Remove tenant service pattern

Signed-off-by: Bryan Frimin <bryan@probo.com>
2026-05-20 16:18:23 -07:00
parent 30db98455d
commit 3e4a9be7c0
89 changed files with 3510 additions and 3031 deletions
--- a/pkg/trust/audit_service.go
+++ b/pkg/trust/audit_service.go
@@ -25,11 +25,12 @@ import (
 )

 type AuditService struct {
-	svc *TenantService
+	svc *Service
 }

 func (s AuditService) Get(
 	ctx context.Context,
+	scope coredata.Scoper,
 	auditID gid.GID,
 ) (*coredata.Audit, error) {
 	audit := &coredata.Audit{}
@@ -37,7 +38,7 @@ func (s AuditService) Get(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			err := audit.LoadByID(ctx, conn, s.svc.scope, auditID)
+			err := audit.LoadByID(ctx, conn, scope, auditID)
 			if err != nil {
 				return fmt.Errorf("cannot load audit: %w", err)
 			}
@@ -54,6 +55,7 @@ func (s AuditService) Get(

 func (s AuditService) GetByReportID(
 	ctx context.Context,
+	scope coredata.Scoper,
 	reportID gid.GID,
 ) (*coredata.Audit, error) {
 	audit := &coredata.Audit{}
@@ -61,7 +63,7 @@ func (s AuditService) GetByReportID(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			err := audit.LoadByReportID(ctx, conn, s.svc.scope, reportID)
+			err := audit.LoadByReportID(ctx, conn, scope, reportID)
 			if err != nil {
 				return fmt.Errorf("cannot load audit: %w", err)
 			}
@@ -78,6 +80,7 @@ func (s AuditService) GetByReportID(

 func (s AuditService) ListForOrganizationId(
 	ctx context.Context,
+	scope coredata.Scoper,
 	organizationID gid.GID,
 	cursor *page.Cursor[coredata.AuditOrderField],
 ) (*page.Page[*coredata.Audit, coredata.AuditOrderField], error) {
@@ -88,7 +91,7 @@ func (s AuditService) ListForOrganizationId(
 		func(ctx context.Context, conn pg.Querier) error {
 			filter := coredata.NewAuditTrustCenterFilter()

-			err := audits.LoadByOrganizationID(ctx, conn, s.svc.scope, organizationID, cursor, filter)
+			err := audits.LoadByOrganizationID(ctx, conn, scope, organizationID, cursor, filter)
 			if err != nil {
 				return fmt.Errorf("cannot load audits: %w", err)
 			}
--- a/pkg/trust/compliance_external_url_service.go
+++ b/pkg/trust/compliance_external_url_service.go
@@ -25,11 +25,12 @@ import (
 )

 type ComplianceExternalURLService struct {
-	svc *TenantService
+	svc *Service
 }

 func (s ComplianceExternalURLService) ListForTrustCenterID(
 	ctx context.Context,
+	scope coredata.Scoper,
 	trustCenterID gid.GID,
 	cursor *page.Cursor[coredata.ComplianceExternalURLOrderField],
 ) (*page.Page[*coredata.ComplianceExternalURL, coredata.ComplianceExternalURLOrderField], error) {
@@ -38,7 +39,7 @@ func (s ComplianceExternalURLService) ListForTrustCenterID(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			err := items.LoadByTrustCenterID(ctx, conn, s.svc.scope, trustCenterID, cursor)
+			err := items.LoadByTrustCenterID(ctx, conn, scope, trustCenterID, cursor)
 			if err != nil {
 				return fmt.Errorf("cannot load compliance external URLs: %w", err)
 			}
--- a/pkg/trust/compliance_framework_service.go
+++ b/pkg/trust/compliance_framework_service.go
@@ -25,11 +25,12 @@ import (
 )

 type ComplianceFrameworkService struct {
-	svc *TenantService
+	svc *Service
 }

 func (s ComplianceFrameworkService) ListByTrustCenterID(
 	ctx context.Context,
+	scope coredata.Scoper,
 	trustCenterID gid.GID,
 	cursor *page.Cursor[coredata.ComplianceFrameworkOrderField],
 ) (*page.Page[*coredata.ComplianceFramework, coredata.ComplianceFrameworkOrderField], error) {
@@ -38,7 +39,7 @@ func (s ComplianceFrameworkService) ListByTrustCenterID(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			err := complianceFrameworks.LoadByTrustCenterID(ctx, conn, s.svc.scope, trustCenterID, cursor)
+			err := complianceFrameworks.LoadByTrustCenterID(ctx, conn, scope, trustCenterID, cursor)
 			if err != nil {
 				return fmt.Errorf("cannot load compliance frameworks: %w", err)
 			}
--- a/pkg/trust/compliance_page_service.go
+++ b/pkg/trust/compliance_page_service.go
@@ -117,15 +117,13 @@ func (s *Service) RenderCompliancePageMarkdown(
 	ctx context.Context,
 	w io.Writer,
 	trustCenterID gid.GID,
-	tenantID gid.TenantID,
+	scope coredata.Scoper,
 ) error {
 	org, err := s.GetOrganizationByTrustCenterID(ctx, trustCenterID)
 	if err != nil {
 		return fmt.Errorf("cannot load organization for compliance page: %w", err)
 	}

-	tenantSvc := s.WithTenant(tenantID)
-
 	data := &compliancePageData{
 		OrgName: org.Name,
 	}
@@ -146,32 +144,32 @@ func (s *Service) RenderCompliancePageMarkdown(
 		data.Details = append(data.Details, compliancePageDetail{Label: "Headquarters", Value: *org.HeadquarterAddress})
 	}

-	data.Frameworks, err = s.fetchComplianceFrameworks(ctx, tenantSvc, trustCenterID)
+	data.Frameworks, err = s.fetchComplianceFrameworks(ctx, scope, trustCenterID)
 	if err != nil {
 		return fmt.Errorf("cannot fetch compliance frameworks: %w", err)
 	}

-	data.Documents, err = s.fetchDocuments(ctx, tenantSvc, org.ID)
+	data.Documents, err = s.fetchDocuments(ctx, scope, org.ID)
 	if err != nil {
 		return fmt.Errorf("cannot fetch documents: %w", err)
 	}

-	data.Audits, err = s.fetchAudits(ctx, tenantSvc, org.ID)
+	data.Audits, err = s.fetchAudits(ctx, scope, org.ID)
 	if err != nil {
 		return fmt.Errorf("cannot fetch audits: %w", err)
 	}

-	data.ThirdParties, err = s.fetchThirdParties(ctx, tenantSvc, org.ID)
+	data.ThirdParties, err = s.fetchThirdParties(ctx, scope, org.ID)
 	if err != nil {
 		return fmt.Errorf("cannot fetch thirdParties: %w", err)
 	}

-	data.References, err = s.fetchReferences(ctx, tenantSvc, trustCenterID)
+	data.References, err = s.fetchReferences(ctx, scope, trustCenterID)
 	if err != nil {
 		return fmt.Errorf("cannot fetch references: %w", err)
 	}

-	data.ExternalLinks, err = s.fetchExternalLinks(ctx, tenantSvc, trustCenterID)
+	data.ExternalLinks, err = s.fetchExternalLinks(ctx, scope, trustCenterID)
 	if err != nil {
 		return fmt.Errorf("cannot fetch external links: %w", err)
 	}
@@ -199,7 +197,7 @@ func (s *Service) RenderSitemap(
 	ctx context.Context,
 	w io.Writer,
 	trustCenterID gid.GID,
-	tenantID gid.TenantID,
+	scope coredata.Scoper,
 	baseURL string,
 ) error {
 	org, err := s.GetOrganizationByTrustCenterID(ctx, trustCenterID)
@@ -207,13 +205,11 @@ func (s *Service) RenderSitemap(
 		return fmt.Errorf("cannot load organization for sitemap: %w", err)
 	}

-	tenantSvc := s.WithTenant(tenantID)
-
 	data := &sitemapData{
 		BaseURL: baseURL,
 	}

-	data.Documents, err = s.fetchDocumentIDs(ctx, tenantSvc, org.ID)
+	data.Documents, err = s.fetchDocumentIDs(ctx, scope, org.ID)
 	if err != nil {
 		return fmt.Errorf("cannot fetch document IDs for sitemap: %w", err)
 	}
@@ -243,7 +239,7 @@ func (s *Service) RenderRobotsTxt(
 	return nil
 }

-func (s *Service) fetchDocumentIDs(ctx context.Context, tenantSvc *TenantService, orgID gid.GID) ([]string, error) {
+func (s *Service) fetchDocumentIDs(ctx context.Context, scope coredata.Scoper, orgID gid.GID) ([]string, error) {
 	var ids []string

 	var cursorKey *page.CursorKey
@@ -258,7 +254,7 @@ func (s *Service) fetchDocumentIDs(ctx context.Context, tenantSvc *TenantService
 			},
 		)

-		result, err := tenantSvc.Documents.ListForOrganizationId(ctx, orgID, cursor)
+		result, err := s.Documents.ListForOrganizationId(ctx, scope, orgID, cursor)
 		if err != nil {
 			return nil, fmt.Errorf("cannot list documents: %w", err)
 		}
@@ -283,7 +279,7 @@ func (s *Service) fetchDocumentIDs(ctx context.Context, tenantSvc *TenantService
 	return ids, nil
 }

-func (s *Service) fetchComplianceFrameworks(ctx context.Context, tenantSvc *TenantService, trustCenterID gid.GID) ([]compliancePageFramework, error) {
+func (s *Service) fetchComplianceFrameworks(ctx context.Context, scope coredata.Scoper, trustCenterID gid.GID) ([]compliancePageFramework, error) {
 	var frameworks []compliancePageFramework

 	var cursorKey *page.CursorKey
@@ -298,7 +294,7 @@ func (s *Service) fetchComplianceFrameworks(ctx context.Context, tenantSvc *Tena
 			},
 		)

-		result, err := tenantSvc.ComplianceFrameworks.ListByTrustCenterID(ctx, trustCenterID, cursor)
+		result, err := s.ComplianceFrameworks.ListByTrustCenterID(ctx, scope, trustCenterID, cursor)
 		if err != nil {
 			return nil, fmt.Errorf("cannot list compliance frameworks: %w", err)
 		}
@@ -308,7 +304,7 @@ func (s *Service) fetchComplianceFrameworks(ctx context.Context, tenantSvc *Tena
 				continue
 			}

-			fw, err := tenantSvc.Frameworks.Get(ctx, cf.FrameworkID)
+			fw, err := s.Frameworks.Get(ctx, scope, cf.FrameworkID)
 			if err != nil {
 				return nil, fmt.Errorf("cannot get framework %s: %w", cf.FrameworkID, err)
 			}
@@ -333,7 +329,7 @@ func (s *Service) fetchComplianceFrameworks(ctx context.Context, tenantSvc *Tena
 	return frameworks, nil
 }

-func (s *Service) fetchDocuments(ctx context.Context, tenantSvc *TenantService, orgID gid.GID) ([]compliancePageDocument, error) {
+func (s *Service) fetchDocuments(ctx context.Context, scope coredata.Scoper, orgID gid.GID) ([]compliancePageDocument, error) {
 	var docs []compliancePageDocument

 	var cursorKey *page.CursorKey
@@ -348,7 +344,7 @@ func (s *Service) fetchDocuments(ctx context.Context, tenantSvc *TenantService,
 			},
 		)

-		result, err := tenantSvc.Documents.ListForOrganizationId(ctx, orgID, cursor)
+		result, err := s.Documents.ListForOrganizationId(ctx, scope, orgID, cursor)
 		if err != nil {
 			return nil, fmt.Errorf("cannot list documents: %w", err)
 		}
@@ -379,7 +375,7 @@ func (s *Service) fetchDocuments(ctx context.Context, tenantSvc *TenantService,
 	return docs, nil
 }

-func (s *Service) fetchAudits(ctx context.Context, tenantSvc *TenantService, orgID gid.GID) ([]compliancePageAudit, error) {
+func (s *Service) fetchAudits(ctx context.Context, scope coredata.Scoper, orgID gid.GID) ([]compliancePageAudit, error) {
 	var audits []compliancePageAudit

 	var cursorKey *page.CursorKey
@@ -394,7 +390,7 @@ func (s *Service) fetchAudits(ctx context.Context, tenantSvc *TenantService, org
 			},
 		)

-		result, err := tenantSvc.Audits.ListForOrganizationId(ctx, orgID, cursor)
+		result, err := s.Audits.ListForOrganizationId(ctx, scope, orgID, cursor)
 		if err != nil {
 			return nil, fmt.Errorf("cannot list audits: %w", err)
 		}
@@ -406,7 +402,7 @@ func (s *Service) fetchAudits(ctx context.Context, tenantSvc *TenantService, org

 			frameworkName := ""

-			fw, err := tenantSvc.Frameworks.Get(ctx, audit.FrameworkID)
+			fw, err := s.Frameworks.Get(ctx, scope, audit.FrameworkID)
 			if err == nil {
 				frameworkName = fw.Name
 			}
@@ -438,7 +434,7 @@ func (s *Service) fetchAudits(ctx context.Context, tenantSvc *TenantService, org
 	return audits, nil
 }

-func (s *Service) fetchThirdParties(ctx context.Context, tenantSvc *TenantService, orgID gid.GID) ([]compliancePageThirdParty, error) {
+func (s *Service) fetchThirdParties(ctx context.Context, scope coredata.Scoper, orgID gid.GID) ([]compliancePageThirdParty, error) {
 	var thirdParties []compliancePageThirdParty

 	var cursorKey *page.CursorKey
@@ -453,7 +449,7 @@ func (s *Service) fetchThirdParties(ctx context.Context, tenantSvc *TenantServic
 			},
 		)

-		result, err := tenantSvc.ThirdParties.ListForOrganizationId(ctx, orgID, cursor)
+		result, err := s.ThirdParties.ListForOrganizationId(ctx, scope, orgID, cursor)
 		if err != nil {
 			return nil, fmt.Errorf("cannot list thirdParties: %w", err)
 		}
@@ -487,7 +483,7 @@ func (s *Service) fetchThirdParties(ctx context.Context, tenantSvc *TenantServic
 	return thirdParties, nil
 }

-func (s *Service) fetchReferences(ctx context.Context, tenantSvc *TenantService, trustCenterID gid.GID) ([]compliancePageReference, error) {
+func (s *Service) fetchReferences(ctx context.Context, scope coredata.Scoper, trustCenterID gid.GID) ([]compliancePageReference, error) {
 	var refs []compliancePageReference

 	var cursorKey *page.CursorKey
@@ -502,7 +498,7 @@ func (s *Service) fetchReferences(ctx context.Context, tenantSvc *TenantService,
 			},
 		)

-		result, err := tenantSvc.TrustCenterReferences.ListForTrustCenterID(ctx, trustCenterID, cursor)
+		result, err := s.TrustCenterReferences.ListForTrustCenterID(ctx, scope, trustCenterID, cursor)
 		if err != nil {
 			return nil, fmt.Errorf("cannot list references: %w", err)
 		}
@@ -531,7 +527,7 @@ func (s *Service) fetchReferences(ctx context.Context, tenantSvc *TenantService,
 	return refs, nil
 }

-func (s *Service) fetchExternalLinks(ctx context.Context, tenantSvc *TenantService, trustCenterID gid.GID) ([]compliancePageExternalLink, error) {
+func (s *Service) fetchExternalLinks(ctx context.Context, scope coredata.Scoper, trustCenterID gid.GID) ([]compliancePageExternalLink, error) {
 	var links []compliancePageExternalLink

 	var cursorKey *page.CursorKey
@@ -546,7 +542,7 @@ func (s *Service) fetchExternalLinks(ctx context.Context, tenantSvc *TenantServi
 			},
 		)

-		result, err := tenantSvc.ComplianceExternalURLs.ListForTrustCenterID(ctx, trustCenterID, cursor)
+		result, err := s.ComplianceExternalURLs.ListForTrustCenterID(ctx, scope, trustCenterID, cursor)
 		if err != nil {
 			return nil, fmt.Errorf("cannot list external links: %w", err)
 		}
--- a/pkg/trust/document_service.go
+++ b/pkg/trust/document_service.go
@@ -33,7 +33,7 @@ import (

 type (
 	DocumentService struct {
-		svc               *TenantService
+		svc               *Service
 		html2pdfConverter *html2pdf.Converter
 	}

@@ -46,6 +46,7 @@ func (e ErrDocumentArchived) Error() string {

 func (s *DocumentService) ListForOrganizationId(
 	ctx context.Context,
+	scope coredata.Scoper,
 	organizationID gid.GID,
 	cursor *page.Cursor[coredata.DocumentOrderField],
 ) (*page.Page[*coredata.Document, coredata.DocumentOrderField], error) {
@@ -56,7 +57,7 @@ func (s *DocumentService) ListForOrganizationId(
 		func(ctx context.Context, conn pg.Querier) error {
 			filter := coredata.NewDocumentTrustCenterFilter()

-			if err := documents.LoadPublishedByOrganizationID(ctx, conn, s.svc.scope, organizationID, cursor, filter); err != nil {
+			if err := documents.LoadPublishedByOrganizationID(ctx, conn, scope, organizationID, cursor, filter); err != nil {
 				return fmt.Errorf("cannot load published documents: %w", err)
 			}

@@ -72,10 +73,11 @@ func (s *DocumentService) ListForOrganizationId(

 func (s *DocumentService) ExportPDF(
 	ctx context.Context,
+	scope coredata.Scoper,
 	documentID gid.GID,
 	email mail.Addr,
 ) ([]byte, error) {
-	pdfData, err := s.exportPDFData(ctx, documentID)
+	pdfData, err := s.exportPDFData(ctx, scope, documentID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot export document PDF: %w", err)
 	}
@@ -90,13 +92,15 @@ func (s *DocumentService) ExportPDF(

 func (s *DocumentService) ExportPDFWithoutWatermark(
 	ctx context.Context,
+	scope coredata.Scoper,
 	documentID gid.GID,
 ) ([]byte, error) {
-	return s.exportPDFData(ctx, documentID)
+	return s.exportPDFData(ctx, scope, documentID)
 }

 func (s DocumentService) Get(
 	ctx context.Context,
+	scope coredata.Scoper,
 	organizationID gid.GID,
 	documentID gid.GID,
 ) (*coredata.Document, error) {
@@ -105,7 +109,7 @@ func (s DocumentService) Get(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			err := document.LoadByID(ctx, conn, s.svc.scope, documentID)
+			err := document.LoadByID(ctx, conn, scope, documentID)
 			if err != nil {
 				return fmt.Errorf("cannot load document: %w", err)
 			}
@@ -134,6 +138,7 @@ func (s DocumentService) Get(

 func (s *DocumentService) exportPDFData(
 	ctx context.Context,
+	scope coredata.Scoper,
 	documentID gid.GID,
 ) ([]byte, error) {
 	document := &coredata.Document{}
@@ -143,7 +148,7 @@ func (s *DocumentService) exportPDFData(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			if err := document.LoadByID(ctx, conn, s.svc.scope, documentID); err != nil {
+			if err := document.LoadByID(ctx, conn, scope, documentID); err != nil {
 				return fmt.Errorf("cannot load document: %w", err)
 			}

@@ -155,7 +160,7 @@ func (s *DocumentService) exportPDFData(
 				return fmt.Errorf("document not visible on trust center")
 			}

-			if err := version.LoadLatestPublishedVersion(ctx, conn, s.svc.scope, documentID); err != nil {
+			if err := version.LoadLatestPublishedVersion(ctx, conn, scope, documentID); err != nil {
 				return fmt.Errorf("cannot load latest published document version: %w", err)
 			}

@@ -163,7 +168,7 @@ func (s *DocumentService) exportPDFData(
 				return nil
 			}

-			if err := fileRecord.LoadByID(ctx, conn, s.svc.scope, *version.FileID); err != nil {
+			if err := fileRecord.LoadByID(ctx, conn, scope, *version.FileID); err != nil {
 				return fmt.Errorf("cannot load document version file: %w", err)
 			}

@@ -184,7 +189,7 @@ func (s *DocumentService) exportPDFData(
 	}

 	// TODO: remove on-the-fly fallback once all published versions have a stored PDF.
-	pdfData, err := s.generatePDFOnTheFly(ctx, document, version)
+	pdfData, err := s.generatePDFOnTheFly(ctx, scope, document, version)
 	if err != nil {
 		return nil, fmt.Errorf("cannot generate PDF on the fly: %w", err)
 	}
@@ -197,6 +202,7 @@ func (s *DocumentService) exportPDFData(
 // processed by the document PDF worker.
 func (s *DocumentService) generatePDFOnTheFly(
 	ctx context.Context,
+	scope coredata.Scoper,
 	document *coredata.Document,
 	version *coredata.DocumentVersion,
 ) ([]byte, error) {
@@ -208,7 +214,7 @@ func (s *DocumentService) generatePDFOnTheFly(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
 			lastQuorum := &coredata.DocumentVersionApprovalQuorum{}
-			if err := lastQuorum.LoadLastByDocumentVersionID(ctx, conn, s.svc.scope, version.ID); err != nil {
+			if err := lastQuorum.LoadLastByDocumentVersionID(ctx, conn, scope, version.ID); err != nil {
 				if !errors.Is(err, coredata.ErrResourceNotFound) {
 					return fmt.Errorf("cannot load last approval quorum: %w", err)
 				}
@@ -221,7 +227,7 @@ func (s *DocumentService) generatePDFOnTheFly(
 				if err := approvedDecisions.LoadByQuorumID(
 					ctx,
 					conn,
-					s.svc.scope,
+					scope,
 					lastQuorum.ID,
 					page.NewCursor(
 						100,
@@ -244,7 +250,7 @@ func (s *DocumentService) generatePDFOnTheFly(

 				if len(approverProfileIDs) > 0 {
 					profiles := coredata.MembershipProfiles{}
-					if err := profiles.LoadByIDs(ctx, conn, s.svc.scope, approverProfileIDs); err != nil {
+					if err := profiles.LoadByIDs(ctx, conn, scope, approverProfileIDs); err != nil {
 						return fmt.Errorf("cannot load approver profiles: %w", err)
 					}

@@ -254,7 +260,7 @@ func (s *DocumentService) generatePDFOnTheFly(
 				}
 			}

-			if err := organization.LoadByID(ctx, conn, s.svc.scope, document.OrganizationID); err != nil {
+			if err := organization.LoadByID(ctx, conn, scope, document.OrganizationID); err != nil {
 				return fmt.Errorf("cannot load organization: %w", err)
 			}

@@ -282,7 +288,7 @@ func (s *DocumentService) generatePDFOnTheFly(
 		fileRecord := &coredata.File{}

 		fileErr := s.svc.pg.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
-			return fileRecord.LoadByID(ctx, conn, s.svc.scope, *organization.HorizontalLogoFileID)
+			return fileRecord.LoadByID(ctx, conn, scope, *organization.HorizontalLogoFileID)
 		})
 		if fileErr == nil {
 			base64Data, mimeType, logoErr := s.svc.fileManager.GetFileBase64(ctx, fileRecord)
--- a/pkg/trust/framework_service.go
+++ b/pkg/trust/framework_service.go
@@ -25,17 +25,18 @@ import (
 )

 type FrameworkService struct {
-	svc *TenantService
+	svc *Service
 }

 func (s FrameworkService) Get(
 	ctx context.Context,
+	scope coredata.Scoper,
 	frameworkID gid.GID,
 ) (*coredata.Framework, error) {
 	framework := &coredata.Framework{}

 	err := s.svc.pg.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
-		err := framework.LoadByID(ctx, conn, s.svc.scope, frameworkID)
+		err := framework.LoadByID(ctx, conn, scope, frameworkID)
 		if err != nil {
 			return fmt.Errorf("cannot load framework: %w", err)
 		}
@@ -51,6 +52,7 @@ func (s FrameworkService) Get(

 func (s FrameworkService) GenerateLightLogoURL(
 	ctx context.Context,
+	scope coredata.Scoper,
 	frameworkID gid.GID,
 	expiresIn time.Duration,
 ) (*string, error) {
@@ -60,7 +62,7 @@ func (s FrameworkService) GenerateLightLogoURL(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
 			framework := &coredata.Framework{}
-			if err := framework.LoadByID(ctx, conn, s.svc.scope, frameworkID); err != nil {
+			if err := framework.LoadByID(ctx, conn, scope, frameworkID); err != nil {
 				return fmt.Errorf("cannot load framework: %w", err)
 			}

@@ -68,7 +70,7 @@ func (s FrameworkService) GenerateLightLogoURL(
 				return nil
 			}

-			if err := file.LoadByID(ctx, conn, s.svc.scope, *framework.LightLogoFileID); err != nil {
+			if err := file.LoadByID(ctx, conn, scope, *framework.LightLogoFileID); err != nil {
 				return fmt.Errorf("cannot load file: %w", err)
 			}

@@ -93,6 +95,7 @@ func (s FrameworkService) GenerateLightLogoURL(

 func (s FrameworkService) GenerateDarkLogoURL(
 	ctx context.Context,
+	scope coredata.Scoper,
 	frameworkID gid.GID,
 	expiresIn time.Duration,
 ) (*string, error) {
@@ -102,7 +105,7 @@ func (s FrameworkService) GenerateDarkLogoURL(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
 			framework := &coredata.Framework{}
-			if err := framework.LoadByID(ctx, conn, s.svc.scope, frameworkID); err != nil {
+			if err := framework.LoadByID(ctx, conn, scope, frameworkID); err != nil {
 				return fmt.Errorf("cannot load framework: %w", err)
 			}

@@ -110,7 +113,7 @@ func (s FrameworkService) GenerateDarkLogoURL(
 				return nil
 			}

-			if err := file.LoadByID(ctx, conn, s.svc.scope, *framework.DarkLogoFileID); err != nil {
+			if err := file.LoadByID(ctx, conn, scope, *framework.DarkLogoFileID); err != nil {
 				return fmt.Errorf("cannot load file: %w", err)
 			}

--- a/pkg/trust/organization_service.go
+++ b/pkg/trust/organization_service.go
@@ -27,11 +27,12 @@ import (
 )

 type OrganizationService struct {
-	svc *TenantService
+	svc *Service
 }

 func (s OrganizationService) Get(
 	ctx context.Context,
+	scope coredata.Scoper,
 	organizationID gid.GID,
 ) (*coredata.Organization, error) {
 	organization := &coredata.Organization{}
@@ -42,7 +43,7 @@ func (s OrganizationService) Get(
 			err := organization.LoadByID(
 				ctx,
 				conn,
-				s.svc.scope,
+				scope,
 				organizationID,
 			)
 			if err != nil {
@@ -61,6 +62,7 @@ func (s OrganizationService) Get(

 func (s OrganizationService) GetOrganizationCustomDomain(
 	ctx context.Context,
+	scope coredata.Scoper,
 	organizationID gid.GID,
 ) (*coredata.CustomDomain, error) {
 	var domain *coredata.CustomDomain
@@ -69,7 +71,7 @@ func (s OrganizationService) GetOrganizationCustomDomain(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
 			var org coredata.Organization
-			if err := org.LoadByID(ctx, conn, s.svc.scope, organizationID); err != nil {
+			if err := org.LoadByID(ctx, conn, scope, organizationID); err != nil {
 				return fmt.Errorf("cannot load organization: %w", err)
 			}

@@ -78,7 +80,7 @@ func (s OrganizationService) GetOrganizationCustomDomain(
 			}

 			domain = &coredata.CustomDomain{}
-			if err := domain.LoadByID(ctx, conn, s.svc.scope, *org.CustomDomainID); err != nil {
+			if err := domain.LoadByID(ctx, conn, scope, *org.CustomDomainID); err != nil {
 				return fmt.Errorf("cannot load custom domain: %w", err)
 			}

@@ -94,10 +96,11 @@ func (s OrganizationService) GetOrganizationCustomDomain(

 func (s OrganizationService) GenerateLogoURL(
 	ctx context.Context,
+	scope coredata.Scoper,
 	organizationID gid.GID,
 	expiresIn time.Duration,
 ) (*string, error) {
-	organization, err := s.Get(ctx, organizationID)
+	organization, err := s.Get(ctx, scope, organizationID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot get organization: %w", err)
 	}
@@ -111,7 +114,7 @@ func (s OrganizationService) GenerateLogoURL(
 	err = s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			return file.LoadByID(ctx, conn, s.svc.scope, *organization.LogoFileID)
+			return file.LoadByID(ctx, conn, scope, *organization.LogoFileID)
 		},
 	)
 	if err != nil {
--- a/pkg/trust/report_service.go
+++ b/pkg/trust/report_service.go
@@ -29,15 +29,16 @@ import (
 )

 type ReportService struct {
-	svc *TenantService
+	svc *Service
 }

 func (s ReportService) Get(
 	ctx context.Context,
+	scope coredata.Scoper,
 	organizationID gid.GID,
 	reportID gid.GID,
 ) (*coredata.Report, error) {
-	report, err := s.loadByID(ctx, reportID)
+	report, err := s.loadByID(ctx, scope, reportID)
 	if err != nil {
 		return nil, err
 	}
@@ -51,6 +52,7 @@ func (s ReportService) Get(

 func (s ReportService) loadByID(
 	ctx context.Context,
+	scope coredata.Scoper,
 	reportID gid.GID,
 ) (*coredata.Report, error) {
 	report := &coredata.Report{}
@@ -58,7 +60,7 @@ func (s ReportService) loadByID(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			err := report.LoadByID(ctx, conn, s.svc.scope, reportID)
+			err := report.LoadByID(ctx, conn, scope, reportID)
 			if err != nil {
 				return fmt.Errorf("cannot load report: %w", err)
 			}
@@ -75,10 +77,11 @@ func (s ReportService) loadByID(

 func (s ReportService) GenerateDownloadURL(
 	ctx context.Context,
+	scope coredata.Scoper,
 	reportID gid.GID,
 	expiresIn time.Duration,
 ) (*string, error) {
-	report, err := s.loadByID(ctx, reportID)
+	report, err := s.loadByID(ctx, scope, reportID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot get report: %w", err)
 	}
@@ -103,10 +106,11 @@ func (s ReportService) GenerateDownloadURL(

 func (s ReportService) ExportPDF(
 	ctx context.Context,
+	scope coredata.Scoper,
 	reportID gid.GID,
 	email mail.Addr,
 ) ([]byte, error) {
-	pdfData, err := s.exportPDFData(ctx, reportID)
+	pdfData, err := s.exportPDFData(ctx, scope, reportID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot export report PDF: %w", err)
 	}
@@ -121,16 +125,18 @@ func (s ReportService) ExportPDF(

 func (s ReportService) ExportPDFWithoutWatermark(
 	ctx context.Context,
+	scope coredata.Scoper,
 	reportID gid.GID,
 ) ([]byte, error) {
-	return s.exportPDFData(ctx, reportID)
+	return s.exportPDFData(ctx, scope, reportID)
 }

 func (s ReportService) exportPDFData(
 	ctx context.Context,
+	scope coredata.Scoper,
 	reportID gid.GID,
 ) ([]byte, error) {
-	report, err := s.loadByID(ctx, reportID)
+	report, err := s.loadByID(ctx, scope, reportID)
 	if err != nil {
 		return nil, fmt.Errorf("cannot get report: %w", err)
 	}
--- a/pkg/trust/service.go
+++ b/pkg/trust/service.go
@@ -36,32 +36,18 @@ import (

 type (
 	Service struct {
-		pg                 *pg.Client
-		s3                 *s3.Client
-		bucket             string
-		proboSvc           *probo.Service
-		slackSigningSecret string
-		baseURL            string
-		iam                *iam.Service
-		esign              *esign.Service
-		html2pdfConverter  *html2pdf.Converter
-		fileManager        *filemanager.Service
-		logger             *log.Logger
-		slack              *slack.Service
-	}
-
-	TenantService struct {
 		pg                     *pg.Client
 		s3                     *s3.Client
 		bucket                 string
-		scope                  coredata.Scoper
 		proboSvc               *probo.Service
+		slackSigningSecret     string
 		baseURL                string
 		iam                    *iam.Service
 		esign                  *esign.Service
 		html2pdfConverter      *html2pdf.Converter
 		fileManager            *filemanager.Service
 		logger                 *log.Logger
+		slack                  *slack.Service
 		TrustCenters           *TrustCenterService
 		Documents              *DocumentService
 		Audits                 *AuditService
@@ -74,7 +60,6 @@ type (
 		Reports                *ReportService
 		Organizations          *OrganizationService
 		ComplianceExternalURLs *ComplianceExternalURLService
-		SlackMessages          *slack.SlackMessageService
 	}
 )

@@ -91,7 +76,7 @@ func NewService(
 	logger *log.Logger,
 	slack *slack.Service,
 ) *Service {
-	return &Service{
+	svc := &Service{
 		pg:                 pgClient,
 		s3:                 s3Client,
 		bucket:             bucket,
@@ -104,38 +89,20 @@ func NewService(
 		logger:             logger,
 		slack:              slack,
 	}
-}
+	svc.TrustCenters = &TrustCenterService{svc: svc}
+	svc.Documents = &DocumentService{svc: svc, html2pdfConverter: html2pdfConverter}
+	svc.Audits = &AuditService{svc: svc}
+	svc.ThirdParties = &ThirdPartyService{svc: svc}
+	svc.Frameworks = &FrameworkService{svc: svc}
+	svc.ComplianceFrameworks = &ComplianceFrameworkService{svc: svc}
+	svc.TrustCenterAccesses = &TrustCenterAccessService{svc: svc, iamSvc: iam, logger: logger}
+	svc.TrustCenterReferences = &TrustCenterReferenceService{svc: svc}
+	svc.TrustCenterFiles = &TrustCenterFileService{svc: svc}
+	svc.Reports = &ReportService{svc: svc}
+	svc.Organizations = &OrganizationService{svc: svc}
+	svc.ComplianceExternalURLs = &ComplianceExternalURLService{svc: svc}

-func (s *Service) WithTenant(tenantID gid.TenantID) *TenantService {
-	tenantService := &TenantService{
-		pg:                s.pg,
-		s3:                s.s3,
-		bucket:            s.bucket,
-		scope:             coredata.NewScope(tenantID),
-		proboSvc:          s.proboSvc,
-		baseURL:           s.baseURL,
-		iam:               s.iam,
-		esign:             s.esign,
-		html2pdfConverter: s.html2pdfConverter,
-		fileManager:       s.fileManager,
-		logger:            s.logger,
-	}
-
-	tenantService.TrustCenters = &TrustCenterService{svc: tenantService}
-	tenantService.Documents = &DocumentService{svc: tenantService, html2pdfConverter: s.html2pdfConverter}
-	tenantService.Audits = &AuditService{svc: tenantService}
-	tenantService.ThirdParties = &ThirdPartyService{svc: tenantService}
-	tenantService.Frameworks = &FrameworkService{svc: tenantService}
-	tenantService.ComplianceFrameworks = &ComplianceFrameworkService{svc: tenantService}
-	tenantService.TrustCenterAccesses = &TrustCenterAccessService{svc: tenantService, iamSvc: s.iam, logger: s.logger}
-	tenantService.TrustCenterReferences = &TrustCenterReferenceService{svc: tenantService}
-	tenantService.TrustCenterFiles = &TrustCenterFileService{svc: tenantService}
-	tenantService.Reports = &ReportService{svc: tenantService}
-	tenantService.Organizations = &OrganizationService{svc: tenantService}
-	tenantService.ComplianceExternalURLs = &ComplianceExternalURLService{svc: tenantService}
-	tenantService.SlackMessages = s.slack.WithTenant(tenantID).SlackMessages
-
-	return tenantService
+	return svc
 }

 func (s *Service) Get(
@@ -272,7 +239,7 @@ func (s *Service) EmailPresenterConfigByOrganizationID(ctx context.Context, orgI
 		return emails.PresenterConfig{}, fmt.Errorf("cannot load trust center for org %s: %w", orgID, err)
 	}

-	return s.WithTenant(orgID.TenantID()).TrustCenters.EmailPresenterConfig(ctx, trustCenter.ID)
+	return s.TrustCenters.EmailPresenterConfig(ctx, scope, trustCenter.ID)
 }

 func (s *Service) GetOrganizationByTrustCenterID(
--- a/pkg/trust/third_party_service.go
+++ b/pkg/trust/third_party_service.go
@@ -25,11 +25,12 @@ import (
 )

 type ThirdPartyService struct {
-	svc *TenantService
+	svc *Service
 }

 func (s ThirdPartyService) Get(
 	ctx context.Context,
+	scope coredata.Scoper,
 	thirdPartyID gid.GID,
 ) (*coredata.ThirdParty, error) {
 	thirdParty := &coredata.ThirdParty{}
@@ -37,7 +38,7 @@ func (s ThirdPartyService) Get(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			err := thirdParty.LoadByID(ctx, conn, s.svc.scope, thirdPartyID)
+			err := thirdParty.LoadByID(ctx, conn, scope, thirdPartyID)
 			if err != nil {
 				return fmt.Errorf("cannot load thirdParty: %w", err)
 			}
@@ -54,6 +55,7 @@ func (s ThirdPartyService) Get(

 func (s ThirdPartyService) ListForOrganizationId(
 	ctx context.Context,
+	scope coredata.Scoper,
 	organizationID gid.GID,
 	cursor *page.Cursor[coredata.ThirdPartyOrderField],
 ) (*page.Page[*coredata.ThirdParty, coredata.ThirdPartyOrderField], error) {
@@ -65,7 +67,7 @@ func (s ThirdPartyService) ListForOrganizationId(
 			showOnTrustCenter := true
 			filter := coredata.NewThirdPartyFilter(&showOnTrustCenter)

-			err := thirdParties.LoadByOrganizationID(ctx, conn, s.svc.scope, organizationID, cursor, filter)
+			err := thirdParties.LoadByOrganizationID(ctx, conn, scope, organizationID, cursor, filter)
 			if err != nil {
 				return fmt.Errorf("cannot load thirdParties: %w", err)
 			}
@@ -82,6 +84,7 @@ func (s ThirdPartyService) ListForOrganizationId(

 func (s ThirdPartyService) CountForTrustCenterId(
 	ctx context.Context,
+	scope coredata.Scoper,
 	trustCenterID gid.GID,
 ) (int, error) {
 	var count int
@@ -89,7 +92,7 @@ func (s ThirdPartyService) CountForTrustCenterId(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) (err error) {
-			trustCenter, err := s.svc.TrustCenters.Get(ctx, trustCenterID)
+			trustCenter, err := s.svc.TrustCenters.Get(ctx, scope, trustCenterID)
 			if err != nil {
 				return fmt.Errorf("cannot load trust center: %w", err)
 			}
@@ -98,7 +101,7 @@ func (s ThirdPartyService) CountForTrustCenterId(
 			showOnTrustCenter := true
 			filter := coredata.NewThirdPartyFilter(&showOnTrustCenter)

-			count, err = thirdParties.CountByOrganizationID(ctx, conn, s.svc.scope, trustCenter.OrganizationID, filter)
+			count, err = thirdParties.CountByOrganizationID(ctx, conn, scope, trustCenter.OrganizationID, filter)
 			if err != nil {
 				return fmt.Errorf("cannot count thirdParties: %w", err)
 			}
--- a/pkg/trust/trust_center_access_service.go
+++ b/pkg/trust/trust_center_access_service.go
@@ -31,7 +31,7 @@ import (

 type (
 	TrustCenterAccessService struct {
-		svc    *TenantService
+		svc    *Service
 		iamSvc *iam.Service
 		logger *log.Logger
 	}
@@ -51,6 +51,7 @@ const (

 func (s TrustCenterAccessService) Request(
 	ctx context.Context,
+	scope coredata.Scoper,
 	req *TrustCenterAccessRequest,
 ) (*coredata.TrustCenterAccess, error) {
 	var (
@@ -62,12 +63,12 @@ func (s TrustCenterAccessService) Request(
 		ctx,
 		func(ctx context.Context, tx pg.Tx) error {
 			trustCenter := &coredata.TrustCenter{}
-			if err := trustCenter.LoadByID(ctx, tx, s.svc.scope, req.TrustCenterID); err != nil {
+			if err := trustCenter.LoadByID(ctx, tx, scope, req.TrustCenterID); err != nil {
 				return fmt.Errorf("cannot load trust center: %w", err)
 			}

 			access = &coredata.TrustCenterAccess{}
-			if err := access.LoadByTrustCenterIDAndIdentityID(ctx, tx, s.svc.scope, req.TrustCenterID, req.IdentityID); err != nil {
+			if err := access.LoadByTrustCenterIDAndIdentityID(ctx, tx, scope, req.TrustCenterID, req.IdentityID); err != nil {
 				return fmt.Errorf("cannot load compliance page membership: %w", err)
 			}

@@ -79,7 +80,7 @@ func (s TrustCenterAccessService) Request(

 				filter := coredata.NewDocumentTrustCenterFilter()

-				if err := allDocuments.LoadAllByOrganizationID(ctx, tx, s.svc.scope, organizationID, filter); err != nil {
+				if err := allDocuments.LoadAllByOrganizationID(ctx, tx, scope, organizationID, filter); err != nil {
 					return fmt.Errorf("cannot list documents: %w", err)
 				}

@@ -94,7 +95,7 @@ func (s TrustCenterAccessService) Request(

 				auditFilter := coredata.NewAuditTrustCenterFilter()

-				if err := allAudits.LoadAllByOrganizationID(ctx, tx, s.svc.scope, organizationID, auditFilter); err != nil {
+				if err := allAudits.LoadAllByOrganizationID(ctx, tx, scope, organizationID, auditFilter); err != nil {
 					return fmt.Errorf("cannot list audits: %w", err)
 				}

@@ -113,7 +114,7 @@ func (s TrustCenterAccessService) Request(
 					coredata.WithTrustCenterFileVisibilities(coredata.TrustCenterVisibilityPrivate, coredata.TrustCenterVisibilityNone),
 				)

-				if err := allTrustCenterFiles.LoadAllByOrganizationID(ctx, tx, s.svc.scope, organizationID, filter); err != nil {
+				if err := allTrustCenterFiles.LoadAllByOrganizationID(ctx, tx, scope, organizationID, filter); err != nil {
 					return fmt.Errorf("cannot list trust center files: %w", err)
 				}

@@ -123,7 +124,7 @@ func (s TrustCenterAccessService) Request(
 			}

 			var existingAccesses coredata.TrustCenterDocumentAccesses
-			if err := existingAccesses.LoadAllByTrustCenterAccessID(ctx, tx, s.svc.scope, access.ID); err != nil {
+			if err := existingAccesses.LoadAllByTrustCenterAccessID(ctx, tx, scope, access.ID); err != nil {
 				return fmt.Errorf("cannot load existing access records: %w", err)
 			}

@@ -137,7 +138,7 @@ func (s TrustCenterAccessService) Request(
 			if err := accesses.BulkInsertDocumentAccesses(
 				ctx,
 				tx,
-				s.svc.scope,
+				scope,
 				access.ID,
 				access.OrganizationID,
 				newDocumentIDs,
@@ -150,7 +151,7 @@ func (s TrustCenterAccessService) Request(
 			if err := accesses.BulkInsertReportAccesses(
 				ctx,
 				tx,
-				s.svc.scope,
+				scope,
 				access.ID,
 				access.OrganizationID,
 				newReportIDs,
@@ -163,7 +164,7 @@ func (s TrustCenterAccessService) Request(
 			if err := accesses.BulkInsertTrustCenterFileAccesses(
 				ctx,
 				tx,
-				s.svc.scope,
+				scope,
 				access.ID,
 				access.OrganizationID,
 				newTrustCenterFileIDs,
@@ -180,7 +181,7 @@ func (s TrustCenterAccessService) Request(
 		return nil, err
 	}

-	if err := s.svc.SlackMessages.QueueSlackNotification(ctx, req.IdentityID, req.TrustCenterID); err != nil {
+	if err := s.svc.slack.QueueSlackNotification(ctx, scope, req.IdentityID, req.TrustCenterID); err != nil {
 		s.logger.ErrorCtx(ctx, "cannot queue slack notification", log.Error(err))
 	}

@@ -189,13 +190,14 @@ func (s TrustCenterAccessService) Request(

 func (s TrustCenterAccessService) GetAccess(
 	ctx context.Context,
+	scope coredata.Scoper,
 	trustCenterID gid.GID,
 	identityID gid.GID,
 ) (coredata.TrustCenterAccess, error) {
 	var access coredata.TrustCenterAccess

 	err := s.svc.pg.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
-		return access.LoadByTrustCenterIDAndIdentityID(ctx, conn, s.svc.scope, trustCenterID, identityID)
+		return access.LoadByTrustCenterIDAndIdentityID(ctx, conn, scope, trustCenterID, identityID)
 	})

 	return access, err
@@ -203,6 +205,7 @@ func (s TrustCenterAccessService) GetAccess(

 func (s TrustCenterAccessService) GetDocumentAccess(
 	ctx context.Context,
+	scope coredata.Scoper,
 	trustCenterID gid.GID,
 	identityID gid.GID,
 	documentID gid.GID,
@@ -212,7 +215,7 @@ func (s TrustCenterAccessService) GetDocumentAccess(
 	err := s.svc.pg.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
 		access := &coredata.TrustCenterAccess{}

-		err := access.LoadByTrustCenterIDAndIdentityID(ctx, conn, s.svc.scope, trustCenterID, identityID)
+		err := access.LoadByTrustCenterIDAndIdentityID(ctx, conn, scope, trustCenterID, identityID)
 		if err != nil {
 			if errors.Is(err, coredata.ErrResourceNotFound) {
 				return ErrMembershipNotFound
@@ -222,7 +225,7 @@ func (s TrustCenterAccessService) GetDocumentAccess(
 		}

 		profile := &coredata.MembershipProfile{}
-		if err := profile.LoadByIdentityIDAndOrganizationID(ctx, conn, s.svc.scope, identityID, access.OrganizationID); err != nil {
+		if err := profile.LoadByIdentityIDAndOrganizationID(ctx, conn, scope, identityID, access.OrganizationID); err != nil {
 			if errors.Is(err, coredata.ErrResourceNotFound) {
 				return ErrUserNotFound
 			}
@@ -234,7 +237,7 @@ func (s TrustCenterAccessService) GetDocumentAccess(

 		documentAccess = &coredata.TrustCenterDocumentAccess{}

-		err = documentAccess.LoadByTrustCenterAccessIDAndDocumentID(ctx, conn, s.svc.scope, access.ID, documentID)
+		err = documentAccess.LoadByTrustCenterAccessIDAndDocumentID(ctx, conn, scope, access.ID, documentID)
 		if err != nil {
 			if errors.Is(err, coredata.ErrResourceNotFound) {
 				return ErrDocumentAccessNotFound
@@ -254,6 +257,7 @@ func (s TrustCenterAccessService) GetDocumentAccess(

 func (s TrustCenterAccessService) GetReportAccess(
 	ctx context.Context,
+	scope coredata.Scoper,
 	trustCenterID gid.GID,
 	identityID gid.GID,
 	reportID gid.GID,
@@ -263,7 +267,7 @@ func (s TrustCenterAccessService) GetReportAccess(
 	err := s.svc.pg.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
 		access := &coredata.TrustCenterAccess{}

-		err := access.LoadByTrustCenterIDAndIdentityID(ctx, conn, s.svc.scope, trustCenterID, identityID)
+		err := access.LoadByTrustCenterIDAndIdentityID(ctx, conn, scope, trustCenterID, identityID)
 		if err != nil {
 			if errors.Is(err, coredata.ErrResourceNotFound) {
 				return ErrMembershipNotFound
@@ -273,7 +277,7 @@ func (s TrustCenterAccessService) GetReportAccess(
 		}

 		profile := &coredata.MembershipProfile{}
-		if err := profile.LoadByIdentityIDAndOrganizationID(ctx, conn, s.svc.scope, identityID, access.OrganizationID); err != nil {
+		if err := profile.LoadByIdentityIDAndOrganizationID(ctx, conn, scope, identityID, access.OrganizationID); err != nil {
 			if errors.Is(err, coredata.ErrResourceNotFound) {
 				return ErrUserNotFound
 			}
@@ -285,7 +289,7 @@ func (s TrustCenterAccessService) GetReportAccess(

 		reportAccess = &coredata.TrustCenterDocumentAccess{}

-		err = reportAccess.LoadByTrustCenterAccessIDAndReportID(ctx, conn, s.svc.scope, access.ID, reportID)
+		err = reportAccess.LoadByTrustCenterAccessIDAndReportID(ctx, conn, scope, access.ID, reportID)
 		if err != nil {
 			if errors.Is(err, coredata.ErrResourceNotFound) {
 				return ErrDocumentAccessNotFound
@@ -305,6 +309,7 @@ func (s TrustCenterAccessService) GetReportAccess(

 func (s TrustCenterAccessService) GetTrustCenterFileAccess(
 	ctx context.Context,
+	scope coredata.Scoper,
 	trustCenterID gid.GID,
 	identityID gid.GID,
 	trustCenterFileID gid.GID,
@@ -314,7 +319,7 @@ func (s TrustCenterAccessService) GetTrustCenterFileAccess(
 	err := s.svc.pg.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
 		access := &coredata.TrustCenterAccess{}

-		err := access.LoadByTrustCenterIDAndIdentityID(ctx, conn, s.svc.scope, trustCenterID, identityID)
+		err := access.LoadByTrustCenterIDAndIdentityID(ctx, conn, scope, trustCenterID, identityID)
 		if err != nil {
 			if errors.Is(err, coredata.ErrResourceNotFound) {
 				return ErrMembershipNotFound
@@ -324,7 +329,7 @@ func (s TrustCenterAccessService) GetTrustCenterFileAccess(
 		}

 		profile := &coredata.MembershipProfile{}
-		if err := profile.LoadByIdentityIDAndOrganizationID(ctx, conn, s.svc.scope, identityID, access.OrganizationID); err != nil {
+		if err := profile.LoadByIdentityIDAndOrganizationID(ctx, conn, scope, identityID, access.OrganizationID); err != nil {
 			if errors.Is(err, coredata.ErrResourceNotFound) {
 				return ErrUserNotFound
 			}
@@ -336,7 +341,7 @@ func (s TrustCenterAccessService) GetTrustCenterFileAccess(

 		fileAccess = &coredata.TrustCenterDocumentAccess{}

-		err = fileAccess.LoadByTrustCenterAccessIDAndTrustCenterFileID(ctx, conn, s.svc.scope, access.ID, trustCenterFileID)
+		err = fileAccess.LoadByTrustCenterAccessIDAndTrustCenterFileID(ctx, conn, scope, access.ID, trustCenterFileID)
 		if err != nil {
 			if errors.Is(err, coredata.ErrResourceNotFound) {
 				return ErrDocumentAccessNotFound
@@ -356,6 +361,7 @@ func (s TrustCenterAccessService) GetTrustCenterFileAccess(

 func (s *TrustCenterAccessService) GrantByIDs(
 	ctx context.Context,
+	scope coredata.Scoper,
 	organizationID gid.GID,
 	email mail.Addr,
 	documentIDs []gid.GID,
@@ -364,7 +370,7 @@ func (s *TrustCenterAccessService) GrantByIDs(
 ) error {
 	return s.svc.pg.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error {
 		trustCenter := &coredata.TrustCenter{}
-		if err := trustCenter.LoadByOrganizationID(ctx, tx, s.svc.scope, organizationID); err != nil {
+		if err := trustCenter.LoadByOrganizationID(ctx, tx, scope, organizationID); err != nil {
 			return fmt.Errorf("cannot load trust center: %w", err)
 		}

@@ -374,12 +380,12 @@ func (s *TrustCenterAccessService) GrantByIDs(
 		}

 		access := &coredata.TrustCenterAccess{}
-		if err := access.LoadByTrustCenterIDAndIdentityID(ctx, tx, s.svc.scope, trustCenter.ID, identity.ID); err != nil {
+		if err := access.LoadByTrustCenterIDAndIdentityID(ctx, tx, scope, trustCenter.ID, identity.ID); err != nil {
 			return fmt.Errorf("cannot load trust center access: %w", err)
 		}

 		profile := &coredata.MembershipProfile{}
-		if err := profile.LoadByIdentityIDAndOrganizationID(ctx, tx, s.svc.scope, identity.ID, access.OrganizationID); err != nil {
+		if err := profile.LoadByIdentityIDAndOrganizationID(ctx, tx, scope, identity.ID, access.OrganizationID); err != nil {
 			if errors.Is(err, coredata.ErrResourceNotFound) {
 				return ErrUserNotFound
 			}
@@ -393,19 +399,19 @@ func (s *TrustCenterAccessService) GrantByIDs(
 		now := time.Now()

 		if len(documentIDs) > 0 {
-			if err := coredata.GrantByDocumentIDs(ctx, tx, s.svc.scope, access.ID, documentIDs, now); err != nil {
+			if err := coredata.GrantByDocumentIDs(ctx, tx, scope, access.ID, documentIDs, now); err != nil {
 				return fmt.Errorf("cannot grant document accesses: %w", err)
 			}
 		}

 		if len(reportIDs) > 0 {
-			if err := coredata.GrantByReportIDs(ctx, tx, s.svc.scope, access.ID, reportIDs, now); err != nil {
+			if err := coredata.GrantByReportIDs(ctx, tx, scope, access.ID, reportIDs, now); err != nil {
 				return fmt.Errorf("cannot grant report accesses: %w", err)
 			}
 		}

 		if len(fileIDs) > 0 {
-			if err := coredata.GrantByTrustCenterFileIDs(ctx, tx, s.svc.scope, access.ID, fileIDs, now); err != nil {
+			if err := coredata.GrantByTrustCenterFileIDs(ctx, tx, scope, access.ID, fileIDs, now); err != nil {
 				return fmt.Errorf("cannot grant trust center file accesses: %w", err)
 			}
 		}
@@ -414,11 +420,11 @@ func (s *TrustCenterAccessService) GrantByIDs(
 			profile.State = coredata.ProfileStateActive

 			profile.UpdatedAt = now
-			if err := profile.Update(ctx, tx, s.svc.scope); err != nil {
+			if err := profile.Update(ctx, tx, scope); err != nil {
 				return fmt.Errorf("cannot update profile: %w", err)
 			}

-			if err := s.sendAccessEmail(ctx, tx, access, profile); err != nil {
+			if err := s.sendAccessEmail(ctx, tx, scope, access, profile); err != nil {
 				return fmt.Errorf("cannot send access email: %w", err)
 			}
 		}
@@ -427,20 +433,26 @@ func (s *TrustCenterAccessService) GrantByIDs(
 	})
 }

-func (s *TrustCenterAccessService) sendAccessEmail(ctx context.Context, tx pg.Tx, access *coredata.TrustCenterAccess, profile *coredata.MembershipProfile) error {
+func (s *TrustCenterAccessService) sendAccessEmail(
+	ctx context.Context,
+	tx pg.Tx,
+	scope coredata.Scoper,
+	access *coredata.TrustCenterAccess,
+	profile *coredata.MembershipProfile,
+) error {
 	organization := &coredata.Organization{}
-	if err := organization.LoadByID(ctx, tx, s.svc.scope, access.OrganizationID); err != nil {
+	if err := organization.LoadByID(ctx, tx, scope, access.OrganizationID); err != nil {
 		return fmt.Errorf("cannot load organization: %w", err)
 	}

 	now := time.Now()
 	access.UpdatedAt = now

-	if err := access.Update(ctx, tx, s.svc.scope); err != nil {
+	if err := access.Update(ctx, tx, scope); err != nil {
 		return fmt.Errorf("cannot update trust center access with expiration: %w", err)
 	}

-	emailPresenterCfg, err := s.svc.TrustCenters.EmailPresenterConfig(ctx, access.TrustCenterID)
+	emailPresenterCfg, err := s.svc.TrustCenters.EmailPresenterConfig(ctx, scope, access.TrustCenterID)
 	if err != nil {
 		return fmt.Errorf("cannot get compliance page email presenter config: %w", err)
 	}
@@ -472,6 +484,7 @@ func (s *TrustCenterAccessService) sendAccessEmail(ctx context.Context, tx pg.Tx

 func (s *TrustCenterAccessService) RejectOrRevokeByIDs(
 	ctx context.Context,
+	scope coredata.Scoper,
 	organizationID gid.GID,
 	email mail.Addr,
 	documentIDs []gid.GID,
@@ -480,7 +493,7 @@ func (s *TrustCenterAccessService) RejectOrRevokeByIDs(
 ) error {
 	return s.svc.pg.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error {
 		trustCenter := &coredata.TrustCenter{}
-		if err := trustCenter.LoadByOrganizationID(ctx, tx, s.svc.scope, organizationID); err != nil {
+		if err := trustCenter.LoadByOrganizationID(ctx, tx, scope, organizationID); err != nil {
 			return fmt.Errorf("cannot load trust center: %w", err)
 		}

@@ -490,12 +503,12 @@ func (s *TrustCenterAccessService) RejectOrRevokeByIDs(
 		}

 		access := &coredata.TrustCenterAccess{}
-		if err := access.LoadByTrustCenterIDAndIdentityID(ctx, tx, s.svc.scope, trustCenter.ID, identity.ID); err != nil {
+		if err := access.LoadByTrustCenterIDAndIdentityID(ctx, tx, scope, trustCenter.ID, identity.ID); err != nil {
 			return fmt.Errorf("cannot load trust center access: %w", err)
 		}

 		profile := &coredata.MembershipProfile{}
-		if err := profile.LoadByIdentityIDAndOrganizationID(ctx, tx, s.svc.scope, identity.ID, access.OrganizationID); err != nil {
+		if err := profile.LoadByIdentityIDAndOrganizationID(ctx, tx, scope, identity.ID, access.OrganizationID); err != nil {
 			return fmt.Errorf("cannot load profile: %w", err)
 		}

@@ -505,7 +518,7 @@ func (s *TrustCenterAccessService) RejectOrRevokeByIDs(
 		if len(documentIDs) > 0 {
 			shouldSendEmail = true

-			if err := coredata.RejectOrRevokeByDocumentIDs(ctx, tx, s.svc.scope, access.ID, documentIDs, now); err != nil {
+			if err := coredata.RejectOrRevokeByDocumentIDs(ctx, tx, scope, access.ID, documentIDs, now); err != nil {
 				return fmt.Errorf("cannot reject/revoke document accesses: %w", err)
 			}
 		}
@@ -513,7 +526,7 @@ func (s *TrustCenterAccessService) RejectOrRevokeByIDs(
 		if len(reportIDs) > 0 {
 			shouldSendEmail = true

-			if err := coredata.RejectOrRevokeByReportIDs(ctx, tx, s.svc.scope, access.ID, reportIDs, now); err != nil {
+			if err := coredata.RejectOrRevokeByReportIDs(ctx, tx, scope, access.ID, reportIDs, now); err != nil {
 				return fmt.Errorf("cannot reject/revoke report accesses: %w", err)
 			}
 		}
@@ -521,13 +534,13 @@ func (s *TrustCenterAccessService) RejectOrRevokeByIDs(
 		if len(fileIDs) > 0 {
 			shouldSendEmail = true

-			if err := coredata.RejectOrRevokeByTrustCenterFileIDs(ctx, tx, s.svc.scope, access.ID, fileIDs, now); err != nil {
+			if err := coredata.RejectOrRevokeByTrustCenterFileIDs(ctx, tx, scope, access.ID, fileIDs, now); err != nil {
 				return fmt.Errorf("cannot reject/revoke trust center file accesses: %w", err)
 			}
 		}

 		if shouldSendEmail {
-			if err := s.sendDocumentAccessRejectedEmail(ctx, tx, access, profile, documentIDs, reportIDs, fileIDs); err != nil {
+			if err := s.sendDocumentAccessRejectedEmail(ctx, tx, scope, access, profile, documentIDs, reportIDs, fileIDs); err != nil {
 				return fmt.Errorf("cannot send access email: %w", err)
 			}
 		}
@@ -539,6 +552,7 @@ func (s *TrustCenterAccessService) RejectOrRevokeByIDs(
 func (s *TrustCenterAccessService) sendDocumentAccessRejectedEmail(
 	ctx context.Context,
 	tx pg.Tx,
+	scope coredata.Scoper,
 	access *coredata.TrustCenterAccess,
 	profile *coredata.MembershipProfile,
 	documentIDs []gid.GID,
@@ -546,7 +560,7 @@ func (s *TrustCenterAccessService) sendDocumentAccessRejectedEmail(
 	fileIDs []gid.GID,
 ) error {
 	organization := &coredata.Organization{}
-	if err := organization.LoadByID(ctx, tx, s.svc.scope, access.OrganizationID); err != nil {
+	if err := organization.LoadByID(ctx, tx, scope, access.OrganizationID); err != nil {
 		return fmt.Errorf("cannot load organization: %w", err)
 	}

@@ -556,7 +570,7 @@ func (s *TrustCenterAccessService) sendDocumentAccessRejectedEmail(
 	)

 	if len(documentIDs) > 0 {
-		if err := documents.LoadByIDs(ctx, tx, s.svc.scope, documentIDs); err != nil {
+		if err := documents.LoadByIDs(ctx, tx, scope, documentIDs); err != nil {
 			return fmt.Errorf("cannot load documents by IDs: %w", err)
 		}

@@ -567,7 +581,7 @@ func (s *TrustCenterAccessService) sendDocumentAccessRejectedEmail(

 	var reports coredata.Reports
 	if len(reportIDs) > 0 {
-		if err := reports.LoadByIDs(ctx, tx, s.svc.scope, reportIDs); err != nil {
+		if err := reports.LoadByIDs(ctx, tx, scope, reportIDs); err != nil {
 			return fmt.Errorf("cannot load reports by IDs: %w", err)
 		}

@@ -578,7 +592,7 @@ func (s *TrustCenterAccessService) sendDocumentAccessRejectedEmail(

 	var files coredata.TrustCenterFiles
 	if len(fileIDs) > 0 {
-		if err := files.LoadByIDs(ctx, tx, s.svc.scope, fileIDs); err != nil {
+		if err := files.LoadByIDs(ctx, tx, scope, fileIDs); err != nil {
 			return fmt.Errorf("cannot load files by IDs: %w", err)
 		}

@@ -587,7 +601,7 @@ func (s *TrustCenterAccessService) sendDocumentAccessRejectedEmail(
 		}
 	}

-	emailPresenterCfg, err := s.svc.TrustCenters.EmailPresenterConfig(ctx, access.TrustCenterID)
+	emailPresenterCfg, err := s.svc.TrustCenters.EmailPresenterConfig(ctx, scope, access.TrustCenterID)
 	if err != nil {
 		return fmt.Errorf("cannot get compliance page email presenter config: %w", err)
 	}
--- a/pkg/trust/trust_center_file_service.go
+++ b/pkg/trust/trust_center_file_service.go
@@ -29,11 +29,12 @@ import (
 )

 type TrustCenterFileService struct {
-	svc *TenantService
+	svc *Service
 }

 func (s *TrustCenterFileService) Get(
 	ctx context.Context,
+	scope coredata.Scoper,
 	organizationID gid.GID,
 	trustCenterFileID gid.GID,
 ) (*coredata.TrustCenterFile, error) {
@@ -42,7 +43,7 @@ func (s *TrustCenterFileService) Get(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			err := trustCenterFile.LoadByID(ctx, conn, s.svc.scope, trustCenterFileID)
+			err := trustCenterFile.LoadByID(ctx, conn, scope, trustCenterFileID)
 			if err != nil {
 				return fmt.Errorf("cannot load trust center file: %w", err)
 			}
@@ -67,6 +68,7 @@ func (s *TrustCenterFileService) Get(

 func (s *TrustCenterFileService) ListForOrganizationId(
 	ctx context.Context,
+	scope coredata.Scoper,
 	organizationID gid.GID,
 	cursor *page.Cursor[coredata.TrustCenterFileOrderField],
 	filter *coredata.TrustCenterFileFilter,
@@ -76,7 +78,7 @@ func (s *TrustCenterFileService) ListForOrganizationId(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			err := trustCenterFiles.LoadByOrganizationID(ctx, conn, s.svc.scope, organizationID, cursor, filter)
+			err := trustCenterFiles.LoadByOrganizationID(ctx, conn, scope, organizationID, cursor, filter)
 			if err != nil {
 				return fmt.Errorf("cannot load trust center files: %w", err)
 			}
@@ -93,10 +95,11 @@ func (s *TrustCenterFileService) ListForOrganizationId(

 func (s *TrustCenterFileService) ExportFile(
 	ctx context.Context,
+	scope coredata.Scoper,
 	trustCenterFileID gid.GID,
 	email mail.Addr,
 ) ([]byte, string, error) {
-	fileData, mimeType, err := s.exportFileData(ctx, trustCenterFileID)
+	fileData, mimeType, err := s.exportFileData(ctx, scope, trustCenterFileID)
 	if err != nil {
 		return nil, "", fmt.Errorf("cannot export trust center file: %w", err)
 	}
@@ -115,13 +118,15 @@ func (s *TrustCenterFileService) ExportFile(

 func (s *TrustCenterFileService) ExportFileWithoutWatermark(
 	ctx context.Context,
+	scope coredata.Scoper,
 	trustCenterFileID gid.GID,
 ) ([]byte, string, error) {
-	return s.exportFileData(ctx, trustCenterFileID)
+	return s.exportFileData(ctx, scope, trustCenterFileID)
 }

 func (s *TrustCenterFileService) exportFileData(
 	ctx context.Context,
+	scope coredata.Scoper,
 	trustCenterFileID gid.GID,
 ) ([]byte, string, error) {
 	var (
@@ -131,12 +136,12 @@ func (s *TrustCenterFileService) exportFileData(

 	err := s.svc.pg.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
 		trustCenterFile = &coredata.TrustCenterFile{}
-		if err := trustCenterFile.LoadByID(ctx, conn, s.svc.scope, trustCenterFileID); err != nil {
+		if err := trustCenterFile.LoadByID(ctx, conn, scope, trustCenterFileID); err != nil {
 			return fmt.Errorf("cannot load trust center file: %w", err)
 		}

 		file = &coredata.File{}
-		if err := file.LoadByID(ctx, conn, s.svc.scope, trustCenterFile.FileID); err != nil {
+		if err := file.LoadByID(ctx, conn, scope, trustCenterFile.FileID); err != nil {
 			return fmt.Errorf("cannot load file: %w", err)
 		}

--- a/pkg/trust/trust_center_reference_service.go
+++ b/pkg/trust/trust_center_reference_service.go
@@ -28,18 +28,19 @@ import (
 )

 type TrustCenterReferenceService struct {
-	svc *TenantService
+	svc *Service
 }

 func (s TrustCenterReferenceService) ListForTrustCenterID(
 	ctx context.Context,
+	scope coredata.Scoper,
 	trustCenterID gid.GID,
 	cursor *page.Cursor[coredata.TrustCenterReferenceOrderField],
 ) (*page.Page[*coredata.TrustCenterReference, coredata.TrustCenterReferenceOrderField], error) {
 	var references coredata.TrustCenterReferences

 	err := s.svc.pg.WithConn(ctx, func(ctx context.Context, conn pg.Querier) error {
-		err := references.LoadByTrustCenterID(ctx, conn, s.svc.scope, trustCenterID, cursor)
+		err := references.LoadByTrustCenterID(ctx, conn, scope, trustCenterID, cursor)
 		if err != nil {
 			return fmt.Errorf("cannot load trust center references: %w", err)
 		}
@@ -55,6 +56,7 @@ func (s TrustCenterReferenceService) ListForTrustCenterID(

 func (s TrustCenterReferenceService) GenerateLogoURL(
 	ctx context.Context,
+	scope coredata.Scoper,
 	referenceID gid.GID,
 	duration time.Duration,
 ) (string, error) {
@@ -62,12 +64,12 @@ func (s TrustCenterReferenceService) GenerateLogoURL(
 	file := &coredata.File{}

 	err := s.svc.pg.WithTx(ctx, func(ctx context.Context, tx pg.Tx) error {
-		err := reference.LoadByID(ctx, tx, s.svc.scope, referenceID)
+		err := reference.LoadByID(ctx, tx, scope, referenceID)
 		if err != nil {
 			return fmt.Errorf("cannot load trust center reference: %w", err)
 		}

-		err = file.LoadByID(ctx, tx, s.svc.scope, reference.LogoFileID)
+		err = file.LoadByID(ctx, tx, scope, reference.LogoFileID)
 		if err != nil {
 			return fmt.Errorf("cannot load logo file: %w", err)
 		}
@@ -101,6 +103,7 @@ func (s TrustCenterReferenceService) GenerateLogoURL(

 func (s TrustCenterReferenceService) Get(
 	ctx context.Context,
+	scope coredata.Scoper,
 	referenceID gid.GID,
 ) (*coredata.TrustCenterReference, error) {
 	reference := &coredata.TrustCenterReference{}
@@ -108,7 +111,7 @@ func (s TrustCenterReferenceService) Get(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			err := reference.LoadByID(ctx, conn, s.svc.scope, referenceID)
+			err := reference.LoadByID(ctx, conn, scope, referenceID)
 			if err != nil {
 				return fmt.Errorf("cannot load trust center reference: %w", err)
 			}
--- a/pkg/trust/trust_center_service.go
+++ b/pkg/trust/trust_center_service.go
@@ -28,11 +28,12 @@ import (
 )

 type TrustCenterService struct {
-	svc *TenantService
+	svc *Service
 }

 func (s TrustCenterService) Get(
 	ctx context.Context,
+	scope coredata.Scoper,
 	trustCenterID gid.GID,
 ) (*coredata.TrustCenter, error) {
 	var trustCenter *coredata.TrustCenter
@@ -41,7 +42,7 @@ func (s TrustCenterService) Get(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
 			trustCenter = &coredata.TrustCenter{}
-			if err := trustCenter.LoadByID(ctx, conn, s.svc.scope, trustCenterID); err != nil {
+			if err := trustCenter.LoadByID(ctx, conn, scope, trustCenterID); err != nil {
 				return fmt.Errorf("cannot load trust center: %w", err)
 			}

@@ -57,6 +58,7 @@ func (s TrustCenterService) Get(

 func (s TrustCenterService) GetByOrganizationID(
 	ctx context.Context,
+	scope coredata.Scoper,
 	organizationID gid.GID,
 ) (*coredata.TrustCenter, error) {
 	trustCenter := &coredata.TrustCenter{}
@@ -64,7 +66,7 @@ func (s TrustCenterService) GetByOrganizationID(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			err := trustCenter.LoadByOrganizationID(ctx, conn, s.svc.scope, organizationID)
+			err := trustCenter.LoadByOrganizationID(ctx, conn, scope, organizationID)
 			if err != nil {
 				return fmt.Errorf("cannot load trust center: %w", err)
 			}
@@ -81,6 +83,7 @@ func (s TrustCenterService) GetByOrganizationID(

 func (s TrustCenterService) GetNDAFile(
 	ctx context.Context,
+	scope coredata.Scoper,
 	trustCenterID gid.GID,
 ) (*coredata.File, error) {
 	var file *coredata.File
@@ -89,7 +92,7 @@ func (s TrustCenterService) GetNDAFile(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
 			trustCenter := &coredata.TrustCenter{}
-			if err := trustCenter.LoadByID(ctx, conn, s.svc.scope, trustCenterID); err != nil {
+			if err := trustCenter.LoadByID(ctx, conn, scope, trustCenterID); err != nil {
 				return fmt.Errorf("cannot load trust center: %w", err)
 			}

@@ -98,7 +101,7 @@ func (s TrustCenterService) GetNDAFile(
 			}

 			file = &coredata.File{}
-			if err := file.LoadByID(ctx, conn, s.svc.scope, *trustCenter.NonDisclosureAgreementFileID); err != nil {
+			if err := file.LoadByID(ctx, conn, scope, *trustCenter.NonDisclosureAgreementFileID); err != nil {
 				return fmt.Errorf("cannot load file: %w", err)
 			}

@@ -114,6 +117,7 @@ func (s TrustCenterService) GetNDAFile(

 func (s TrustCenterService) GenerateNDAFileURL(
 	ctx context.Context,
+	scope coredata.Scoper,
 	trustCenterID gid.GID,
 	expiresIn time.Duration,
 ) (string, error) {
@@ -123,7 +127,7 @@ func (s TrustCenterService) GenerateNDAFileURL(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
 			trustCenter := &coredata.TrustCenter{}
-			if err := trustCenter.LoadByID(ctx, conn, s.svc.scope, trustCenterID); err != nil {
+			if err := trustCenter.LoadByID(ctx, conn, scope, trustCenterID); err != nil {
 				return fmt.Errorf("cannot load trust center: %w", err)
 			}

@@ -132,7 +136,7 @@ func (s TrustCenterService) GenerateNDAFileURL(
 			}

 			file = &coredata.File{}
-			if err := file.LoadByID(ctx, conn, s.svc.scope, *trustCenter.NonDisclosureAgreementFileID); err != nil {
+			if err := file.LoadByID(ctx, conn, scope, *trustCenter.NonDisclosureAgreementFileID); err != nil {
 				return fmt.Errorf("cannot load file: %w", err)
 			}

@@ -153,6 +157,7 @@ func (s TrustCenterService) GenerateNDAFileURL(

 func (s TrustCenterService) GenerateLogoURL(
 	ctx context.Context,
+	scope coredata.Scoper,
 	compliancePageID gid.GID,
 	expiresIn time.Duration,
 ) (*string, error) {
@@ -162,7 +167,7 @@ func (s TrustCenterService) GenerateLogoURL(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			if err := compliancePage.LoadByID(ctx, conn, s.svc.scope, compliancePageID); err != nil {
+			if err := compliancePage.LoadByID(ctx, conn, scope, compliancePageID); err != nil {
 				return fmt.Errorf("cannot load compliance page: %w", err)
 			}

@@ -170,7 +175,7 @@ func (s TrustCenterService) GenerateLogoURL(
 				return nil
 			}

-			if err := file.LoadByID(ctx, conn, s.svc.scope, *compliancePage.LogoFileID); err != nil {
+			if err := file.LoadByID(ctx, conn, scope, *compliancePage.LogoFileID); err != nil {
 				return fmt.Errorf("cannot load file: %w", err)
 			}

@@ -199,6 +204,7 @@ func (s TrustCenterService) GenerateLogoURL(

 func (s TrustCenterService) GenerateDarkLogoURL(
 	ctx context.Context,
+	scope coredata.Scoper,
 	compliancePageID gid.GID,
 	expiresIn time.Duration,
 ) (*string, error) {
@@ -208,7 +214,7 @@ func (s TrustCenterService) GenerateDarkLogoURL(
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
-			if err := compliancePage.LoadByID(ctx, conn, s.svc.scope, compliancePageID); err != nil {
+			if err := compliancePage.LoadByID(ctx, conn, scope, compliancePageID); err != nil {
 				return fmt.Errorf("cannot load compliance page: %w", err)
 			}

@@ -216,7 +222,7 @@ func (s TrustCenterService) GenerateDarkLogoURL(
 				return nil
 			}

-			if err := file.LoadByID(ctx, conn, s.svc.scope, *compliancePage.DarkLogoFileID); err != nil {
+			if err := file.LoadByID(ctx, conn, scope, *compliancePage.DarkLogoFileID); err != nil {
 				return fmt.Errorf("cannot load file: %w", err)
 			}

@@ -243,7 +249,11 @@ func (s TrustCenterService) GenerateDarkLogoURL(
 	return &presignedURL, nil
 }

-func (s *TrustCenterService) EmailPresenterConfig(ctx context.Context, compliancePageID gid.GID) (emails.PresenterConfig, error) {
+func (s *TrustCenterService) EmailPresenterConfig(
+	ctx context.Context,
+	scope coredata.Scoper,
+	compliancePageID gid.GID,
+) (emails.PresenterConfig, error) {
 	var (
 		compliancePage    = &coredata.TrustCenter{}
 		organization      = &coredata.Organization{}
@@ -252,8 +262,6 @@ func (s *TrustCenterService) EmailPresenterConfig(ctx context.Context, complianc
 		emailPresenterCfg = emails.DefaultPresenterConfig(s.svc.bucket, s.svc.baseURL)
 	)

-	scope := coredata.NewScopeFromObjectID(compliancePageID)
-
 	err := s.svc.pg.WithConn(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
@@ -334,6 +342,7 @@ func (s *TrustCenterService) EmailPresenterConfig(ctx context.Context, complianc

 func (s *TrustCenterService) GetMailingList(
 	ctx context.Context,
+	scope coredata.Scoper,
 	trustCenterID gid.GID,
 ) (*coredata.MailingList, error) {
 	var mailingList *coredata.MailingList
@@ -342,7 +351,7 @@ func (s *TrustCenterService) GetMailingList(
 		ctx,
 		func(ctx context.Context, conn pg.Querier) error {
 			trustCenter := &coredata.TrustCenter{}
-			if err := trustCenter.LoadByID(ctx, conn, s.svc.scope, trustCenterID); err != nil {
+			if err := trustCenter.LoadByID(ctx, conn, scope, trustCenterID); err != nil {
 				return fmt.Errorf("cannot load trust center: %w", err)
 			}

@@ -351,7 +360,7 @@ func (s *TrustCenterService) GetMailingList(
 			}

 			mailingList = &coredata.MailingList{}
-			if err := mailingList.LoadByID(ctx, conn, s.svc.scope, *trustCenter.MailingListID); err != nil {
+			if err := mailingList.LoadByID(ctx, conn, scope, *trustCenter.MailingListID); err != nil {
 				return fmt.Errorf("cannot load mailing list: %w", err)
 			}