Your records, in your own database.
Every organisation on Backbone holds its own database rather than a partition of somebody else's. Your data has a boundary you can point at, a backup you can take, and an export you can leave with.
Separate, not partitioned
A tenant's records live in a database of their own, so the boundary is a boundary rather than a filter somebody has to get right.