How best to lock down files for authorized access only

I currently have an application I wrote for a company to manage their projects. We've developed it enough over time that it has become fairly useful for them, and other companies in their industry have expressed an interest in using it as well, so they are looking for ways to turn around and sell rights to use it. Then general approach we were looking at is for them to host the site, and then people who log into it obviously only have access to their own products and any features they want to purchase. WHich is obviously a bit of a change from a single company environment. One of the big features of the current system is that they currently can upload different CAD drawing, contracts, etc to the website. Right now I just use the web.config files to like the stuff down, make sure sensitive stuff is locked to the administrative level, shared stuff to administrators and users. I'm not really sure how I go about this from multiple company approach. I would tend to lean toward a ...