# Tenancy and identity in a data product

URL: /products/data/tenancy-and-identity · Id: `page:products/data/tenancy-and-identity`

> The Dataset is shared and each customer's use is its own: keys, usage, saved queries and downloads live in the customer's Tenant, apart from every other.

A [Dataset](/business/nouns/dataset)'s records are the same for every buyer; what each buyer does with them is its own. Keys, usage, saved queries and downloads live in the buyer's [Tenant](/business/nouns/tenant).

## Shared records, private use
| Record | Belongs to | Who sees it |
| --- | --- | --- |
| The Dataset's records and their provenance | The [Startup](/business/nouns/startup) | Every buyer whose license covers them |
| Keys, usage and the request log | The buyer's Tenant | The buyer and the Startup |
| Saved queries, exports and their schedules | The buyer's Tenant | The buyer |

## Keys and planes
| | As your customer | As the builder |
| --- | --- | --- |
| Host | `api.ratebook.dev` | `api.sb/ratebook.dev` |
| Package | `ratebook` | `startup-builder` |
| Key | `ratebook_sk_live_…`, issued in the [Portal](/business/nouns/portal) | The builder's own key |
| Reaches | Lookups, its usage, its exports | The Dataset, its [Sources](/business/nouns/source), every Tenant's usage |

A `test` key reads synthetic records only, so a buyer's tests never draw down its allowance or leak the real Dataset. [Your customers' API keys](/products/api/customer-keys) covers issuing, rolling and revoking keys.

## Agents as buyers
A buyer's agent calls with its principal's key or pays from its own [Mandate](/business/nouns/mandate). Every call records `by` the agent and `for` the buyer, so usage and receipts reach the party that pays.

## People in the records
When the records are about people, the [data broker rules](/systems/legal-and-corporate/floor/data-broker) apply. A person who asks to be removed leaves the next delivery, and each buyer's next file carries the removal.