Updated 2026-06-14
For security reviewers comparing SaaS isolation approaches (dedicated namespaces vs row-level security). Includes reproduction steps for diligence-not a product overview.
Visual anchor before the full guide below.
assessor reference
For security reviewers comparing SaaS isolation approaches (dedicated namespaces vs row-level security). Includes reproduction steps for diligence-not a product overview.
> Audience: Security engineers and assessors evaluating vendor diligence. MSP buyers should expect tenant separation by default; this article explains implementation choices for technical review.
Multi-tenant MSP platforms store scripts, credentials metadata, audit history, and customer configuration for thousands of organizations. Reviewers evaluating SaaS separation often compare dedicated namespace per tenant designs with row-level security (RLS) on shared tables.
Both can work; the question is which failure modes your assessor cares about and how much structural defense you want beyond application discipline.
Trustholm allocates each tenant a dedicated PostgreSQL schema (for example tenant_{code}). Tenant-scoped entities-agents, scripts, security audit rows, monitoring configuration-live in that namespace. Connection routing and ORM scoping target one schema per tenant for normal portal and API operations.
This is not dedicated cluster isolation by default. Enterprise profiles can use DedicatedDatabase via connection secret reference for separate database instances. DedicatedCluster remains a future profile documented honestly in our evidence map.
RLS attaches policies to tables so queries only see rows matching session variables such as tenant_id. When every query path sets the variable correctly, RLS is powerful. The risk is any raw SQL, reporting job, or ORM bug that omits the predicate-one mistake can expose cross-tenant rows in a shared table.
Mature teams using RLS often pair it with code review, static analysis, and database roles. Schema-per-tenant adds namespace separation so a missing filter is less likely to read another tenant's tables at all.
Database layout alone does not stop header manipulation. For authenticated portal users, Trustholm binds JWT TenantId to the resolved tenant from X-Tenant-Code, subdomain, or path. Mismatch returns 403. Platform principals follow documented Super Admin support-access audit rules.
Agent paths are different: anonymous polling uses tenant code headers and per-agent X-Agent-Key hashes-not portal JWTs. Security narratives should not conflate human SSO with machine credentials.
Ask vendors (including Trustholm) for:
Trustholm publishes Shipped/Gap rows on the trust hub. We do not claim SOC 2 or ISO certification on resource pages.
Network segmentation, backup encryption, key management, pentest cadence, and incident response remain customer obligations. Schema-per-tenant reduces one class of application bug blast radius; it does not replace governance, monitoring of infrastructure, or WORM audit storage-which remains backlog for append-only application flows.
If your assessor asks "how do you prevent Tenant A seeing Tenant B's scripts," prefer evidence you can run in trial: export audit rows scoped to one tenant, attempt cross-tenant API calls with mismatched JWT, inspect agent runtime tenant binding after reinstall. Marketing architecture slides are not substitutes for reproducible checks.
During trial or proof-of-concept, reproducible checks beat architecture slides.
Assign a security engineer to: (1) create two trial tenants or use production and sandbox; (2) authenticate as Tenant A user and attempt API calls with Tenant B header-expect 403; (3) export audit from Tenant A and confirm no Tenant B identifiers appear; (4) review agent runtime JSON after reinstall and confirm tenant code alignment; (5) document DedicatedDatabase option if enterprise procurement requires separate instances; (6) attach limitations appendix naming WORM and Sentinel gaps for your SSP.
Repeat after major upgrades. MSP platform teams should include isolation verification in quarterly control testing alongside incumbent RMM reviews-especially after custom integrations that resolve tenant context.
Schedule a ninety-minute session with security engineering and sales: map assessor questions to reproducible trial steps, assign owners for export automation, and pre-write limitations appendix language for WORM audit and Sentinel connector backlog. Revisit when trust hub Shipped/Gap rows change or when you onboard regulated clients.
Workshop output should be a version-controlled diligence folder-not ad hoc email threads that stall enterprise deals.
See /trust/tenant-isolation for evidence tables. AU buyers: /resources/data-residency-australia-msp-saas. EU buyers: /resources/digital-sovereignty-eu-msp-saas. Honest gap disclosure accelerates reviews.
Assign a reviewer to open trial tenant, navigate documented UI paths, and capture screenshots with timestamps. Export audit JSON for same session.
Store in immutable GRC folder. Compare results to this article quarterly.
When Shipped/Gap rows change in trust hub, re-run reproduction within ten business days. Attach limitations memo for WORM audit and Sentinel connector backlog.
Include DB operator access policy from hosting provider. Pair technical evidence with customer governance documents-policies, pentest summaries, IR runbooks.
Never substitute marketing copy for reproduced checks in front of assessors. Treat this appendix as a living runbook section owned by security engineering, not a one-time audit artifact.
Schedule annual refresh aligned with trust hub version stamps and major product releases. Link each reproduction run to a change ticket for traceability.
Distribute updated article PDFs to customer-facing teams when dateModified changes. Archive prior versions for twelve months to support assessor lookback questions.
When citing this article externally, include dateModified and pillar metadata in footnotes so readers know content freshness. Internal enablement should link pillar tags to trust hub sections for consistent customer messaging.
Add article slug to internal wiki index for sales engineering quick lookup during live questionnaire calls.
No architecture eliminates application bugs. Defense in depth includes API tenant binding, automated tests, least-privilege DB roles, and operational access controls. Document residual risk in your SSP.
Not necessarily. RLS with rigorous enforcement works for many SaaS products. Schema-per-tenant trades some operational complexity for structural separation. Evaluate against your threat model and DBA practices.
Elevated platform roles exist for commercial and support tasks under audited patterns. Normal tenant users cannot select arbitrary tenants without elevation.
DedicatedDatabase via connection secret ref is supported for enterprise deployments. Confirm commercial terms and backup procedures during onboarding.
No. Isolation is one control among many in Australian government assessments. Consumers supply SSP, IR runbooks, and agency-specific controls-we provide technical evidence without IRAP vendor certification claims.