← All posts

Engineering

Tenant isolation is a test, not a promise

Every multi-tenant platform says data is isolated. We made ours provable: a scan that discovers tables from the schema catalogue and fails the release if any business table lacks a tenant column.

The short version

This post is part of the public engineering record for Tenza. The full write-up is maintained alongside the documentation, and the behaviour it describes is what the platform does today — if the two ever disagree, the documentation is authoritative and this post is out of date.

Why it mattered

Every multi-tenant platform says data is isolated. We made ours provable: a scan that discovers tables from the schema catalogue and fails the release if any business table lacks a tenant column. The change shipped in the release dated , and its effects are visible on the status page history from that date onward.

Related reading