Question

A healthcare SaaS company is designing a new multi-tenant platform on Google Cloud. Each tenant is a separate hospital that must have strong data isolation to satisfy contractual and regulatory obligations, but the company also wants to minimize operational overhead and control costs as it onboards hundreds of tenants over time. Tenants share the same application code but must never be able to access another tenant's data, and the company must be able to demonstrate isolation boundaries to auditors. Which design approach best meets these business requirements?

Accepted Answer

Use a shared application layer but isolate each tenant's data into its own project or resource boundary with IAM policies, while standardizing deployment through infrastructure-as-code templates.

Answer

Deploy a single shared application layer and store all tenant data in one shared database, using an application-enforced tenant_id column to filter every query.

Answer

Provision an entirely separate Google Cloud project, VPC, and dedicated infrastructure for every tenant to guarantee complete isolation.

Answer

Store all tenants in one database but encrypt each tenant's rows with a distinct customer-managed key to enforce isolation.