Enterprise customers of your code assistant require contractually that their source code can never influence suggestions shown to another company. Infra wants a shared embedding index and a shared semantic response cache to cut costs. Which design meets the requirement?

1. A Use one shared vector index with a tenant_id filter applied after retrieval, plus a global semantic cache keyed on prompt embedding.
2. B Fine-tune a shared completion model weekly on aggregated customer repos, stripping secrets with a scanner before each training run.
3. C Partition indexes and caches per tenant, scope cache keys by tenant, and exclude customer code from training unless opted in.
4. D Encrypt embeddings at rest in a shared index so other tenants cannot decode the vectors, and keep the global cache for latency.