Home  ›  Glossary  ›  Multi-Tenancy

What is multi-tenancy?

Multi-tenancy is an architecture in which one instance of an application or storage system serves many separate tenants, such as customers or business units, while keeping each tenant's data, identities and resource use isolated from the others. Isolation is enforced in layers, chiefly identity boundaries, namespaces and quotas.

How are identity boundaries drawn?

Each tenant has its own account, with its own users, groups, access keys and policies, in an IAM model of the kind S3 platforms use. A policy written inside one tenant account can grant rights only to resources in that account, so no setting a tenant controls can reach a neighbor. Tenants can often federate to their own directory, which keeps user lifecycle with the tenant. The platform operator's accounts sit above every tenant, and their administrative blast radius is the widest on the system.

What does namespace isolation cover?

Every bucket and object belongs to exactly one tenant. Listings, searches, logs and usage reports return only that tenant's resources, and requests for another tenant's bucket fail as if it did not exist. Namespace isolation is what lets many tenants share one S3 endpoint while each sees a private storage system. The storage-specific design is covered under multi-tenant storage.

How do quotas and rate limits contain a tenant?

Capacity quotas cap how much a tenant can store. They do not cap how hard it works the system. A tenant running a large restore after an incident can take most of the disk and network capacity, and every other tenant's jobs slow or miss their backup window. This is the noisy neighbor problem. Per-tenant limits on request rate and bandwidth, part of storage QoS, contain it, and so does placing heavy tenants on separate resource pools. Both rely on per-tenant metering, which also supports billing.

Which layers complete the isolation?

  • Encryption keys. Separate keys per tenant, sometimes held by the tenant, keep a key compromise to one tenant.
  • Audit. Access logs kept per tenant let each prove who touched what, and let the operator show the same to an auditor.

The layers fail independently. Strong identity with a shared key means one stolen key opens every tenant, and separate keys without rate limits leave performance shared.

When is logical isolation not enough?

A regulator may require physical separation, a contract may forbid shared hardware, or a tenant's risk profile may rule out co-residency. Multi-tenancy delivers logical isolation, and those cases call for dedicated hardware for that tenant, even under the same management layer.

Frequently asked questions

Is multi-tenant storage secure enough for regulated data?

It can be, when every isolation layer is enforced and audited. Regulators may ask for evidence such as an independent audit report, and some require dedicated infrastructure regardless.

What is the difference between a tenant and a user?

A tenant is a customer or business unit with its own isolated account. Users are individual identities inside a tenant, with permissions that apply only within it.

Do capacity quotas prevent noisy neighbors?

No. Capacity quotas limit stored data. Noisy neighbors are contained by per-tenant limits on request rate and bandwidth.