Multi-tenant B2B SaaS: shared or per-tenant database, cost and security

The verdict in three sentences

For a software vendor signing its first enterprise accounts, a shared database with row level security (RLS) remains the best starting point: the cheapest hosting and a single migration pipeline to maintain. A schema per tenant gives auditors an isolation story they understand without blowing up the bill, while a dedicated database multiplies hosting cost by 5 to 10 and only makes sense for customers who pay for it. The most profitable answer is often hybrid: shared by default, dedicated database sold as an add-on to banks, insurers and public bodies.

The three isolation models compared

A multi-tenant SaaS serves many client companies from one codebase. The real question is where the boundary between each customer's data sits. In the shared model, all rows live in the same tables with a tenant_id column, and a PostgreSQL RLS policy filters every query. In the schema model, each customer has its own tables inside the same instance. In the dedicated model, each customer has its own database, sometimes on its own server or in its own cloud region, for instance UK South or Canada Central.

The shared model has a poor reputation with some buyers because one badly filtered query can expose another customer's data. With RLS enforced in the database, the filter no longer depends on application code: even a developer who forgets a WHERE clause only sees the current tenant's rows. Combined with an automated test suite that tries to read another tenant's data on every deployment, this answers most audits.

What enterprise buyers actually require

First contracts with a bank, a telco or a multinational almost always come with a security questionnaire of 150 to 300 questions. Buyers do not necessarily ask for a dedicated database: they want demonstrable isolation, access logs kept for at least 12 months, an annual penetration test and an exit clause. In London, UK GDPR and often a SOC 2 or ISO 27001 request apply; in Toronto, PIPEDA and provincial rules such as Quebec's Law 25 come into play, and some public buyers insist on Canadian hosting.

The takeaway is simple: only two requirements out of six force physical isolation. Moving the whole platform to dedicated databases to satisfy 20% of customers means charging premium hosting to the 80% who do not need it.

Budget and timeline with Kolonell

Kolonell prices this work with its custom application grid: simple from 2,500,000 to 4,000,000 FCFA (3,810 to 6,100 EUR), medium from 4,000,000 to 7,000,000 FCFA (6,100 to 10,670 EUR), complex from 7,000,000 to 15,000,000+ FCFA (10,670 to 22,870+ EUR). An isolation migration usually takes 2 to 4 months, depending on data volume and how many tenants must move without downtime. For comparison, London or Toronto agencies quote this kind of re-architecture well above these figures in GBP or CAD (2026 order of magnitude).

The most underestimated item is tooling: a script that creates a dedicated database, runs migrations, configures backups and registers the tenant in the routing table in under 10 minutes. Without it, every new enterprise account costs several days of manual engineering.

Mini case study

Priya, CTO of an HR software vendor in Toronto, serves 60 mid-sized companies on a shared database hosted for about CAD 4,000 per month (2026 order of magnitude). Two new customers, a bank and a provincial agency, require physical isolation and Canadian hosting.

• All-dedicated for 62 tenants: roughly 6 times the current bill, about CAD 24,000 per month.
• Hybrid: CAD 4,000 for the shared database + 2 dedicated databases at CAD 1,500 each, so CAD 7,000 per month. Extra cost: CAD 3,000.
• The two enterprise customers pay an isolation add-on of CAD 3,500 per month each, so CAD 7,000.

Monthly margin on the add-on: 7,000 minus 3,000, so CAD 4,000, or CAD 48,000 per year. The hybrid project pays for itself within the first year, before counting the value of the two signed contracts.

FAQ

Is row level security enough for a bank?

In roughly 6 cases out of 10, yes, if you show the RLS policies, the isolation tests run on every deployment and the access logs. Banks that require in-country hosting or their own encryption keys will ask for a dedicated database.

How long does a move to schema per tenant take?

Plan 2 to 3 months for 50 to 300 tenants, including 3 to 4 weeks of testing and progressive cutover. Tenants move one by one, overnight, with a rollback ready.

Can models be mixed in one SaaS?

Yes, it is the most common setup among vendors selling to both SMEs and enterprises. A routing table tells the application where each tenant's data lives, and about 90% of the code stays shared.

How do I prove isolation to an auditor?

Provide an architecture diagram, access policies, the latest penetration test report and a sample of 12 months of logs. A well prepared pack cuts a 250-question questionnaire down to 2 or 3 days of work.

Does a shared database slow down as tenants grow?

RLS policies add roughly 2 to 10% query overhead when tenant_id is indexed. Beyond a few hundred million rows, partitioning by tenant solves most issues.

Let's scope your project. We audit your current architecture, size the isolation model your enterprise accounts need and plan a zero-downtime migration over 2 to 4 months. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.