Multi-tenant security testing: prove no tenant can reach another.
Every SaaS customer assumes their data is walled off from everyone else's. That wall is rarely one control. It's a tenant filter repeated in every query, job, cache key, file path and support tool. Multi-tenant testing checks each of those places, as each tenant, on every release.
Eight Places Tenant Isolation Fails in Multi-Tenant SaaS
The main API is usually well guarded. Leaks tend to come from the paths built later, by a different team, or run in the background.
Object reads by ID
An endpoint loads a record by ID without checking the caller's tenant.
TEST · Request each tenant's canary object as every other tenant.List, search and filters
A search index or filter returns matches across tenants.
TEST · Search for another tenant's canary string.Exports and reports
The request is checked; the background job that builds the file isn't.
TEST · Generate exports and scan the file for foreign canaries.File storage
Predictable paths or long-lived signed URLs open another tenant's files.
TEST · Reuse paths and links across tenants and after expiry.Webhooks and events
Events fan out to the wrong subscriber or include another tenant's payload.
TEST · Subscribe as each tenant and inspect delivered events.Caches
A cache key omits the tenant, so one tenant is served another's response.
TEST · Warm the cache as one tenant, read it as another.Support and admin tools
Impersonation or internal tools skip the checks customers go through.
TEST · Scope support roles and test what they can reach.AI assistants and RAG
Retrieval pulls documents from a shared index without a tenant filter.
TEST · Ask each tenant's assistant about another's canary."Often missed" reflects where tenant checks are commonly absent, not measured incidence.
Pooled, Bridge and Silo: How Each Tenancy Model Leaks
Stronger separation moves the risk; it doesn't remove it. Pick your model to see where testing should focus.
Cross-Tenant Testing: Every Surface, Every Tenant Pair
Three tenants give six directions to test. Each cell asks one question: can the attacker tenant see the victim's canary on this surface?
Illustrative run · synthetic tenants and data · 20 s replay
Tenant Isolation Example: The Export Job That Forgot Its Tenant
The export endpoint checked the tenant. The background worker that built the file didn't. The leak only appears when you follow the request past the API, into the job and out through the download link.
Illustrative run · synthetic data
How to Build a Multi-Tenant Security Test Plan
Six ingredients. Set them up once and the same plan reruns on every release.
Running it safely in production →Three or more test tenants
With different plans, regions or settings, so direction-specific and config-specific bugs show up.
Roles inside each tenant
At least an admin and a standard member, plus any support or partner roles that cross tenants.
Canary records everywhere
Unique markers in records, files, comments and documents, so leaks are unambiguous.
A surface inventory
Every path data leaves through: APIs, search, exports, files, events, caches, tools and AI features.
Follow the request
Track work into async jobs, queues and generated files, not just the synchronous response.
Rerun on release
Run the full matrix from CI/CD so new features are tested against every tenant pair.
Where Tenant Isolation Evidence Gets Used
Customers' security reviews, your auditors and your own AppSec team all ask the same question in different words.
OWASP API Security Top 10 (2023)
API1 and API3 (object and property level authorization) and API5 (function level) are the API-layer forms of isolation failure.
USE IT FOR · Classifying isolation findings on APIs.CWE-639 and CWE-284
Authorization bypass through a user-controlled key, and improper access control more broadly.
USE IT FOR · Recording the root cause developers fix.SOC 2 (logical access)
Logical access criteria cover restricting access to data to authorized users, including between customers in shared systems.
USE IT FOR · Showing auditors isolation is tested, not just designed.ISO/IEC 27001
Annex A access-control and information access restriction controls apply to multi-tenant data segregation.
USE IT FOR · Evidence that segregation controls operate effectively.Security questionnaires
Enterprise buyers routinely ask how tenant data is segregated and how that is verified.
USE IT FOR · Answering with test evidence instead of architecture diagrams.Summaries are for orientation only. Confirm control mappings with your auditor.
Continuous Tenant Isolation Validation, With Evidence
Hayrok runs the cross-tenant matrix as each tenant and role you define, follows requests into jobs, files and integrations, and records proof for every cell. Reruns happen on every release, so isolation is a tested property, not an assumption.
Tenant and role identities
Define tenants and roles once; every scenario runs as each of them, with tokens managed for you.
Canary seeding and matching
Markers are planted in test tenants and matched in every response, file and event.
Beyond the synchronous API
Scenarios follow requests into exports, jobs, file links, webhooks and AI retrieval.
Matrix on every release
The full tenant-pair matrix reruns from CI/CD; regressions open as validated findings.
Evidence per cell
Each pass and each leak is stored with redacted request pairs in Evidence Fabric.
Multi-Tenant Security Testing FAQ
Testing whether one customer (tenant) of a shared application can read, change or infer another tenant's data. It covers every path data takes: APIs, search, exports, files, background jobs, caches, integrations and support tools.