Security & Multi-tenancy interview questions

Tenant isolation, secrets management, defence in depth, and threat modelling a distributed system.

4 questions in System Design.

System DesignA 24-minute read on how the topic fits together, before the questions.System design fundamentals60 short answers on one page, for revising rather than studying.

hard4

hardScenarioDesignConcept

A customer reports seeing another company's records in your admin console. Walk me through the first hour, and then tell me what you change so this class of bug cannot happen again.

Treat it as a confirmed breach until proven otherwise: preserve logs, scope who saw what, and start the disclosure clock alongside the investigation. The cause is almost always tenant scoping living in application code, where one forgotten filter leaks everything - so move enforcement below the code, to row-level security.

4 minsenior, lead, staff

hardScenarioDesign

A customer's API token turns up in a public repository. What do you do in the next hour, and what in your token design decides how bad this is?

The damage is fixed before the leak by three earlier decisions: whether the token can be revoked and how fast that takes effect, how narrowly it was scoped, and whether your audit trail can attribute actions to that specific credential rather than only to the tenant.

7 minmid, senior, staff

hardScenarioDesign

How do you design a highly available envelope encryption architecture that protects billions of records without exhausting KMS API limits or crushing latency?

Envelope encryption at scale separates Data Encryption Keys (DEKs) from Key Encryption Keys (KEKs), caches plaintext DEKs only inside strict boundaries, and designs rotation so latency, KMS limits, and algorithm migration do not break availability.

3 minsenior, staff

hardDesignCase Study

Four thousand business customers share your SaaS platform. What are your tenant isolation options, and how do you make a cross-tenant data leak structurally impossible rather than merely unlikely?

Isolation runs from a tenant_id column through separate schemas and databases to a stack per tenant, trading efficiency against blast radius. Careful filtering is not an isolation model: push the predicate below the application with row-level security and scope caches and object prefixes too.

7 minsenior, staff, lead