hardDesignCase StudySeniorStaffLead
Four thousand business customers share your SaaS platform. What are your tenant isolation options, and how do you make a cross-tenant data leak structurally impossible rather than merely unlikely?
7 min readUpdated 2026-08-15
Answer
Short answer
Isolation runs from a tenant_id column through separate schemas and databases to a stack per tenant, trading efficiency against blast radius. Careful filtering is not an isolation model: push the predicate below the application with row-level security and scope caches and object prefixes too.
Was this answer helpful?
Likely follow-ups
- Your largest customer demands their data in their own database in their own region. How do you offer that without forking the product?
- How would you prove to an auditor that no cross-tenant read is possible, rather than asserting it?
- One tenant runs a report that saturates the shared database. What do you change?
- How do you delete a tenant completely, including from backups, caches and the search index?
Related questions
- How do you isolate tenants in a shared vector index?hardAlso on tenant-isolation and blast-radius6 min
- One managed service in your primary region is having a bad day and your product is down with it. What can you do during the outage, and what should you have designed before it?hardAlso on blast-radius6 min
- A customer reports seeing another company's records in your admin console. Walk me through the first hour, and then tell me what you change so this class of bug cannot happen again.hardAlso on tenant-isolation4 min
- A configuration change that passed review takes the entire fleet down in under a minute. What in your design should have limited the damage?hardAlso on blast-radius7 min