Draft under legal review before launch.
Isolation
A separate database and database user for every company.
Backups
A daily backup kept with a provider other than the server provider.
Protection
The site sits behind Cloudflare, connections are encrypted (https) and the sign-in screen is protected.
Sign-in
One device per user, with optional two-step verification.