How do I design a multi-tenant SaaS architecture?

Multi-tenancy serves many customers from one platform while keeping their data and performance isolated.

Isolation models

• Shared schema (a tenant_id on every row) — cheapest and simplest to scale; requires strict enforcement with Row Level Security and tenant-scoped queries
• Schema-per-tenant — stronger separation, harder migrations at scale
• Database-per-tenant — strongest isolation and per-customer restore; highest cost and operational load
• Hybrid — shared by default, dedicated for regulated or very large customers

Design requirements

• Derive the tenant from the authenticated identity server-side — never from a client-supplied value
• Tenant-scoped caches, search indexes, file paths and background jobs
• Noisy-neighbour control: per-tenant rate limits, quotas and fair job scheduling
• Per-tenant backup/export/deletion, audit logs and usage metering
• Automated, tested onboarding and offboarding

Test: write negative tests proving tenant A can never read or change tenant B's data.