The database never leaks upward
Every line of SQL lives behind an interface. No service imports a driver, and none of them knows Postgres is down there at all — which is why moving this app off MongoDB rewrote one directory instead of the whole codebase.