CyArt Academy
Unlock ProSign in

Multi-tenant isolation

Silo, pool and bridge models; the isolation primitives at each layer; and how to prove to a customer that another tenant cannot see their data.

🔒 PROLesson·14 min read·Advanced → Staff
multi-tenancyisolationSaaS

01Silo, pool and bridge

✓What you will learn
  • Choose silo, pool or bridge per tier of customer and say what each costs
  • Carry a verified tenant context from the token to the last query, cache key and log line
  • Enforce isolation at identity, compute, data and key layers, with a database backstop
  • Prove isolation to a customer with tests and logs, not a diagram

A tenant is the unit a SaaS product sells to: a company, a school, a workspace. Multi-tenancy means many tenants share one deployment. Two things can go wrong. The serious one is a cross-tenant data leak: tenant A reads, changes or infers tenant B's data. The common one is the noisy neighbour: tenant A's batch import starves tenant B of CPU or database connections. Isolation design addresses both, and the first one is a security incident that ends contracts.

There are three deployment models. Pool shares everything and separates tenants logically by a tenant ID. Silo gives a tenant its own stack: account, database, keys. Bridge mixes them, typically pooled compute over siloed data. Most products run all three, chosen per customer tier.

PoolBridgeSilo
Isolation strengthLogical: one bug in authz can leakData physically separate; compute sharedStrongest: separate account and network
Cost per tenantLowest; amortisedMediumHighest; idle capacity per tenant
Blast radius of a bugAll tenantsTenants on that computeOne tenant
OperationsOne deploy, one migrationMigrations run per databaseN stacks to patch, monitor and upgrade
FitsFree and self-serve tiersMid-marketRegulated, enterprise, data residency
LayerPool primitiveSilo primitive
IdentityTenant claim in every token; authz scoped by itSeparate IdP tenant or realm
ComputeShared services; tenant ID in every request contextPer-tenant namespace or cloud account
DataRow-level security keyed by tenantDatabase or schema per tenant
KeysPer-tenant DEK under a shared KEKPer-tenant KMS key, optionally customer-managed
NetworkShared mesh, policy by workload identityPer-tenant VPC

This is an advanced module

Advanced: Security Architecture at Scale is part of the Pro pass. 4 more sections — the deep dives, the final design, follow-ups and the test — unlock with it.

Enter access codeSee Pro pass

Already a cyart.io or studio.cyart.io member? Your pass code is in your Studio account.

Related lessons