Multi-tenant security: stop data leaking to the neighbours
You probably use dozens of online (SaaS) tools: CRM, invoicing, HR… Behind each one is a rarely explained reality: your company and hundreds of others often share the same application and the same database. Which raises a question that should keep you up at night: what guarantees another customer never sees your data? The answer comes down to three letters: RLS.
What is "multi-tenant"?
A multi-tenant application hosts several companies (the "tenants") on the same infrastructure. The simplest image is an apartment building: one building, one address, but each tenant has their own flat and keys. Nobody ends up in the neighbour's living room. The whole security challenge is guaranteeing those walls — digitally.
The real risk: leaks between organisations
A SaaS vendor's nightmare isn't only the outside hacker. It's the leak between customers: because of a bug, company A glimpses company B's leads, invoices or contracts. A single occurrence is enough to destroy trust — and trigger a GDPR incident. It's the most underestimated risk, and the most serious.
The fragile method: filtering only in the application
The naïve approach politely asks, on every screen, "only show this customer's data". It works… as long as nobody forgets. But an application is hundreds of screens and queries, changed by several developers over years. It takes just one forgotten filter to open a door. Betting all your customers' privacy on "no one will ever make a mistake" is not a strategy.
The right method: Row-Level Security (RLS)
Row-Level Security moves protection to where the data lives: the database itself. Each row (each lead, each invoice) is tagged by organisation. Then a simple, unavoidable rule is set: the database only returns rows that belong to the requester. Full stop.
The difference is huge: even if a developer forgets a filter in the app, the database refuses to serve another customer's data. It's no longer a courtesy you hope is respected — it's a law enforced by the foundation, on every single query.
Filtering in the app is locking your door. RLS also puts a guard at the building entrance who checks everyone.
What it means for you
Whether you're a vendor or a SaaS customer, RLS delivers three concrete things: isolation by default (human error alone can no longer cause a leak), stronger and demonstrable GDPR compliance, and trust you can explain to your own customers. It's exactly the foundation our Orbit platform is built on: each organisation is isolated at the database level, not just on screen.
In short
In shared software, the real question isn't "is it secure?" but "where is security enforced?". If the answer is "only in the application", be wary. If it includes Row-Level Security at the core of the database, your data has a real guard. Before trusting a SaaS with your information, ask the question.