Multi-Tenancy Architecture

How one SaaS product serves many customers from shared infrastructure without leaking data or letting one customer slow down the rest: silo, pool and bridge models, tenant context, row-level security, noisy neighbors and tiers.

Overview

A tenant is one customer of a software-as-a-service (SaaS) product: usually a company, with many users of its own. Multi-tenancy means serving many tenants from one running system, instead of installing a separate copy for each.

Sharing is what makes SaaS cheap to run and quick to change. One deployment carries every tenant, one upgrade reaches everyone, and capacity follows total load instead of sitting idle per customer. It also creates the two problems this chapter is about. Isolation: no tenant may ever see or change another tenant's data. AWS's SaaS guidance calls crossing that boundary a significant and potentially unrecoverable event for a SaaS business. Fairness: one busy tenant must not slow down the rest, the so-called noisy neighbor.

Real designs sit on a spectrum. At one end, each tenant gets its own stack (silo). At the other, everything is shared and each row carries a tenant ID (pool). Most real products mix the two, per layer and per customer tier.

What you will be able to do

  • Explain the silo, pool and bridge models and choose one for each layer of a design.
  • Carry a trusted tenant ID from sign-in to every query, and enforce it in more than one place.
  • Use PostgreSQL row-level security as a safety net, and avoid its common traps.
  • Protect tenants from each other's load with limits, quotas and placement.
  • Shard a pooled database by tenant, and move a large tenant out when it outgrows the pool.

Key concepts

  • Tenant
  • Silo model
  • Pool model
  • Bridge model
  • Tier-based isolation
  • Tenant context
  • Row-level security
  • Noisy neighbor
  • Tenant-aware sharding

Interview questions

  • Explain the silo, pool and bridge models. Which would you choose for a new B2B SaaS product?
  • How do you prevent one tenant from reading another tenant's data in a pooled database?
  • What is the noisy neighbor problem, and how do you handle it?
  • How would you shard a multi-tenant database as it grows?
  • Write a PostgreSQL row-level security policy for tenant isolation, and explain its pitfalls.
  • An enterprise customer needs its data in the EU and its own encryption keys. How do you fit it in?
  • Schema per tenant or shared tables: which would you pick for 50,000 small tenants?
  • How do you know what each tenant costs you?

Sign up free to read the full topic

More System Design topics

Start free on Cariara · Coding problems · System design studio