Multi-Tenancy, Security, and Compliance.

Welcome to Week 9#

Theme: Building Systems for the Real World#

For the past eight weeks, we've focused on making systems that work — scalable, reliable, and fast. But there's a dimension we've only touched on: making systems that are safe to operate in a regulated world.

What You'll Learn This Week#

The Big Picture#

Day 1: Tenant Isolation Strategies#

The Core Question: How do you serve thousands of customers on shared infrastructure while guaranteeing they can't see each other's data?

What You'll Build:

• Tenant context propagation across services
• Row-level security implementation
• Schema-per-tenant database architecture
• Tenant routing and request isolation

Key Trade-offs:

• Cost vs isolation level
• Operational complexity vs security guarantees
• Performance vs resource sharing

Day 2: Noisy Neighbor Prevention#

The Core Question: How do you stop one customer from consuming all resources and degrading service for everyone else?

What You'll Build:

• Per-tenant rate limiting
• Resource quota management
• Fair scheduling algorithms
• Tenant usage dashboards

Key Techniques:

• Token bucket per tenant
• CPU and memory quotas
• Query complexity analysis
• Graceful degradation

Day 3: Data Residency and GDPR#

The Core Question: How do you run a global platform while keeping data in the regions where it legally must stay?

What You'll Build:

• Regional data partitioning
• Cross-region data access controls
• Consent management system
• Data Processing Agreement tracking

Key Concepts:

• Data residency vs data sovereignty
• Standard Contractual Clauses
• Privacy by design
• Lawful basis for processing

Day 4: Right to Deletion (GDPR Article 17)#

The Core Question: When a user says "delete all my data," how do you actually do it across dozens of systems?

What You'll Build:

• Deletion request workflow
• Data inventory and mapping
• Cascading deletion across systems
• Deletion verification and audit

Key Challenges:

• Backups and point-in-time recovery
• Aggregated vs individual data
• Third-party data processors
• Proving deletion happened

Day 5: Security Architecture#

The Core Question: How do you build defense in depth for a system where one breach could expose thousands of customers' data?

What You'll Build:

• Service mesh security policies
• Secrets management
• Audit logging infrastructure
• PII detection and masking

Key Patterns:

• Defense in depth
• Least privilege access
• Separation of duties
• Fail secure (not fail open)

The Capstone: GDPR-Compliant Multi-Tenant SaaS Platform#

At the end of Week 9, you'll design a complete B2B SaaS platform that could pass an enterprise security audit.

This capstone will test your ability to combine:

• Tenant isolation strategies (Day 1)
• Resource management (Day 2)
• Data residency (Day 3)
• Deletion workflows (Day 4)
• Security architecture (Day 5)

Key Concepts to Master#

Multi-Tenancy Patterns#

Compliance Framework#

Security Principles#

%% title: Defense in depth
flowchart TD
  R@{ icon: "sd:user", label: "External Request" } --> L1@{ icon: "sd:firewall", label: "WAF · DDoS · Rate Limiting<br/>Layer 1: Perimeter" }
  L1 --> L2@{ icon: "sd:network", label: "VPC · Security Groups · Private Subnets<br/>Layer 2: Network" }
  L2 --> L3["AuthN · AuthZ · Input Valid. · Tenant Check<br/>Layer 3: Application"]:::core
  L3 --> L4@{ icon: "sd:database", label: "Encryption · Row-level Sec<br/>Layer 4: Data" }
  L5@{ icon: "sd:log", label: "Audit Logs · Anomaly Detection<br/>Layer 5: Monitoring" }
  L1 -.-> L5
  L2 -.-> L5
  L3 -.-> L5
  L4 -.-> L5
  class R client
  class L1 edge
  class L2 service
  class L4 store

Each layer assumes the others might fail.

Technologies You'll Work With#

Identity and Access Management#

Compliance Tooling#

Real-World Case Studies#

Throughout the week, we'll examine:

Slack's Multi-Tenancy#

Stripe's Compliance#

Salesforce Multi-Tenancy#

How Week 9 Connects to Previous Weeks#

What Success Looks Like#

By the end of Week 9, you should be able to:

Interview Relevance#

Week 9 topics are increasingly common in system design interviews:

Preparing for Week 9#

Prerequisites#

Make sure you're comfortable with:

• Database design (Week 1)
• API design patterns
• Authentication basics (OAuth, JWT)
• Basic encryption concepts

Mindset Shift#

Resources to Explore#

Before Starting#

• Read

  GDPR Overview: gdpr.eu

• Read

  OWASP Top 10: owasp.org

• Read

  SOC 2 Basics: Research the five trust principles

During the Week#

• Paper

  AWS Multi-Tenancy Whitepaper

• Docs

  Slack's Enterprise Security Documentation

• Docs

  Stripe's Security Documentation

Optional Deep Dives#

• Book

  "Building Secure and Reliable Systems" (Google SRE Book)

• Docs

  HashiCorp Vault Documentation

• Docs

  Open Policy Agent Documentation

Summary#

Week 9 begins tomorrow with Day 1: Tenant Isolation Strategies

Your systems have been fast. Now let's make them trusted.