Why should you care?

PostgresVerse B2B SaaS serves 500 tenants on one cluster; leak between tenants ends the company.

See it live — copy this example

Run in pgAdmin or psql.

CREATE TABLE tenants (
  tenant_id serial PRIMARY KEY,
  name text NOT NULL
);
CREATE TABLE tenant_users (
  user_id bigserial PRIMARY KEY,
  tenant_id int REFERENCES tenants(tenant_id),
  email citext NOT NULL,
  UNIQUE (tenant_id, email)
);
ALTER TABLE tenant_users ENABLE ROW LEVEL SECURITY;
CREATE POLICY p_tenant ON tenant_users
  USING (tenant_id = current_setting('app.tenant_id')::int);

What happened?

• citext email per tenant unique.
• RLS policy filters rows by session tenant setting apps set per JWT.
• Schema separates tenants table registry from user data.

Practice next

1. Create tenants and tenant_users.
2. Insert two tenants with users each.
3. SET app.tenant_id and SELECT — see isolation.
4. Add tenants plan column; quota function per tenant.
5. Schema-per-tenant compare for enterprise whale customer.

Remember

tenant_id on every business table. RLS enforces isolation at database. UNIQUE constraints often composite with tenant_id.

PostgresVerse SaaS launch

500 SMB tenants onboard; RLS tests in CI with two SET sessions.

Outcome: SOC2 auditor validates tenant isolation without code review every endpoint.