Every B2B app has to keep one customer's data from another's. Shared tables with a tenant ID are cheapest and the most common; separate databases or accounts per tenant are easier to explain to enterprise buyers. The models, where isolation is actually enforced, noisy neighbours, and when to move a big customer to its own silo.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
A tenant ID column on every tenant-owned table, never optional.
Enforcement in the database, not only in queries: Postgres row-level security keyed on a tenant setting for the connection or transaction.
Tenant derived from the authenticated session on the server, never from a request parameter the client controls.
Unique constraints and indexes that include the tenant ID.
Tests that try to read another tenant's data through every API, run in CI.
Tenant ID in every log line and trace, so incidents can be scoped.
In a pooled system one large tenant's import or report can slow everyone. Per-tenant rate limits, per-tenant queues or fair scheduling for background work, and query timeouts keep one customer's spike from becoming everyone's outage.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Row-Level Security: The Check Between Your Users' Data and Everyone Else
Apps on Supabase, Firebase and similar platforms let the browser talk to the database directly. That is fine only if the database enforces who sees what, because anyone can call the same API without your UI. How row-level security works, the gaps that catch people (views, functions, storage), and a ten-minute test.
Read
GDPR for US Startups: When It Applies, and the Minimum Worth Doing
GDPR applies to a US company that offers goods or services to people in the EU or monitors their behaviour, even with no office there. What that means in practice, the documents enterprise customers will ask for (a DPA, a subprocessor list, a transfer mechanism such as the EU-US Data Privacy Framework), and the engineering it implies.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.