Core concepts

The top-level tenant. Every customer of yours is a website inside one organization. Postgres RLS guarantees no row leaks across organizations.

A website has one primary domain and zero or more additional domains (subdomains, staging). The consent loader is bound to a website id, not to a domain — so subdomains share the visitor's decision.

One banner_config row per website. Many banner_translations rows, one per language. The banner version is bumped atomically on publish; every consent event records the version that was active.

Per-region instructions: should the banner show, and what Consent Mode defaults apply? The strictest rule wins until a server-side geo lookup is added (Phase 6).

The Google Consent Mode v2 state matrix (ad_storage, analytics_storage, ad_user_data, ad_personalization, functionality_storage, personalization_storage, security_storage) is the contract between the banner and Google tags.