The multi-tenant SaaS architecture decision: cost & engineering hours across four patterns

Multi-tenancy decisions are easy to over-engineer because the failure mode of getting them wrong (data leaking between tenants) is catastrophic. The interesting question is which pattern actually fits the workload, most teams default to the most-isolated pattern they can afford, which is often two patterns more isolated than they need.

We compared the four mainstream patterns, single DB with tenant_id, schema-per-tenant, database-per-tenant, and sharded-by-region, across cost, isolation, onboard latency, and engineering hours to ship. Below.

The four patterns at a glance

Finding 1: TIC ranges 13x across the four patterns

Tenant Isolation Cost (TIC) per 1,000 tenants ranges from $1,800 (single DB, tenant_id) to $24,000 (database-per-tenant) at the 1k-tenant baseline. The range matters because it compounds, at 1k tenants the TIC delta is already $27k/mo, on the order of an additional engineer. Pick the wrong pattern early and the infrastructure bill funds a salary nobody plans for.

Finding 2: Cost scaling diverges sharply past 10k tenants

Read on log-log axes: the Single-DB pattern scales sub-linearly (cost per tenant goes down) because the underlying database has fixed overhead. Database-per-tenant scales super-linearly (cost goes up faster than tenant count) because each tenant gets its own running database. Past 10k tenants, the gap is 20x+. Past 100k it's 40x.

Finding 3: Blast-Radius is real and asymmetric

The BCM score captures how much one bad tenant can affect others. Single-DB with tenant_id has the highest BCM (75) because a runaway query on a hot table affects everyone. Database-per-tenant has the lowest (18). The asymmetry: the BCM cost is paid only when something goes wrong; the TIC cost is paid every month.

How we compare the four patterns

1. Tenant Isolation Cost (TIC)

TIC = (Monthly infra cost / active tenants) x 1000

The core unit-economic number. Compute on observed infra spend and tenant count; compare against pattern benchmarks above.

2. Architecture Onboarding Cost (AOC)

AOC = Engineering hours to ship the multi-tenancy pattern from scratch

Includes schema design, RLS / policy setup, test coverage, observability for the chosen pattern, and tenant onboarding flow. Measured per pattern across our own implementations.

3. Blast-Radius Cost Multiplier (BCM)

BCM = Probability of cross-tenant impact x cost-of-impact

A risk-weighted cost. Multi-tenant SaaS in regulated verticals applies BCM as a hard floor, patterns above a threshold are rejected regardless of TIC.

What surprised us about tenant isolation in practice

1. Most over-engineering happens at <1k tenants.Founders pick database-per-tenant because it "feels safer" before there's any reason to. The 100-tenant company on database-per-tenant is paying $24/mo per tenant in infra to isolate.
2. Hybrid patterns work and almost nobody documents them. Single-DB with tenant_id for the bulk of the workload, schema-per-tenant for analytics-heavy tables, database-per-tenant for HIPAA-flagged tenants. Three of our highest-scale builds run this hybrid.
3. Postgres RLS is dramatically more reliable than app-layer guards.The 5 tenant-leak incidents we've audited all happened on stacks that relied on the application to filter; none on stacks that used RLS as the floor.
4. Schema-per-tenant runs out of room around 5k tenants on Postgres. Catalogue scans, migration time, and connection-pool fragmentation all degrade. Past that point you're moving to sharded-by-region whether you wanted to or not.
5. Onboard latency over 3 seconds measurably hurts conversion.A/B testing across two of our SaaS clients showed sign-up completion drops 6-9% when the "creating your workspace" step exceeds 3s. Database-per-tenant pays this tax every signup.

Concretely, “single-DB with tenant_id and RLS as the floor” is short for the policy below. This is the minimum we deploy on a new Postgres-backed multi-tenant SaaS, the policy is the second line of defence after application-layer filtering, but it is the line that actually held up across the audits we ran.

Applied to every tenant-scoped table. Reads and writes are restricted to the tenant in the JWT claim that the API server sets via SET LOCAL on each request.

-- 1. enforce tenant_id on every table that holds tenant data
ALTER TABLE projects
  ADD COLUMN tenant_id uuid NOT NULL REFERENCES tenants(id);

CREATE INDEX projects_tenant_id_idx ON projects(tenant_id);

-- 2. turn RLS on, force it (so even the table owner is bound by it)
ALTER TABLE projects ENABLE ROW LEVEL SECURITY;
ALTER TABLE projects FORCE ROW LEVEL SECURITY;

-- 3. tenant scoping policy: rows must match the request's tenant
CREATE POLICY projects_tenant_isolation ON projects
  USING       (tenant_id = current_setting('app.current_tenant', true)::uuid)
  WITH CHECK  (tenant_id = current_setting('app.current_tenant', true)::uuid);

-- 4. the API server sets the tenant per-transaction from the verified JWT:
--    SET LOCAL app.current_tenant = '<tenant uuid from auth claim>';
--
-- 5. an integration test should attempt a cross-tenant read with tenant A's
--    session and assert zero rows. Run it on every PR.

Recommendations

For founders building a new SaaS

Default to single-DB with tenant_id on Postgres with RLS. Validate isolation with tests before launch. Plan to keep the pattern through ~10k tenants. Hybrid only when a real compliance or performance reason forces it. Our SaaS web app development engagement runs this pattern by default.

For founders building AI SaaS

AI features add an interesting wrinkle: tenant-context data shouldn't leak into model prompts across tenants. The cleanest pattern is single-DB tenant_id with tenant-scoped RAG indexes. We bake this into AI SaaS product developmentfrom day one, the alternative is a single embedding-store leak from one tenant's docs into another's completions.

For founders connecting multi-tenant data via APIs

Tenant scoping has to live at the API gateway layer, not just inside the application. We see this miss repeatedly: app code is tenant-aware, public APIs are not, and a single misconfigured token grants cross-tenant read access. The Series A codebase audit has the war stories, three of the 23 audited codebases had this exact failure mode in production. Our API & integration engagement covers exactly this surface, gateway-level tenant scoping, scoped tokens, and tenant-aware rate limits.

Limitations

Cost figures use AWS / GCP / Neon / Supabase pricing as of May 2026. Self-hosted setups will diverge, usually lower at scale, higher at small scale. Onboard latency numbers come from production telemetry on our own stacks.

How to choose the pattern in 30 minutes

The cost difference between "chose the right multi-tenant pattern" and "chose the safest-feeling one" is an entire engineer's salary at scale. Pick on the basis of TIC x tenant count five years out, not on the strength of the strongest-isolated alternative.

What multi-tenancy looks like at Series A, what an MVP build cost it, and the per-tenant token math for AI features:

The two engagements where this pattern is part of the architecture from sprint zero, plus the calculator that prices an architecture against your scope: