<story><title>Shipping Multi-Tenant SaaS Using Postgres Row-Level Security</title><url>https://www.thenile.dev/blog/multi-tenant-rls</url></story><parent_chain><item><author>e1g</author><text>Every B2B client who asked us how we handle multi-tenancy also asked how we ensure their data is erased at the end of the contract. Using a shared database with RLS means you have to go through all DB backups, delete individual rows for that tenant, then re-generate the backup. That’s a non-starter, so we opted for having one DB per tenant which also makes sharding, scaling, balancing, and handling data-residency challenges easier.</text></item><item><author>bearjaws</author><text>This is such a killer feature in PG, my new job uses it and it makes audits of our tenancy model dead simple.&lt;p&gt;Coming from a SaaS company that used MySQL, we would get asked by some customers how we guarantee we segmented their data, and it always ended at the app layer. One customer (A fortune 10 company) asked if we could switch to SQL Server to get this feature...&lt;p&gt;Our largest customers ask how we do database multi-tenant and we point to our SDLC + PG docs and they go &amp;#x27;K&amp;#x27;.</text></item></parent_chain><comment><author>brightball</author><text>I filled out a ton of enterprise questionnaires on this stuff before and we just told people that it would be deleted when the backups expired after X days because we didn&amp;#x27;t have the capability to delete specific rows from our backups. Nobody ever argued.&lt;p&gt;There&amp;#x27;s not a single customer I&amp;#x27;ve ever run across who&amp;#x27;s going to halt a contract because you can&amp;#x27;t purge their data from your backups fast enough. They&amp;#x27;re signing up because of what you offer, not the termination clause.</text></comment>
<story><title>Shipping Multi-Tenant SaaS Using Postgres Row-Level Security</title><url>https://www.thenile.dev/blog/multi-tenant-rls</url></story><parent_chain><item><author>e1g</author><text>Every B2B client who asked us how we handle multi-tenancy also asked how we ensure their data is erased at the end of the contract. Using a shared database with RLS means you have to go through all DB backups, delete individual rows for that tenant, then re-generate the backup. That’s a non-starter, so we opted for having one DB per tenant which also makes sharding, scaling, balancing, and handling data-residency challenges easier.</text></item><item><author>bearjaws</author><text>This is such a killer feature in PG, my new job uses it and it makes audits of our tenancy model dead simple.&lt;p&gt;Coming from a SaaS company that used MySQL, we would get asked by some customers how we guarantee we segmented their data, and it always ended at the app layer. One customer (A fortune 10 company) asked if we could switch to SQL Server to get this feature...&lt;p&gt;Our largest customers ask how we do database multi-tenant and we point to our SDLC + PG docs and they go &amp;#x27;K&amp;#x27;.</text></item></parent_chain><comment><author>bearjaws</author><text>We usually write a &amp;quot;reasonable best effort&amp;quot; clause into our deletion, that it will 100% be deleted from production within 30 days and automatically fall out of backups 60 days from there. This also helps since we can&amp;#x27;t control our downstream vendors such as Twilio, AWS SES, etc, who all have their own legal obligations and time frames.&lt;p&gt;Even for large health systems they have been okay with it.</text></comment>