You run all tenants in one shared database. Why should I accept that over a dedicated instance per customer?

The full executive answer

Shared-schema multi-tenancy with database-enforced isolation is the mainstream architecture for enterprise SaaS — it is what Salesforce runs — and the trade-off analysis is codified in the AWS SaaS Lens: silo per customer gives isolation at the cost of operational sprawl, version skew, and per-tenant cost; pooled tenancy gives uniform operations and economics, and the isolation question moves to how rigorously the boundary is enforced. Our answer to that question is unusually strong: isolation is enforced by the database itself, not by application code. Row-level security — RLS — means Postgres attaches your organisation's identity to every query and physically will not return another tenant's rows, even if our application code has a bug.

Two properties make our implementation defensible to an architect. First, the tenant identity comes only from the verified sign-in token, resolved server-side — never from anything a client sends — so the boundary cannot be forged from outside. Second, and this is the part I have not seen elsewhere: the isolation rule is enforced on our engineers by the build pipeline. A static test in CI scans every database migration, and if any table carrying tenant data lacks an RLS policy, the build fails. The next engineer cannot forget isolation; the pipeline will not let them.

And the models are not mutually exclusive in our architecture: it is already cell-based — the EU and India cells are defined in configuration — and a cell is also the mechanism for a dedicated single-tenant deployment at the top tier. So pooled economics by default, silo as a premium, on the same codebase. That is the SaaS Lens playbook, deliberately followed.