before a customer routes to one; nothing provisions them inline.