Multi-Tenant SaaS Isolation: Shared DB, RLS, and When to Silo
Shared databases vs siloed tenants, row-level security, and how we choose isolation models for compliance-heavy B2B SaaS clients.
Isolation is a spectrum
Pooling every tenant in one schema is cheapest operationally and riskiest for noisy neighbours and compliance reviews. Dedicated databases per tenant invert that trade-off. Most B2B products land somewhere in between: shared compute, careful data boundaries, and selective silos for enterprise contracts.
We start from threat models and contractual obligations, not from a preferred ORM pattern. If a customer requires residency or audit-proof separation, the architecture must say so explicitly.
Emit tenant IDs on every log and trace in production. Isolation without observability becomes forensic work during the first serious incident.
Row-level security done right
Postgres RLS is powerful when tenant context is set on every connection and policies are tested as thoroughly as application code. It fails when a service role bypasses policies or a reporting job reads without tenant filters.
Defence in depth still matters: application filters, RLS, and automated tests that attempt cross-tenant reads in CI. One layer alone will eventually be bypassed.
Emit tenant IDs on every log and trace in production. Isolation without observability becomes forensic work during the first serious incident.
When to silo a tenant
Silo when the revenue justifies the ops cost, when compliance demands it, or when a tenant's workload would starve others. Partial silos — dedicated search indexes or object storage prefixes — often deliver most of the benefit without full stack duplication.
Plan migration paths early. Promoting a shared tenant to a silo under deadline is far harder than designing the escape hatch on day one.
Emit tenant IDs on every log and trace in production. Isolation without observability becomes forensic work during the first serious incident.
Operational guardrails
Quota noisy neighbours with per-tenant rate limits and storage caps. Emit tenant IDs on every log and trace so incidents do not become forensic puzzles.
Isolation without observability is theatre. The goal is blast-radius control you can prove during a security review.
Emit tenant IDs on every log and trace in production. Isolation without observability becomes forensic work during the first serious incident.
Prove isolation in CI
Add automated tests that attempt cross-tenant reads and writes on every PR that touches auth, reporting, or data access. Isolation without continuous proof eventually fails a security review.
Choose shared DB, RLS, or silos from contracts and threat models — then keep the escape hatch to silo documented before an enterprise deal forces it.
Emit tenant IDs on every log and trace in production. Isolation without observability becomes forensic work during the first serious incident.
Start from contracts and threat models
Pooling every tenant in one schema is cheapest and riskiest. Dedicated databases invert the trade-off. Most B2B products land in between: shared compute, careful data boundaries, and selective silos for enterprise contracts.
Begin from contractual obligations and threat models, not from an ORM preference. If residency or audit-proof separation is required, the architecture must say so explicitly.
Emit tenant IDs on every log and trace in production. Isolation without observability becomes forensic work during the first serious incident.
Defence in depth for tenant context
Postgres RLS is powerful when tenant context is set on every connection and policies are tested like application code. It fails when a service role bypasses policies or a reporting job reads unfiltered.
Keep application filters, RLS, and CI tests that attempt cross-tenant reads. One layer alone will eventually be bypassed.
Emit tenant IDs on every log and trace in production. Isolation without observability becomes forensic work during the first serious incident.
Plan the escape hatch to silo early
Silo when revenue justifies ops cost, compliance demands it, or a tenant’s workload starves others. Partial silos — dedicated search indexes or storage prefixes — often deliver most benefits without full duplication.
Promoting a shared tenant to a silo under a sales deadline is far harder than designing the escape hatch on day one.
Emit tenant IDs on every log and trace in production. Isolation without observability becomes forensic work during the first serious incident.
“Sustainable delivery comes from making the important trade-offs explicit, measurable, and recoverable.”
Checklist
- Service promise and recovery objective documented
- Tenant or workload boundaries visible in telemetry
- Failure and rollback exercise completed
- Consistency and cache invalidation rules recorded
- Cost and operational owner assigned
- Runbook tested before wider rollout
Muhammad Talha Zubair
CTO & Managing Director
Owns technical direction and delivery across web, mobile, and AI integration work. Sets architecture standards and keeps product engineering close to the builders.
Let's build something
remarkable
Whether you need a web or mobile app with AI integrations, blockchain work, or a conversation about our AI products — tell us what you're building and we'll respond fast.
Blog questions
How we write, how often we publish, and how you can contribute or stay in the loop.
Blogs are written by Automative Tech’s engineering leadership — Muhammad Talha Zubair, Bilal Hassan, and Umar Khalid — based on production web, mobile, AI integration, and blockchain work.
We lead with custom web and mobile delivery with AI integrations — Next.js, React, React Native, Flutter, and LLM features. Selected posts also cover blockchain, AI products, and cloud when they support shipping real products.
A few deep pieces per month. We prioritize substance over cadence.
Yes with attribution and a link back to the original. For syndication, contact us for a simple agreement.
Occasionally, when the author has real production experience. Pitch a short outline via the contact form.
Follow the social links in the footer, or contact us to ask about engineering notes updates.