Overview
Choose tenant isolation based on compliance needs: shared schema (cheap), separate schemas (balanced), or separate databases (strongest).
Strategies
- Shared schema — one table, tenant_id + RLS.
- Separate schemas — per-tenant schema, shared app.
- Separate databases — maximum isolation, more ops.
Config
resolve tenant
const tenant = await resolveTenant(req.hostname);
db.setTenant(tenant.id); // sets app.tenant_id for RLS