In a multi-tenant SaaS, "don't show restaurant A's data to restaurant B" isn't a feature you build. It's a promise you can never break — not once, not on the one endpoint a tired engineer forgot to filter. That single omission isn't a bug ticket; it's a data breach.
Getting that guarantee right is the backbone of DineGuru, a multi-tenant restaurant-operations platform I built that runs in production.
Where multi-tenancy quietly fails
The dangerous pattern is treating tenancy as a filter you remember to add — a WHERE clause on every query. Which means it also lives as the one query where someone forgets it. Do that a hundred times across a growing codebase and the odds of a slip approach certainty. And the cost of a single slip is catastrophic: one customer seeing another customer's data.
You cannot enforce a critical guarantee through discipline and hope. It has to be structural.
Enforcing isolation in the layer that can't be skipped
DineGuru is a FastAPI modular monolith over PostgreSQL with nine domain modules — identity and access, menu catalog, ingredient stock, orders and billing, recipe costing, procurement, analytics, and more. The spine of it is server-side tenancy scoping: isolation is a property of how data access works, not something each endpoint opts into. Forgetting isn't catastrophic, because there's nothing to forget.
Two decisions shaped it:
- Tenancy pushed down, not up. The scoping lives where it can't be bypassed, so a new endpoint is safe by default instead of one review away from a leak.
- A modular monolith, on purpose. Nine clear domain modules give the separation of concerns of services without the operational tax of a distributed system at this stage — the boundaries are in the code, not spread across a network.
The principle
Any guarantee you enforce by convention will eventually be violated by convention. The engineering move is to push it down into the layer where violating it is impossible — the database, the access layer, the framework — so correctness is the default and mistakes are contained.
Building a system where one forgotten filter could expose a customer taught me that the best security isn't vigilance. It's architecture that makes the dangerous thing unrepresentable.
The full multi-tenant architecture is on the project page.
👉 See the platform: www.divyakush.com/projects/dineguru
Divyakush Punjabi — Full-Stack & AI Systems Engineer
🌐 https://www.divyakush.com · 💼 LinkedIn · 💻 GitHub
Top comments (0)