Multi-tenant data isolation patterns that hold up in audits

Row-level security, schema-per-tenant, and hybrid models—how to choose without overbuilding your first SaaS release.

Tenant leaks are existential for B2B SaaS. Architecture reviews should answer how a bug in one feature could expose another customer's rows—not whether you have a separate database logo.

Three patterns, three tradeoffs

• Shared schema + RLS: cost-efficient; demands rigorous policy tests.
• Schema per tenant: stronger isolation; ops overhead scales with count.
• Database per tenant: enterprise sales friendly; automation required from day one.

Most teams start shared with RLS and tenant_id on every table—including audit and background job tables engineers forget. Migration discipline matters more than the label on the diagram.

Prove isolation continuously

Automated tests attempt cross-tenant reads with swapped JWTs. CI fails if a new endpoint lacks tenant scoping. Pen tests focus on IDOR and export endpoints—common leak paths.

Multi-tenancy is a security property, not a deployment detail. Buyers ask how you prevent cross-tenant reads; auditors ask for evidence, not architecture slides.

Engineering habits that leak tenants

• Background jobs without tenant context.
• Admin "impersonate" features without logging.
• Cached objects keyed only by resource ID.
• Export endpoints that filter in application code only.
• JOIN queries that forget tenant predicates.

Defense in depth

Application checks plus database RLS (where supported) plus network segmentation for largest clients. Encryption at rest is table stakes; key rotation and customer-managed keys matter for enterprise deals.

Migration and reporting

Analytics warehouses must inherit tenant keys. BI tools connected read-only still need row filters. One-off support queries should go through audited interfaces, not raw SQL consoles.

Choosing a pattern as you grow

From 10 to 1,000 tenants, operational cost dominates. Automate provisioning, schema migrations, and per-tenant backups before sales promises dedicated databases you cannot operate.

Triaxo SaaS reviews include tenant-isolation test cases in CI templates we hand off—so new endpoints cannot merge without scoping review.