Software Tenant Isolation Checklist

Tenant isolation ensures one organization or account cannot read, change, or infer another's data. The boundary must hold across ordinary requests, background jobs, files, exports, caches, logs, search, and support tools—not only on the main database query.

Define the tenant identity

Choose the organization, account, workspace, or customer identifier that scopes data. Derive it from an authenticated relationship rather than trusting a browser-supplied value, and document how users who belong to more than one tenant switch context.

Scope every data access path

Review reads, creates, updates, deletes, reports, search, bulk actions, imports, exports, and administrative tools. Require a tenant constraint or an explicit approved cross-tenant operation, then test both allowed and denied access.

Protect files and derived data

Scope object-storage paths, signed links, thumbnails, document previews, cache keys, search indexes, notifications, and generated reports. A correct database query does not protect a file URL or a cached response that omits tenant identity.

Carry context through jobs and integrations

Include tenant identity in queue payloads, scheduled jobs, webhooks, provider records, retries, and audit events. The internal tool security checklist helps review staff access and connected systems.

Check roles and support access

Separate tenant administrator, member, support, system, and emergency access. Make elevated cross-tenant support visible, time-bound, approved, and auditable. Avoid broad database or storage access as a shortcut for support workflows.

Use the API security checklist for authentication and authorization boundaries, and the application health checklist for monitoring isolation failures.

Test leakage and inference

Use two test tenants with similar and different records. Test IDs, slugs, search, counts, errors, exports, file links, caches, jobs, logs, notifications, and timing. Confirm that an empty result does not disclose whether another tenant's record exists.

Monitor and respond

Alert on unauthorized tenant identifiers, cross-tenant query patterns, denied access spikes, support elevation, and unexpected result counts. Document containment, evidence preservation, customer communication, and corrective action before a real incident occurs.