Multi-tenancy isolation
Silo, pool or bridge: how SaaS systems keep tenants' data apart, stop noisy neighbours, and use shuffle sharding and cells to shrink a bad tenant's blast radius.
25 min6 steps
By the end you can
- Choose between silo, pool and bridge tenancy models for isolation, cost and operations
- Enforce tenant scoping on every data access, with defence in depth such as row-level security
- Apply per-tenant quotas and fair scheduling so one tenant cannot exhaust shared capacity
- Count shuffle shards and explain how they shrink the blast radius of a bad tenant
Silo, pool or bridge
A tenant is a customer organisation sharing your system.
Silo
- Own stack or database
- Easy delete and audit
- Costly at thousands
Pool
- Shared tables, tenant_id
- Cheapest
- Isolation is all in your code
Bridge
- Mix of both
- Silo big or regulated tenants
Scope every query to the tenant
One missing WHERE tenant_id = ? leaks another customer's data. Take the tenant from the authenticated context, never a caller parameter, and add defence in depth: PostgreSQL row-level security filters every query.
Noisy neighbours
One tenant's spike or bulk import can slow everyone. Apply rate-limiting tools per tenant: quotas, per-tenant concurrency, fair queueing, separate pools for the consistently large.
One FIFO
- Bulk import first
- Others wait hours
Fair per-tenant queues
- Bounded share each
- Import still runs
Shuffle sharding shrinks the blast radius
Classic sharding: a bad tenant takes down its whole fixed group. Shuffle sharding (AWS Builders' Library) gives each tenant its own random set of k of n workers. A random other tenant shares your exact set with probability 1 ÷ (n choose k).
Loading question…
Cells: isolation for the whole stack
Cell-based architecture isolates the whole stack: independent copies, each serving some tenants, behind a thin router. Deploy cell by cell; the first cell is your canary.
Check your mastery
Score 80% or more.
Mastery check
3 questions on fresh variants. One attempt each, no time limit. Score 80% or more to master the lesson.
Next: privacy and data deletion.
Answer this step to continue.