Tenant Separation

Many programs today no longer run on your own computer, but in large data centers on the internet. A single provider operates software there for thousands of companies at the same time. Each of these companies is referred to as a tenant, meaning an individual customer with its own data. Tenant separation means: everyone uses the same software, but no one can see anyone else’s data. The customer list of company A and the customer list of company B might reside in the same database. Nevertheless, an employee of company A must never get to see anything belonging to company B.

What’s at stake if the separation breaks

Without reliable separation, the entire business model of modern online software would not be possible. No hospital would put patient data into a system that competitors also use. No tax advisor would store their clients' figures there. Separation is therefore not merely a technical detail, but the foundation of trust for the entire market.

On top of that comes legal pressure. The European General Data Protection Regulation requires that personal data be protected against unauthorized access. An error in which one customer sees another’s data counts as a reportable data protection breach. Such incidents can result in fines in the millions. For publicly listed providers, they are also a matter that affects the stock price.

Economically, shared use is very attractive. A provider only has to maintain and update the software once, not a thousand times. This is exactly why software from the cloud is often cheaper than a dedicated installation. The price for this is the responsibility to keep the separation permanently watertight.

From shared server to dedicated machine

There are several levels of how strictly one can separate. The cheapest variant uses a single database for everyone. Each data record is then given an identifier that indicates the tenant. The software must check with every query whether this identifier matches the logged-in user. If a developer forgets this check in one place, a leak is created.

It is safer to give each tenant its own database. The software remains the same, but the data resides in separate containers. The strictest level gives each customer entirely dedicated computing capacity. This costs more, but is often required by banks, government agencies, and in healthcare.

A helpful comparison is an apartment building. All residents share the foundation, roof, and stairwell, just as tenants share the software. But each apartment has its own lock, and no one can look through the wall. A dedicated server then corresponds to a detached house. In both cases it’s important to note: encrypting the data does not replace separation. It protects against attackers from outside, not against a programming error that shows data to the wrong customer.

Tenant separation in AI services and in tenders

This topic is especially current with AI services. When a company has a language model search through internal documents, those documents must not appear in the answers given to other customers. Providers therefore explicitly assure that customer data is not used to train the models. This very assurance is a form of tenant separation.

You encounter this principle in many places in everyday life. Your school might use a learning platform that thousands of other schools also use. Nevertheless, only your teachers see your grades. Online shops, accounting programs, and video conferencing services also work this way.

In the news, these terms usually appear in two contexts. Either a provider advertises this capability to win major clients or public contracts, or an error has occurred and users briefly saw someone else’s data. Such reports have occurred in the past even at very large providers. For investors, this question is therefore a standard point when evaluating software companies.