Why multi-tenancy matters
Multi-tenancy is the foundation of every SaaS business model. The pattern you pick decides cost, isolation, blast radius, and how painful enterprise customers will be a year from now.
The three classic patterns
1. Shared everything (pool model)
A single database, single schema, every row tagged with tenant_id. Cheapest to operate, easiest to roll out features. The risk: a single bug or query without the tenant filter leaks data across customers.
Pick this when: you are pre-PMF, customers tolerate shared infra, and your queries are tightly reviewed.
2. Schema-per-tenant
One database, one schema per tenant. Better isolation than the pool model, with reasonable cost. Migrations get harder as tenants grow; you'll need automated, fan-out schema migrations.
Pick this when: customers want logical isolation, you have <500 tenants, and you can afford the migration tooling.
3. Database-per-tenant (silo model)
One database (or cluster) per tenant. Hard isolation, easy per-tenant backups and restores, simple compliance story. Highest cost; not realistic at thousands of tenants without orchestration.
Pick this when: customers demand isolation (HIPAA, FedRAMP), or each tenant is large enough to justify the overhead.
Hybrid models in the real world
In practice most mature SaaS products run a *hybrid*: free and self-serve tiers on a pool, mid-market on schema-per-tenant, and enterprise customers on dedicated databases. The data layer abstracts the choice behind a single getConnectionFor(tenant) function.
Checklist before you commit
- Tenant context is set on every request before queries run.
- Row-level security (RLS) is enabled where the database supports it.
- Backups are restorable per tenant, not just per cluster.
- Cross-tenant features (analytics, admin) live in a separate query path.
- Migrations are tested in a fan-out runner with rollback per tenant.
Closing thought
The biggest mistake is locking in early. Start with the simplest pattern that meets today's compliance bar, and design the data access layer so you can promote large tenants to a stronger isolation tier without rewriting the application.