The Fear of Multitenancy

In the world of SaaS and cloud computing there is one single word that will send chills up the spines of mean in IT: Multitenancy.

From Wikipedia:

“Multitenancy refers to a principle in software architecture where a single instance of the software runs on a software-as-a-service (SaaS) vendor's servers, serving multiple client organizations (tenants). Multitenancy is contrasted with a multi-instance architecture where separate software instances (or hardware systems) are set up for different client organizations. With a multitenant architecture, a software application is designed to virtually partition its data and configuration so that each client organization works with a customized virtual application instance.”

That’s a lot of work just to say that you have your own space, at least logically, but physically you share and share alike.

It’s the sharing part that gets many concerned. They are comingling their data with other data they don’t control nor own. The fear is that somehow, some way, the data will leak out of one virtual application instance into another, and 1997 sales from one company could end up in 2007 new customers from another company. Security and data quality could be compromised, and thus why we need to push off our move to SaaS specifically, and cloud computing in general.

I’ve seen a few multitenant systems in my day, and the chances that data and processes will somehow intermingle, or that data and processes will get compromised due to use of a multitenant architecture is up there with lighting strikes and the lottery. Could happen, but it probably won’t.

Truth-be-told, I’m sure that a few cloud computing providers will screw up their multitenant architecture at some point, and some bad things will happen. However, it will be more in the form of service outages than security breaches and lost data. There are so many other things to worry about, that I would not even consider this to be in the top 10. I mean, we’ve been mixing and mingling programs and data for years now; in the past we just called it timesharing.

We have a tendency to jump on some issue that’s really not an issue, and right now Multitenancy seems to be that issue. While there is always some thread of truth to a fear, the movement to cloud computing, SaaS included, should not be hindered by this kind of stuff. It’s better to focus on the underlying business needs, your own architecture, and how to extend that architecture out to the platform of the clouds, looking then at the tradeoffs, including real issues around security, privacy, performance, and compliance.

To sit around and debate the security exposures when using a multitenant architecture when there are so many other issues to consider is just a waste of time. Don’t be those guys.