Case Study: Design a Multi-Tenant SaaS System

Mental Model

Connecting isolated components into a resilient, scalable, and observable distributed web.

Designing a SaaS platform like Slack or Shopify requires choosing a Multi-tenancy Strategy. You must decide how to isolate data for different companies (Tenants) while sharing the same infrastructure.

1. The Three Isolation Models

graph LR
    Producer[Producer Service] -->|Publish Event| Kafka[Kafka / Event Bus]
    Kafka -->|Consume| Consumer1[Consumer Group A]
    Kafka -->|Consume| Consumer2[Consumer Group B]
    Consumer1 --> DB1[(Primary DB)]
    Consumer2 --> Cache[(Redis)]

A. Silo (Database-per-tenant)

Every tenant has their own separate DB instance.

• Pros: Strongest isolation, easy to back up/restore individual tenants.
• Cons: High cost, hard to manage thousands of DBs.

B. Bridge (Schema-per-tenant)

Tenants share the same DB instance but have separate schemas or tables.

• Pros: Balanced cost and isolation.
• Cons: Still hits DB limits (max number of tables).

C. Pool (Shared-schema / Partitioning)

All tenants share the same tables. Rows are distinguished by a tenant_id.

• Pros: Lowest cost, easiest to scale globally.
• Cons: High risk of "noisy neighbor" and data leaks if the app layer has a bug.

2. Noisy Neighbor Problem

One massive tenant (e.g., Apple) uses 90% of the DB resources, making the system slow for 100 small tenants.

• Fix: Tenant-level Rate Limiting and Dedicated Shards for high-value customers.

3. High-Level Architecture

1. Tenant Gateway: Identifies the tenant from the URL (apple.slack.com) or header.
2. Context Service: Provides the connection string or shard ID for that specific tenant.
3. App Layer: Injects tenant_id into every SQL/NoSQL query automatically.

Final Takeaway

Multi-tenancy is about Resource Efficiency vs. Risk. Start with a Pooled model for scale, but implement strict isolation logic at the application layer.

Engineering Standard: The "Staff" Perspective

In high-throughput distributed systems, the code we write is often the easiest part. The difficulty lies in how that code interacts with other components in the stack.

1. Data Integrity and The "P" in CAP

Whenever you are dealing with state (Databases, Caches, or In-memory stores), you must account for Network Partitions. In a standard Java microservice, we often choose Availability (AP) by using Eventual Consistency patterns. However, for financial ledgers, we must enforce Strong Consistency (CP), which usually involves distributed locks (Redis Redlock or Zookeeper) or a strictly linearizable sequence.

2. The Observability Pillar

Writing logic without observability is like flying a plane without a dashboard. Every production service must implement:

• Tracing (OpenTelemetry): Track a single request across 50 microservices.
• Metrics (Prometheus): Monitor Heap usage, Thread saturation, and P99 latencies.
• Structured Logging (ELK/Splunk): Never log raw strings; use JSON so you can query logs like a database.

3. Production Incident Prevention

To survive a 3:00 AM incident, we use:

• Circuit Breakers: Stop the bleeding if a downstream service is down.
• Bulkheads: Isolate thread pools so one failing endpoint doesn't crash the entire app.
• Retries with Exponential Backoff: Avoid the "Thundering Herd" problem when a service comes back online.

Critical Interview Nuance

When an interviewer asks you about this topic, don't just explain the code. Explain the Trade-offs. A Staff Engineer is someone who knows that every architectural decision is a choice between two "bad" outcomes. You are picking the one that aligns with the business goal.

Performance Checklist for High-Load Systems:

1. Minimize Object Creation: Use primitive arrays and reusable buffers.
2. Batching: Group 1,000 small writes into 1 large batch to save I/O cycles.
3. Async Processing: If the user doesn't need the result immediately, move it to a Message Queue (Kafka/SQS).

Technical Trade-offs: Messaging Systems

Key Takeaways

• Pros: Strongest isolation, easy to back up/restore individual tenants.
• Cons: High cost, hard to manage thousands of DBs.
• Pros: Balanced cost and isolation.

Read Next

• Case Study: Design a Feature Flag System
• Deep Dive: Database Sharding

Verbal Interview Script

Interviewer: "How would you ensure high availability and fault tolerance for this specific architecture?"

Candidate: "To achieve 'Five Nines' (99.999%) availability, we must eliminate all Single Points of Failure (SPOF). I would deploy the API Gateway and stateless microservices across multiple Availability Zones (AZs) behind an active-active load balancer. For the data layer, I would use asynchronous replication to a read-replica in a different region for disaster recovery. Furthermore, it's not enough to just deploy redundantly; we must protect the system from cascading failures. I would implement strict timeouts, retry mechanisms with exponential backoff and jitter, and Circuit Breakers (using a library like Resilience4j) on all synchronous network calls between microservices."