Multi-tenant architecture, scoped per row, audited per query.
One database, many tenants, zero cross-tenant leaks. We build SaaS backends where every read and write carries its tenant scope through the type system, the query plan, and the audit log. The kind of architecture a security questionnaire passes without footnotes.
What we build
Row-level scoping in Postgres
Tenant ID stamped on every row, enforced at the database level via RLS policies. Application code asks for data; the database refuses to return rows that don't belong to the requesting tenant. No client-side filter to forget.
Type-safe tenant context
A typed `TenantContext` threads through every query path. Drizzle + TanStack Start make untyped queries a compile error, not a runtime bug. The architectural rule is enforced by the toolchain.
Per-tenant subdomains and custom domains
Tenant resolution at the edge: subdomain routing for the default, custom domains with automated cert provisioning for enterprise tiers. Middleware injects the resolved tenant before the request hits a handler.
Audit trails per tenant
Every state-changing call writes an append-only audit row tagged with tenant, actor, action, and before/after state. The audit table is itself tenant-scoped; tenants see only their own history.
Background jobs that respect tenancy
BullMQ workers receive tenant context as part of the job payload. A long-running export for tenant A can't read tenant B's data because the worker uses the same scoped query path as the request handler.
Migration patterns that scale per tenant
Schema changes are tenant-agnostic by default. When a feature ships per-tenant data, the migration tooling generates per-tenant backfills with rollback plans baked in.
Where this fits
Your SaaS started single-tenant and you need to onboard enterprise customers who require data isolation guarantees in writing.
You're losing deals on the security questionnaire because your tenant model can't pass a penetration test or an SOC 2 review.
You have a multi-tenant database but no architectural enforcement: a forgotten WHERE clause could leak data and you'd never know.
Tech stack
- TypeScript
- Postgres
- Drizzle
- TanStack Start
Want this for your team?
30 minutes with a founder or senior engineer. We'll scope what you need and tell you straight whether Stacklane fits.
Book a Free CallRelated capabilities