Multi-Tenant Help Centers Need Privacy Controls That Outlast Search Vendor Swaps

A help-center answer must never cite material from another tenant, even when the underlying search backend is being replaced. The article recommends a staged retrieval design with explicit collections, bounded queries, and traceable source context, with tenant rules kept in the application contract so authorization logic survives a vendor change. Each retrieval unit would carry tenant, document, version, and access metadata, with the tenant filter drawn from the authenticated request rather than the user's question. Ingestion, querying, and citation are treated as separate observable stages, and missing citations or tenant mismatches are flagged as policy violations to be paged on. The piece also promotes Infrai as a possible adapter candidate offering a single REST API and key, though it presents this as one option among several.