Why should you care?

SaaS winners ship weekly. The data platform must isolate tenants, scale, and enable features like AI search without weekly downtime.

See it live — copy this example

Open mongosh or MongoDB Compass, select database nosqlverse, then run the example. Change one field and run again.

db.tenants.insertOne({ _id: "acme", plan: "pro", region: "IN" })
db.projects.insertOne({ tenantId: "acme", name: "Website redesign", status: "active" })
db.projects.createIndex({ tenantId: 1, status: 1, updatedAt: -1 })
db.projects.find({ tenantId: "acme", status: "active" }).sort({ updatedAt: -1 }).limit(20)
// Every query in the app injects tenantId from the auth token — never from the client alone

Run Example »

Edit the code below and click Run to see the result in Toolliyo’s live editor.

What happened?

• tenants holds plan metadata.
• projects are scoped by tenantId with a supporting index.
• The critical rule: server derives tenantId from auth, not from untrusted client input alone.

Practice next

1. Add tenantId to all business collections in a sketch.
2. Create compound indexes starting with tenantId.
3. Enforce tenantId in a repository helper.
4. Add a unique index { tenantId: 1, slug: 1 } on projects.
5. Simulate two tenants and prove isolation with find tests.

Remember

Tenant scoping is non-negotiable. Index tenantId first on hot collections. Combine Atlas security with app authz.

B2B project tracker

Acme and Globex share one cluster; every query filters tenantId.

Outcome: Enterprise security review passes data isolation checks.