An isolated database, one per app.
Each app gets its OWN least-privilege Postgres database (proj_<name>) — it can never see another app's data, and never the platform's.