Tenant data is stored in the home region you are provisioned in and is not moved out of it unless you ask. There is no shared pool where one customer's records sit next to another's by accident.
Isolation is enforced in the data layer itself. Every envelope and every row carries a reseller_id and a tenant_id, and the database refuses to return rows that do not match the caller's tenancy. The wall is structural, not a filter we remember to apply, so a query can only ever see one tenant's data.
Every action a Fibric operator takes also writes an attributable, reversible receipt, so you can read exactly what happened, in which region, on whose behalf. Real data only goes in, and a placeholder is never allowed to pass as a governed metric.
For the full picture, including how trust fails closed and how receipts work, read the trust page.