Engineering guides / Angular applications and AWS infrastructure
By Arte Soft engineering · 24 October 2026
SaaS database isolation: choose the boundary you can enforce
Database isolation is a product decision as well as a storage decision. Customers need confidence that another organization cannot read or change their records, and operators need a practical way to maintain the system. Shared tables, separate schemas and separate databases offer different tradeoffs. None is safe merely because a tenant identifier appears in the user interface.
Define the isolation requirement
Clarify whether separation is needed between customers, products, environments or business units. Identify the data that belongs to each boundary and the operations that cross it, such as reporting or support access. Consider whether one tenant must be restored independently and whether retention requirements differ. A separate database can simplify some recovery boundaries while increasing migrations and connection management. Shared storage can be operationally efficient but places more responsibility on authorization and query design. Write down the requirement before choosing a topology so the team can evaluate alternatives against a real need rather than a preference.
Protect the path to the data
Derive the tenant context from a verified identity and membership relationship, not a freely trusted request parameter. Apply the boundary consistently to reads, writes, background jobs and exports. Review administrative operations separately because they can bypass normal paths. If the database provides enforcement features, test their behavior with the application’s connection model and permissions. Include cache keys and object storage references in the isolation design; a correctly filtered query does not prevent leakage through a shared cache. These surrounding systems often determine whether the intended database boundary is maintained in practice.
Prove separation with hostile fixtures
Create at least two test tenants with deliberately similar record identifiers. Attempt cross-tenant reads and updates through public operations and asynchronous jobs. Test missing tenant context, an expired membership and an administrator acting outside ordinary permissions. Deliver the data ownership model, migration approach and isolation checks together. Acceptance should also demonstrate a backup or export scoped to the agreed boundary. A single unit test for a query helper cannot establish that every route and maintenance task uses it correctly. Keep the tested surfaces and remaining risks explicit in the handover.
Review the data boundary when adding a new asynchronous worker or reporting feature. Isolation assumptions are easily weakened when an apparently internal process reads directly from storage instead of following the application’s normal request and authorization path.
Account for operational growth
A design that works for ten tenants may become painful when every schema change requires thousands of coordinated operations. Conversely, premature shared infrastructure may complicate a customer’s legitimate need for separate recovery or residency. Model the likely growth and support work without promising unlimited scale. Arte Soft’s own products show application ownership across a portfolio; they are not evidence of a particular enterprise tenant architecture. Bring the customer model, recovery expectations and existing database access paths. A scoped isolation review can recommend an enforceable boundary and a migration route that does not depend on developers remembering an undocumented convention.
Relevant Arte Soft work
Cloud Calendars — our own product is our own product or engineering project. It provides context for the work we discuss here; it is not a claim of identical results for every client deployment.
Sources and further reading
Need help with Tenant isolation architecture review?
Send the current app, system or brief, the behaviour you need and your constraints. We can agree a discovery, implementation or repair scope with concrete acceptance criteria.
Discuss this with Arte Soft