🏢 Multi-Tenant SaaS Architecture

Multi-tenancy means a single deployment of a software application serves multiple customers — called tenants — while keeping their data and configurations logically or physically isolated. It is the defining architectural model for SaaS products because it makes infrastructure costs predictable and operational management centralized. The key design question is how strictly to isolate tenants from one another.

The three canonical models are silo (dedicated infrastructure per tenant), pool (fully shared infrastructure), and bridge (a hybrid). Engineers describe these as: "in the silo model, each tenant gets their own database instance," "in the pool model, all tenants share a single schema differentiated by a tenant ID column," and "in the bridge model, premium tenants get dedicated resources while standard tenants share." Each model involves trade-offs in cost, isolation strength, and operational complexity.

The noisy neighbour problem occurs when one tenant's workload consumes a disproportionate share of shared resources — CPU, memory, or database connections — degrading performance for other tenants. Engineers address it with per-tenant resource quotas, rate limiting, throttling policies, and tenant-level observability. The phrase "we throttle tenants that exceed their tier's resource allocation" is a typical description of the mitigation strategy.

The control plane is the set of services that manage tenant lifecycle — onboarding, configuration, billing, and health monitoring — while the data plane is the application that tenants actually use. Engineers say "the control plane provisions a new database schema and injects the tenant's configuration before routing traffic to the data plane." Separating the two planes is a best practice for operational resilience and independent scaling.

Key terms include "tier" (Free, Starter, Pro, Enterprise), "entitlement" (a specific feature or limit granted to a tier), "feature flag," "plan configuration," "seat-based pricing," and "usage-based billing." Engineers describe tier enforcement by saying "the entitlement service checks the tenant's plan before allowing access to the analytics module" or "the feature is gated behind the Enterprise tier."

Tenant provisioning is the automated process of creating all the resources a new customer needs — database schema, storage bucket, default configuration, and IAM policies. Vocabulary includes "provisioning pipeline," "tenant ID," "tenant context," "onboarding webhook," and "tenant lifecycle states" (active, suspended, offboarded). Engineers say "provisioning is idempotent — running it twice produces the same result as running it once."

Data partitioning options include row-level separation (tenant ID column), schema-per-tenant, and database-per-tenant. The discussion weighs query performance, migration complexity, and regulatory compliance. A typical architect statement: "We chose schema-per-tenant because it gives us strong isolation without the operational overhead of managing hundreds of separate database instances."

Offboarding vocabulary includes "tenant deactivation," "data export," "right to erasure," "hard delete vs. soft delete," "data retention policy," and "deletion cascade." Engineers describe the process as "when a tenant is offboarded, we soft-delete their account immediately, initiate a data export, and schedule a hard delete of all PII after the contractual retention period expires." GDPR compliance requires demonstrating that deletion is complete and auditable.

Tenant-level observability means tracking metrics, logs, and traces at the granularity of individual tenants rather than the system as a whole. Engineers say "we inject the tenant ID into every log line and trace span so we can filter by tenant in Grafana" and "we set up per-tenant SLO dashboards to detect when a single tenant is experiencing degraded performance." This capability is essential for premium SLA tiers.

SaaS architecture roles — platform engineer, solutions architect, backend engineer — frequently use terms like tenant isolation, noisy neighbour, control plane, and entitlement service in technical interviews. Interviewers assess whether candidates can reason through trade-offs using precise vocabulary, not just describe patterns at a high level. Being able to say "I would choose the bridge model because premium tenants require dedicated resources for compliance, while standard tenants can share infrastructure" signals architectural maturity.