Is one client's data separated from another's?

Yes. Every client has its own certificate authority, its own directory connection and its own log. A certificate issued for one client doesn't work on another client's network. There's nothing to set up and nothing you can turn off by mistake.

The separation is built into how Passbeam stores data, not left to each part of the code, and an automated test stops a new table being added without it.