Tenant data is scoped to your account by the database. Keys with privileges never reach the browser.