Multi-tenant architecture
Many customer organisations sharing one running copy of a SaaS product, each strictly walled off from the others' data.
Updated October 2026 · with examples from our own builds
What does multi-tenant architecture mean in practice?
In a multi-tenant product every customer, often called a workspace or account, shares the same code, servers and database, with each record tagged by the tenant it belongs to. Running costs stay low and one release reaches everyone at once.
The risk that keeps B2B founders awake is a leak between tenants. One missing filter can show one customer another's records, and that kind of incident ends deals. Isolation has to be designed in: tenant IDs on every row, permissions scoped to the tenant and, for sensitive data, encryption bound to it.
Products often grow tenants inside tenants, such as an agency with client accounts or a company with branches that mustn't see each other. Planning for that early is far cheaper than adding it to a live database.
Multi-tenant architecture at a glance
- Core rule
- Every record and query carries the tenant ID
- Worst failure
- One customer seeing another's data
- Plan early for
- Sub-accounts, branches and per-tenant settings
Where has multi-tenant architecture come up in our builds?
Every stored credential is encrypted with the workspace ID bound in as additional authenticated data, so a ciphertext copied into another workspace fails to decrypt. Suppression lists are per workspace, and the agency plan rolls client workspaces up as sub-accounts.
At first every industry pack reused the education screens with relabelled fields, and in our own demo data school students showed up on a travel agency's Travelers page because both read one collection. In late July 2026 we gave each industry its own models, collections and routes, so that leak is impossible by construction.
For a business running two legal entities on one system, the proposal puts company and branch on every record, scopes permissions by both and gives each branch its own GSTIN and number series. Recommended, not built.
Common questions about multi-tenant architecture
How do I know my SaaS keeps customers' data apart?
Ask how the tenant ID is enforced: on every query by default, or only where a developer remembered to add it. Then ask for a test that tries to read across tenants and must fail.
Can one customer account have sub-accounts?
Yes, if the data model has a parent above the tenant. LoudMouth's agency plan rolls client workspaces up under one agency while each stays isolated, and the customs broker proposal scopes every record by both company and branch.
Related terms
Planning a product and not sure where multi-tenant architecture fits? Ask us, or browse all 116 terms in the glossary.