Building Resilient Multi-Tenant SaaS Architectures: Isolation, Security & Scalability

Multi-Tenancy Archetypes When building B2B multi-tenant SaaS platforms like **Appointory**, choosing the appropriate isolation model dictates cost structure, security compliance, and operational complexity:

• 1. Database-Per-Tenant: Highest security isolation, but prohibitive cloud infrastructure costs for hundreds of SMB clients.
• 2. Schema-Per-Tenant: Clean separation in relational engines like PostgreSQL, but migrations become unwieldy at scale.
• 3. Shared Database, Shared Schema (Row-Level Security): Optimal cost-efficiency and horizontal scaling, requiring bulletproof query middleware to prevent cross-tenant data leakage.

Row-Level Tenant Scoping Middleware

export interface AuthenticatedTenantRequest extends Request { tenantId?: string; user?: { id: string; role: string }; }

export function tenantContextMiddleware( req: AuthenticatedTenantRequest, res: Response, next: NextFunction ) { const tenantSubdomain = req.headers['x-tenant-id'] || req.hostname.split('.')[0];

if (!tenantSubdomain) { return res.status(400).json({ error: 'Tenant context missing from request headers' }); }

// Inject tenant context into request lifecycle req.tenantId = String(tenantSubdomain).toLowerCase(); next(); }

// Mongoose Plugin to Automatically Scope Every Query to Current Tenant export function tenantPlugin(schema: any) { schema.add({ tenantId: { type: String, required: true, index: true } });

schema.pre(/^find/, function (this: any) { const currentTenant = this.getOptions().tenantId; if (currentTenant) { this.where({ tenantId: currentTenant }); } }); } ```

Crucial Security Invariants - **Never trust client-supplied tenant IDs in POST/PUT bodies**: Always derive `tenantId` from verified JWT claims or authenticated session tokens. - **Dedicated tenant storage partitions**: Store user-uploaded assets in S3 buckets with prefix-based IAM policy boundaries (`bucket/tenants/{tenantId}/*`).