How to control vendor access to tenant details