What is tenant isolation?
Many cloud applications serve several customers with the same software and the same infrastructure. Each customer is a tenant. Tenant isolation covers every measure that keeps one tenant from seeing or affecting another tenant's data or processing.
Common layers are:
- Database: separate databases, separate schemas, or row-level security rules that limit every query to the tenant's own rows.
- Application: every request carries its tenant from the sign-in, not from something the user typed or sent.
- Runtime: code belonging to different tenants runs walled off from each other.
The lower in the stack the separation is enforced, the less it depends on every single line of application code being right.
Tenant isolation at Openbase.one
At Openbase.one, your workspace is the tenant. Workspaces are separated at database level with row-level security. Which workspace a request belongs to always comes from the sign-in.
Apps are separated as well: app code runs in an isolated runtime with no network access and reaches neither the internet nor other workspaces. Apps write no SQL. Every data access goes through the SDK and a gateway that checks each call against workspace, app and permissions. Platform data is hosted in Frankfurt.
Describe your first app and watch it go live, checked.
Start for free