DevelopersBusinessPre-alpha
Isolation model
Clarify tenancy expectations before deployment planning.
One-database model
A Sumeru deployment is one PostgreSQL database with multi-company records and group ACLs. Company context filters and UX (company switcher) are not the same as separate tenants with separate databases.
What that means
| Expectation | Reality in core today |
|---|---|
| Separate customers on one process | Not a hard SaaS isolation boundary |
| Company_id on records / users | Supported for multi-company operations |
| Row-level rules | Evolving; verify in ORM security before relying on them |
Planning. If you need strong tenant isolation, use separate databases (and usually separate processes) per tenant until a dedicated tenancy story exists.
Planning checklist
- Decide: multi-company single org vs true multi-tenant.
- Map groups per company with intent.
- Keep backups and credentials per deployment boundary.
What not to do
- Do not market shared-DB company switching as full tenant isolation.
- Do not mix unrelated customers' data without a written isolation design.
Next step
Return to Security overview or Deployment.