1. A method, comprising the steps of: receiving a data request at a server with an application platform from a user via a user device, the data request being associated with a respective data object of a plurality of data objects stored in a database; determining when the user is an internal user from a plurality of internal users of the application platform or when a portal user from a plurality of portal users of the application platform, the user additionally having a group membership in at least one of a plurality of groups; consulting an organizational wide default table that stores a list of the data objects and, for each of the data objects, a first default security setting for all of the plurality of internal users regardless of the group membership and a second default security setting for all of the plurality of portal users regardless of the group membership, wherein the consulting step includes consulting, when the user is the internal user, the first default security setting for the respective data object in the organizational wide default table to determine when the requested data is public or private, and consulting, when the user is the portal user, the second default security setting for the respective data object in the organizational wide default table to determine when the requested data is public or private; providing, when the user is the internal user and the requested data is public, access information to the user via the user device; providing, when the user is the portal user and the requested data is public, access information to the user via the user device; consulting, when the user is the internal user and only when the requested data is private, a membership table that includes a first listing of the groups associated with the user and a share table that includes a second listing of the groups that have access to the requested data, wherein the membership table and the share table are formed from tenant metadata, and providing the requested data to the user when the membership table and the share table indicates that the group membership of the user has access; and consulting, when the user is the portal user and only when the requested data is private, the membership table and the share table, and providing the requested data to the user when the membership table and the share table indicates that the group membership of the user has access.