Multi tenant in plain English: one codebase, many companies

A permit platform used by several permit companies at once. A CRM where a builder and two partner trades see different leads in the same system. A transit platform running many cities. All three are one piece of software each.

The word, and what it hides

Tenant is a borrowed word. Think of an office building: one structure, one set of plumbing, many businesses behind locked doors. Multi tenant software is the same. One codebase, usually one database, many companies inside it, each with its own locked door. The locked door is the whole subject.

Three systems we run this way

• Permit software for many providers. Private permit companies each manage their own projects, inspections and clients in the same platform. A company in Boca Raton never sees a project belonging to one in Fort Lauderdale, though both are in the same tables.
• A CRM shared by a builder and its partners. The home builder's lead system also receives leads from a painting company and a cabinet shop. The builder's team sees everything. Each partner logs into the same CRM and sees only the leads tagged to its own source, nothing else, not even an internal task.
• A transit platform for many cities. Each program (a campus, a resort, a town) has its own riders, drivers, vehicles, fares and branding, and every rider facing feature is a switch each program flips on or off. One codebase runs all of them.

How the data stays separate

The honest answer is: not at the screen. Hiding a tab is not security. The separation lives in the database through a feature usually called row level security. In everyday terms, every row in every table carries a label saying which tenant it belongs to, and the database itself checks the label against the person asking on every read and every write, no matter which screen or tool made the request. If the app has a bug and asks for the wrong company's leads, the database returns nothing. The door is locked from the inside.

We test this the hard way. Two accounts from different tenants, the same queries, and a list of every record each one can reach, compared line by line. On the shared CRM we ran a set of adversarial checks before the first partner account existed, and the rule is that the partner sees nothing unlinked to its own source, ever.

What is shared, and why it is fine

1. The code. One fix helps every tenant at once. When the email thread parser was repaired for the builder, the partners got the repair in the same deploy.
2. The hosting. One deployment, one set of monitoring, one bill, split across tenants instead of multiplied by them.
3. The structure. The tables, the stages, the inspection templates. Each tenant fills them with its own data and, where allowed, its own settings.

What is never shared: a record. A lead, a permit, a ride, a photo. Those belong to one tenant and the database knows which.

Why it matters for cost

The alternative is one copy of the software per company: separate code, separate database, separate hosting. That is the right answer when the companies are unrelated and each wants full ownership, which is how we build client CRMs for unrelated businesses. It is the wrong answer for a platform, because every improvement would have to be shipped to every copy and every copy would drift. Multi tenant is what lets a permit platform serve its fifth provider for roughly the cost of serving its first, and what lets a transit platform add a city without adding a server.

What to ask any vendor

• Where is the separation enforced: in the screens, or in the database?
• Has anyone tried to reach another tenant's data on purpose, and is that test written down?
• Can a tenant export only its own data, cleanly, on request?
• Can one tenant's settings or outage affect another's?

Good answers are specific. Vague ones mean the door is a curtain.

Multi tenant platforms and single tenant client systems are both things we build, and the choice between them is one of the first decisions we make with an owner, because it sets the cost and the ownership model for years.

Questions people ask