Security & architecture
Multi-tenant ERP security: boundaries every SaaS operator should make explicit
A clear guide to tenant isolation, role-aware portals, server-side authorization and controlled operational changes.
A multi-tenant business system is trustworthy only when its boundaries are understandable and consistently enforced. Interface separation helps people focus, but true isolation depends on the site, database context and server authorization behind every request.
Separate tenant data at the platform boundary
A site-per-tenant model gives each customer a distinct application and database context. Provisioning, routing, backups and operational tooling must preserve that boundary throughout the tenant lifecycle.
Treat portals as focused views, not security controls
A role-focused portal reduces accidental complexity, but hiding a button is not authorization. Every API method must validate the caller, tenant context and permission required for the action.
- Verify tenant context on the server.
- Use least-privilege roles for each workspace.
- Test direct API access as well as frontend navigation.
Control high-impact actions
Provisioning, financial changes, subscription changes and AI-assisted ERP writes deserve explicit review, clear audit events and fail-closed behavior when identity or policy context is incomplete.
Publish what is verified
Security pages should distinguish implemented controls from roadmap intentions. Specific certifications, uptime figures or compliance claims should appear only when evidence and ownership exist.