Shared schema or separate databases: choosing SaaS tenant isolation

Tenant isolation is the set of boundaries that prevents one customer’s workload or data from affecting another. Authorization remains essential, but the storage and deployment model determine how many controls must work correctly and how narrowly a failure, restore, or noisy workload can be contained.

Define the isolation requirement before the database shape

List data sensitivity, contractual or regulatory separation, geographic constraints, tenant size variance, expected customization, encryption-key requirements, restore expectations, and the consequence of a cross-tenant defect. A startup should not claim “enterprise isolation” without defining what is actually separated.

Compare common models

• Shared tables or schema: efficient and easier to operate at small scale, but every query and policy must preserve tenant context and restores are less naturally tenant-scoped.
• Separate schemas or databases: stronger operational boundaries and clearer tenant-level moves or restores, with more provisioning, migration, connection, and monitoring work.
• Dedicated deployments or stamps: useful for strict isolation, geography, or very large tenants, while multiplying infrastructure and release coordination.
• Hybrid tiers: can place most tenants in shared infrastructure and selected tenants in dedicated resources, but need explicit placement and migration rules.

Carry tenant context through every layer

OWASP recommends deriving tenant identity from verified authentication context rather than request parameters alone, applying tenant-scoped authorization at the data-access layer, validating cache keys and file paths, and including tenant context in security logs without exposing sensitive data. Test direct object access, bulk operations, exports, background jobs, caches, and administrative tooling.

Design restore and migration paths

Decide whether one tenant can be restored without overwriting others, how schema changes roll across partitions, and how data moves if a tenant changes tier or region. Prove these operations with representative data; an architectural diagram is not recovery evidence.

Kiwi can help scope and implement an appropriate early SaaS architecture. Formal compliance, cryptographic design, residency commitments, penetration testing, and high-assurance isolation require specialist review.