How your data is kept separate

Every record in GIG belongs to exactly one organization, and every read and write is checked against your membership of that organization — in the application and in the database itself.

That second check is the one that matters. Even a request that got past the app is refused by the database, because the database independently decides what your account is allowed to see.